Cloudflare deploys protections against php2shell vulnerability

What it is

Cloudflare's WAF protections for php2shell, two PHP runtime memory-handling flaws (CVE-2026-109618 and CVE-2026-109619) disclosed on 21 October 2026 by Calif.io, Wiz, OpenAI and Quarkslab. They affect all web servers running PHP 5.4 or later. Cloudflare says impact can be denial of service, remote code execution and data exposure.

How it works

Both flaws arise when PHP stops processing an HTTP request unexpectedly, for example by running out of memory. PHP then fails to clean up safely and later uses data that was not fully set up, or memory that was already released. The two CVEs differ in when the unsafe access happens, but the page does not give that breakdown in the text fetched. Large requests are one way to create memory pressure, but the page says the problem goes beyond resource exhaustion.

Cloudflare's rules use a new capability, full transaction detection, which combines request and origin response in one HTTP transaction. A matching response rule can block the origin response before it reaches the requester. The page says this lets rules judge whether an exploit succeeded and cuts false positives. php2shell is the first managed detection to use it.

Preconditions / Affected

• PHP 5.4 or later, which covers WordPress and Magento deployments among others.
• The flaw is in the PHP runtime, so updating site code or plugins does not fix it.
• Cloudflare reports attack traffic against its customers after the vulnerability leaked before the official release date. It saw attackers mutating payloads to bypass rules.

What to do

• Update PHP itself, following the PHP advisory for affected versions and fixes. If a host manages PHP, ask the host to apply the update.
• Free plans: protection is on by default in the Cloudflare Managed Free Ruleset (ID 77454fe2d30c4220b5701f6fdfb893ba).
• Professional, Business and Enterprise plans: rules are in the Cloudflare Managed Ruleset (ID efb7b8c949ac4650a09736fc376e9aee). Check that the deployment is in block mode.
• The response-side rules sit in the Cloudflare Managed Response Firewall Default, on all plans. The page's rule ID table did not come through in the fetched text.
• To review hits, go to Security > Security Analytics > Events and filter by rule ID. Events show whether a managed or custom rule acted.
• Scope the Managed Ruleset to the relevant parts of an application if tuning is needed.
• Restricting unnecessary uploads and limiting upload sizes can reduce exposure.

Caveats

• Cloudflare states the WAF is defence in depth and not a substitute for patching. Upload limits likewise do not replace the PHP fix.
• Rule descriptions are marked as pending update, and analysts will change rules as new bypass techniques appear. Track changes in the Cloudflare changelog.
• The page names no fixed PHP versions and gives no exploit detail beyond the mechanism above.