Introducing the Cloudflare PHP Capture the Flag challenge
- ID
- 39963
- Status
- summarized
- Published
- 27 Oct 2026, 9:00 PM
- Fetched
- 27 Oct 2026, 10:47 PM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/php-ctf/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 3.5
- Created
- 27 Oct 2026, 10:48 PM
- Tags
- Audience
- developerssaas_founders
What happened
Cloudflare launched a limited-time Capture the Flag via its HackerOne bug bounty program: a deliberately vulnerable sandbox running stock PHP 8.5.11 (Apache 2 via mod_php) behind default WAF rules, targeting CVE-2026-109618 and CVE-2026-109619 — the two vulnerabilities behind php2shell — with a /flag file that resets every few minutes. It follows a week in which eight eMudhra intermediate certificates were compromised and the PHP flaws landed; Cloudflare says it shipped client updates, new WAF rules, and a 'full transaction detection' feature made available on all plans including Free.
Why it matters
If you run PHP, the concrete action is to confirm your runtime is patched and the WAF rules for CVE-2026-109618 and CVE-2026-109619 are active — but the CTF itself is evidence that the WAF layer is being actively probed for bypasses, so treat it as a speed bump, not the fix. Plan on patching PHP as the primary control and WAF as defence in depth.
Discussion angle
When a WAF vendor pays researchers to break its own rules in public, how would your stack behave the week a bypass lands — do you know your PHP patch level and whether those rules are actually enabled on your plan?