php2shell vulnerability: Cloudflare deploys WAF protections

According to the Cloudflare Blog, Cloudflare has deployed web application firewall protections to defend sites against the php2shell vulnerability, a pair of PHP runtime flaws tracked as CVE-2026-109618 and CVE-2026-109619. The company says these protections were in place roughly nine hours before the vulnerabilities were publicly disclosed, and they are active for customers using Cloudflare's WAF on all plans, including Free.

What Cloudflare rolled out

Cloudflare says it worked with the PHP Foundation, OpenAI, Wiz, and other organizations to coordinate mitigations and to deploy multiple WAF rules and response protections. The blog explains that the new protections include managed rulesets that are enabled automatically for customers using the Free or paid WAF. For paid plans, Cloudflare recommends checking that the Managed Ruleset is deployed in block mode.

To improve detection confidence, Cloudflare developed a new capability it calls "full transaction detection," which combines signals from the HTTP request and the origin response to identify exploit attempts. Cloudflare says response rules can block a matching origin response before it reaches the requester, and the php2shell protections are the first managed detections released using this capability. The company also reports seeing attack traffic and payload mutations after the vulnerability leaked, which is why these managed rules are being updated as new techniques appear.

Why the php2shell vulnerability matters

Cloudflare reports that the php2shell flaws affect PHP 5.4 or later and arise from unsafe memory handling when a request fails or a fatal error occurs. The vulnerabilities may let an attacker cause denial of service, read sensitive data from memory, or execute arbitrary code on a vulnerable server. Because PHP is widely used, including by platforms like WordPress and Magento, these runtime flaws could affect many applications.

Because the issues are in the PHP runtime itself, the Cloudflare Blog stresses that updating application code or plugins alone does not fix the problem. Administrators need to update the PHP software running their sites. The blog also notes a later update: the PHP project published an informational advisory for a related issue, CVE-2026-115560, which affects fully patched PHP releases and will be fixed in PHP's next regular release. Cloudflare says its WAF customers are protected against known exploit attempts when the site uses PHP's default session.upload_progress.name, but customers who have changed that setting are not covered by the WAF rule.

Practical steps for site owners

• Apply the PHP vendor advisory and update the PHP runtime on your servers, or ask your hosting provider to apply the update if they manage PHP for you. The Cloudflare Blog advises updating PHP repos as the correct fix.
• Keep Cloudflare WAF protections enabled while you patch, since Cloudflare reports managed rules are protecting customers by default on all plans.
• Review Cloudflare Security Analytics for blocked requests and matched rules. Cloudflare suggests filtering by the relevant rule IDs and inspecting matched requests, actions, and paths to see whether the action came from a managed or custom rule.
• Verify response rules are active in the Cloudflare dashboard under Security > Security Rules, and confirm the Managed Ruleset is in block mode for paid plans if appropriate.
• Restrict unnecessary uploads and limit upload sizes as a temporary risk reduction; the blog notes these measures reduce exposure but do not replace the PHP update.
• If your site changed PHP's session.upload_progress.name, be aware the Cloudflare WAF rule may not cover that case; check your application configuration and rules scope.

If you want help reviewing Cloudflare rules or updating a WordPress site or Formidable Forms setup, get assistance from a Formidable Masterminds developer at /contact.html.

What to watch next

Cloudflare says its security analysts are monitoring attack activity and updating rules as attackers change payloads. The company points to its changelog and security analytics for ongoing updates. Also follow the PHP project advisory for official remediation steps and information about the related CVE-2026-115560 item that the PHP project says will be fixed in a future release.

The key point for site owners is this: Cloudflare's managed WAF protections offer an additional layer of defense, but they are not a substitute for applying the PHP vendor updates. If you host PHP sites or use hosted platforms that rely on PHP, confirm your PHP runtime is updated and keep monitoring WAF logs for blocked attempts.