Cloudflare said it developed and deployed web application firewall protections to shield customers from the php2shell flaws disclosed by Calif.io, Wiz, OpenAI and Quarkslab. The company said it began rolling out managed WAF rules in early October 2026 and put protections live from October 21 3:02 am UTC.
Cloudflare reported those protections reached customers about nine hours ahead of the public disclosure. The firm said its analysts observed leaked exploit traffic and attackers attempting to mutate payloads to bypass rules. Cloudflare added that its managed rules were updated as analysts tracked new variations.
The protections include new rules in the Cloudflare Managed Free Ruleset and the Cloudflare Managed Ruleset for paid plans. Cloudflare named the Free ruleset ID and the paid ruleset ID and said default deployments protect Free and paid customers alike. Customers can inspect blocked events in Security Analytics and adjust managed rule scope where needed.
Cloudflare described a new capability called full transaction detection that combines request and origin response signals in the same HTTP transaction. The company said response-aware rules can block a matching origin response before it reaches the requester. Cloudflare noted php2shell protections are the first managed detections released using this capability.
Implications Effects And Recommendations
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed php2shell, affect PHP versions 5.4 and later. Cloudflare said PHP underpins almost 70 percent of websites and that the flaws can allow denial of service, data exposure, or remote code execution when applications process specially crafted HTTP traffic.
Cloudflare explained how the bugs arise from unsafe memory handling during error conditions. One flaw involves PHP running out of memory and using uninitialized internal data during cleanup. The other leaves stale references after a fatal error that a later request can follow to access invalid memory. These behaviors can crash processes, leak data, or enable execution of attacker-supplied code.
Cloudflare urged administrators to apply the PHP vendor update because fixing application code or plugins does not eliminate the runtime flaw. The company advised keeping WAF protections enabled while patching and recommended limiting unnecessary uploads and upload sizes as temporary mitigations. Cloudflare said its security analysts will continue to monitor attack activity and refine rules as new techniques emerge.
