Abstract:
Cloudflare, a global cloud services and network security company, announced on October 21, 2026 that it has deployed Web Application Firewall (WAF) protection rules against two serious security vulnerabilities known as "php2shell" in the PHP programming language. The two vulnerabilities are numbered CVE-2026-109618 and CVE-2026-109619 respectively, which may lead to denial of service, remote code execution and sensitive data leakage.
Cloudflare stated that the company began preparing protective measures before the vulnerability was officially made public and completed the deployment approximately 9 hours before the vulnerability was made public. Starting at 3:02 a.m. UTC on October 21, both free and paid customers who enable Cloudflare WAF will receive protection by default.
This protection work is one of the coordinated response actions that Cloudflare participated in together with the PHP Foundation, OpenAI, Wiz and other organizations. When vulnerability information is leaked in advance and attackers begin to try to exploit vulnerabilities, the relevant security teams continue to adjust protection rules and strive to provide additional protection for Internet services before website operators complete software upgrades.
Cloudflare said that before the vulnerability was officially made public, the company had observed attack traffic targeting customers. The security team also found that attackers continued to modify attack payloads in an attempt to bypass deployed protection measures. By tracking the number of rule matches and analyzing changes in attackers combined with rule logic, Cloudflare can continuously adjust the detection mechanism to deal with new attack variants.
PHP is a server-side programming language widely used on the Internet. Cloudflare cited data from W3Techs and pointed out that nearly 70% of the world's websites use PHP. Common website platforms including WordPress and Magento all rely on PHP to run. Therefore, once a serious vulnerability occurs in the underlying operating environment, it may affect a large number of websites, online services and enterprise applications.
This vulnerability affects the PHP runtime itself, not a specific website program or plug-in. An attacker can send a specially constructed HTTP request to the server, triggering PHP to handle memory problems in an abnormal state. According to information disclosed by Cloudflare, two vulnerabilities involve PHP's failure to safely handle related memory and internal state when out of memory or fatal errors occur during request processing.
The first vulnerability, CVE-2026-109618, involves exception handling after memory exhaustion. When PHP interrupts the request when some internal data has not been initialized, subsequent cleanup operations may mistakenly use these data that have not been effectively initialized as normal data, causing memory corruption.
The second vulnerability, CVE-2026-109619, involves the internal state that remains after the request ends. When a fatal error occurs in a request, the PHP process may continue to retain references to freed memory. If the same process subsequently handles another request, it may access memory that has expired, leading to the leakage of sensitive data or even creating conditions for further attacks.
An attacker can trigger these exceptions by constructing specific requests. Larger requests can cause memory pressure, but the risk is not limited to consuming server resources. Attackers may also exploit flaws in the program's handling of invalid memory to crash the PHP process, leak sensitive information, or execute code provided by the attacker.
In the face of such vulnerabilities, traditional web application firewall rules do not always provide a reliable enough basis for judgment. Cloudflare notes that by only inspecting incoming requests, it is sometimes difficult to accurately distinguish malicious attacks from normal traffic. If you can analyze the request and the response returned by the server at the same time, you will have the opportunity to obtain more contextual information, more accurately determine whether the attack is successful, and reduce the probability of mistakenly intercepting normal requests.
To this end, Cloudflare has developed a new WAF capability called "Full Transaction Detection". This mechanism combines request and response signals in the same HTTP transaction for analysis. When the detection rules confirm that a transaction meets attack characteristics, the response content from the source server can be intercepted before it is returned to the requester.
The protection rules deployed for php2shell are the first managed detection rules launched by Cloudflare using this new capability. The company believes that by comprehensively analyzing requests and responses, it can identify complex attacks while reducing possible misjudgments caused by relying solely on request characteristics.
In terms of specific deployment, Cloudflare stated that free package users do not need to manually enable new protection rules. The relevant rules have been automatically deployed in the free rule set hosted by Cloudflare. Paid packages provide protection through Cloudflare managed rule sets. Users of the Professional, Business and Enterprise editions should confirm that the relevant rule sets are enabled and in blocking mode, rather than just logging attack events.
Cloudflare also deploys default blocking rules for high-confidence attack signatures in its Managed Response Firewall default rules. Users can enter the security analysis interface to view intercepted requests, matching rules and related paths to understand whether their website is under attack. For customers who require more granular control, the scope of managed rule sets can also be adjusted.
However, Cloudflare has repeatedly emphasized that WAF protection can only be used as part of defense in depth and cannot replace the official PHP patch. Even if a website has the Cloudflare firewall enabled, administrators should still update the actual PHP software running on the server as soon as possible. The reason is that WAF mainly reduces risks by identifying and blocking known or detectable attack traffic, while the vulnerability itself still exists in the unpatched PHP running environment. Once an attacker adopts a new attack method, or the request is not accurately identified by existing rules, the system may still be at risk.
For organizations that cannot complete the upgrade immediately, Cloudflare recommends continuing to enable WAF protection, while limiting unnecessary file upload functions, and setting reasonable file size limits for upload interfaces that must be retained. These measures can help reduce the exposure of some attack paths, but they cannot completely solve the vulnerability problem. For websites using managed hosting, if the operator cannot directly manage the PHP version, they should contact the hosting service provider as soon as possible to confirm whether it has deployed official security updates.
Cloudflare stated that its security analysis team will continue to monitor attack activities and update protection rules based on new technologies and payload variants adopted by attackers. The company also recommends that users continue to retain relevant WAF protection while repairing PHP vulnerabilities to form a multi-layered defense.
This incident highlights the importance of Internet security response mechanisms. For underlying software vulnerabilities that have a wide impact and may be exploited remotely, simply releasing a patch is not enough to ensure that all websites are immediately restored to security, because the update speed, maintenance capabilities and server management methods of different operators vary greatly. Cloud service providers deploy protection rules in advance to buy valuable time between patch release and large-scale installation.
But in the long run, the most reliable solution is still to upgrade to the officially released repair version of PHP. Cloudflare's temporary protection measures can provide additional barriers for websites, but they cannot guarantee that all attack variants will be blocked. For websites running PHP, timely repair of the underlying operating environment, keeping firewall rules enabled, and continuous checking of abnormal requests are still key measures to deal with this php2shell vulnerability.
Related articles:
PHP has exposed serious security vulnerabilities, and global website operators have urgently entered a patching state
Comments