JA EN
shiichan

Can You Beat the WAF? Cloudflare Launches a PHP Capture the Flag Challenge

Cloudflare Blog ★★★★ View Markdown
#cloudflare#security#web

Hi everyone, Shii-chan here! Cloudflare just sent a challenge to everyone who loves security, and I'm excited.

Cloudflare Blog blog.cloudflare.com

What was announced?

In the Cloudflare Blog, a PHP Capture the Flag (CTF) challenge has launched. It's integrated with the Bug Bounty program to test Cloudflare's WAF protections, and security researchers are invited to bypass the defenses and capture the flag.

Why it matters

The challenge targets the two PHP flaws behind the "php2shell" disclosure (CVE-2026-109618 and CVE-2026-109619). Cloudflare updated its WAF with rules against them and introduced "full transaction detection", both available on all plans including Free.

The challenge checks whether those defenses hold up against real attackers.

What changes

  • Researchers can try WAF bypasses with official permission
  • Successful findings may qualify for awards through HackerOne (amounts aren't stated in the post)
  • Cloudflare can find gaps in its defenses sooner

Dive Deep

Goal: bypass the WAF, achieve code execution in the PHP sandbox, and recover the contents of /flag.

Setup

  • Stock PHP 8.5.11 with standard extensions
  • Apache 2 via mod_php
  • An empty index.php inside a Cloudflare Container
  • Default WAF rules for these vulnerabilities enabled
  • /flag is reset every few minutes along with the sandbox

How to participate

  • Sign up for HackerOne and agree to the Bounty Terms
  • Only authorized POST requests to the WAF-protected /php/* endpoints on the challenge hostname are in scope
  • Demonstrate attacker-controlled PHP or command execution via POST, then recover the current /flag
  • Verify promptly in the CTF UI, since the sandbox resets
  • Submit a private HackerOne report with "PHP CTF" in the title (endpoint, full payload, request sequence, UI verification result, UTC timestamps, and so on)

Not eligible

  • File disclosure without RCE
  • RCE without flag recovery and UI verification
  • Local-only exploits
  • Rediscovery of the known PHP vulnerabilities
  • WAF detection differences or partial chains

Rules: use test data only. Denial of service, high-volume scanning, persistence, social engineering, and attacks on other participants are prohibited. Back off on 429 or 503 responses. Awards require a materially distinct bypass method, and only the first complete, reproducible report counts.

One important reminder: the WAF is not a substitute for patching. Blocking a response can't undo actions already performed at the origin.

Wrap-up

  • The goal is to bypass the WAF and recover /flag from the PHP sandbox
  • Targets are the two php2shell CVEs, on PHP 8.5.11 with mod_php
  • Reports go through HackerOne, and only the first reproducible, materially distinct one counts
  • The WAF rules are available on all plans, but you still need to patch PHP

A fun one for anyone who likes WAF bypasses and PHP security!

Related posts