Introducing the Cloudflare PHP Capture the Flag challenge

What it is

Cloudflare's PHP Capture the Flag challenge runs through its HackerOne bug bounty program. The target is stock PHP 8.5.11 with standard extensions, Apache 2 via mod_php and an empty index.php, in a Cloudflare Container. Cloudflare's default WAF rules for CVE-2026-109618 and CVE-2026-109619 (the two vulnerabilities behind php2shell) sit in front of it. The goal is to bypass the WAF, get code execution and read /flag. The challenge page is php-rce.cloudflare.app.

Preconditions / Affected

Participants need a HackerOne account and must accept the Bounty Terms first. Testing is allowed only against the challenge hostname's /php/* endpoints, using POST. Direct access to the underlying infrastructure, other Cloudflare services, the upstream PHP project and third-party systems are out of scope. Denial of service, high-volume scanning, persistence, social engineering and attacks on other participants are banned. On a 429 or 503, back off.

What to do

To claim a bounty:

1. Show attacker-controlled PHP code or command execution through an authorized POST request.
2. Use it to read the current /flag and verify it in the challenge UI. The sandbox and flag reset every few minutes, so verify promptly and keep the result.
3. Submit a private HackerOne report with "PHP CTF" in the title. Include the endpoint, full payload and request sequence with headers, encoding and body bytes, plus raw captures or a readable proof of concept.
4. Explain the WAF bypass, the executed code and how it recovered /flag. Add the attempt ID, UI verification result, UTC timestamps, and what makes the method distinct.

UI verification does not file a report or set reporting priority.

For defenders running PHP, the post says to follow the latest PHP security advisories and patch. It states that response blocking cannot undo actions already performed at the origin.

Caveats

Awards require a materially distinct WAF bypass method, even for the same CVE. Different PHP exploits, payloads, RCE techniques, flag-recovery methods, equivalent encodings, new flags and new attempt IDs do not count as distinct. Only the first complete, reproducible report is considered, even if the bypass is unfixed. Cloudflare makes the final duplicate and reward decisions.

Not eligible: file disclosure without RCE, RCE without verified flag recovery, local-only exploits, rediscovery of the known PHP bugs, and WAF detection differences or partial chains.

Cloudflare records attempt metadata and request payloads, so only test data should be sent. The challenge is limited-time and can end at any time. The Bounty Terms override the post, and the HackerOne page shows whether the challenge is still open. The post gives no reward amounts.

The post also says Cloudflare shipped new WAF rules and a feature called full transaction detection on all plans, including Free. It gives no detail on how that feature works.