Cloudflare Deploys Protections Against php2shell Vulnerabilities

ArticleDaniele Molteni, Dan Jones, and Kuber NandwaniNews

Cloudflare has rolled out Managed WAF rules to protect against the php2shell vulnerabilities affecting PHP 5.4 and later. The mitigations introduce full transaction detection to block exploits before responses reach requesters.

Key points

  1. Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (php2shell) impact PHP 5.4 or later, potentially allowing denial of service, remote code execution, and data exposure via crafted HTTP requests.
  2. Mitigations were deployed across Cloudflare's free and paid WAF plans on 21 October 2026 at 03:02 UTC, roughly nine hours prior to public disclosure.
  3. A related vulnerability, CVE-2026-115560, affects PHP session upload progress up to version 8.5.12; default WAF rules protect sites unless session.upload_progress.name has been modified.
  4. To counter mutating payloads with low false positives, Cloudflare introduced full transaction detection, evaluating both request and response within an HTTP transaction.

Why it matters

Given the widespread adoption of PHP across the internet, critical RCE flaws affecting long-standing versions require immediate edge filtering while upstream vendor updates and local patches are deployed.

Analysis

Pure request-level signatures were insufficient to reliably catch php2shell variations without blocking legitimate traffic. By evaluating origin responses through full transaction detection, Cloudflare blocks confirmed successful exploits at the edge, though setups with customized upload progress directives remain exposed.

Mentioned links

Found in

Summary generated by AI (Gemini 3.8 Flash, 27 October 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Link:Calif Research

    PHP2Shell: Critical Remote Code Execution Flaws Uncovered in PHP

    Calif Research has disclosed PHP2Shell, detailing two severe PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) triggered via out-of-memory states and addressed in the October 2026 security release.

    Web development· Research

  • Link:watchTowr

    PHP2Shell: Exploited Remote Code Execution Vulnerabilities in PHP

    Dubbed PHP2Shell, two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) in PHP allow unauthenticated attackers to execute arbitrary code. Security firm watchTowr confirmed in-the-wild exploitation.

    Web development· Resource

  • Article:Wiz Research

    PHP2Shell: AI Uncovers Critical RCE Vulnerabilities Affecting Core PHP

    Wiz Research has disclosed PHP2Shell, a set of critical memory-safety vulnerabilities in the core PHP engine affecting versions dating back to PHP 5.4. Tracked under CVE-2026-109618 and CVE-2026-109619 with CVSS scores up to 9.2, they enable unauthenticated remote code execution and process-memory leakage. Researchers utilised frontier AI models to rapidly build and adapt complex exploit chains across targets.

    AI & LLMs· News

  • Link:Daniele Molteni and Celso Martinho

    Cloudflare Introduces Zero Wire to Track Critical Internet Vulnerabilities

    Cloudflare has launched Zero Wire, a public vulnerability intelligence feed on Cloudflare Radar. It provides concise briefings, remediation guidance, and pre-compiled AI agent prompts to help security teams evaluate critical CVEs affecting Internet-facing software.

    Security· Announcement

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.