JA EN
shiichan

Protected About 9 Hours Before Disclosure: Cloudflare WAF Defends Against php2shell by Default

Cloudflare Blog ★★★★ View Markdown
#cloudflare#security#web

Hi everyone, Shii-chan here! Critical PHP vulnerabilities were just disclosed, but Cloudflare was already protecting customers ahead of time. Let's see how.

Cloudflare Blog blog.cloudflare.com

What was announced?

The Cloudflare Blog reports that Cloudflare deployed default web application firewall (WAF) protections for the newly disclosed PHP vulnerabilities, known as php2shell, before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.

Why it matters

Calif.io, Wiz, OpenAI, and Quarkslab disclosed two PHP flaws, CVE-2026-109618 and CVE-2026-109619. They affect all web servers running PHP 5.4 or later, and specially crafted HTTP traffic could cause denial of service, remote code execution, or data exposure. PHP runs about 70% of websites (per W3Techs) and underpins platforms like WordPress and Magento, so the potential impact is broad.

What changes

  • Cloudflare developed WAF protections starting in early October and deployed them about 9 hours before public disclosure
  • Starting at 3:02 am UTC on October 21, free and paid WAF customers were protected by default
  • Cloudflare reported observing attack traffic, with attackers mutating payloads to bypass rules. Analysts continue to monitor and will update rules as new variants appear

Dive Deep

The vulnerabilities

Both involve memory handling after errors:

  • CVE-2026-109618: PHP runs out of memory before some internal data is initialized, and during cleanup it may treat that unfinished data as valid
  • CVE-2026-109619: a fatal error leaves PHP holding references to memory freed at request end. A later request handled by the same process may follow those stale references and expose sensitive data

Updating application code or plugins does not fix these flaws. The PHP runtime itself must be updated, or the hosting provider must apply the patch. Limiting upload sizes and restricting uploads reduces exposure but is not a substitute.

Rules deployed

  • Free plan: Cloudflare Managed Free Ruleset (ID 77454fe2d30c4220b5701f6fdfb893ba) with seven "Generic Rules - Anomalous Execution" rules (1-7). No action is needed to enable them
  • Paid plans (Professional, Business, Enterprise): Cloudflare Managed Ruleset (ID efb7b8c949ac4650a09736fc376e9aee) with seven matching "Anomalous Execution" rules. Confirm the deployment is in block mode
  • All plans, including Free: Cloudflare Managed Response Firewall Default (rule ID afffe22785674c80a31875c848d2242a), "Default block for High confidence Signatures"

The last rule uses the new full transaction detection capability, which analyzes request and response signals within the same HTTP transaction. Response-side rules can block a matching origin response before it reaches the requester, which also helps reduce false positives. The php2shell protections are the first managed detections to use it.

Recommended actions

  • Review blocked events in Security > Security Analytics > Events by filtering on the rule IDs above
  • Adjust managed ruleset scope to relevant application paths if needed
  • Apply the PHP vendor update to affected repositories as soon as possible and keep WAF protections enabled during patching (the PHP advisory at php.net has the remediation details)
  • Track rule changes in Cloudflare's WAF changelog

Wrap-up

  • php2shell is two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.4 and later
  • Cloudflare deployed default WAF protections to all plans, including Free, about 9 hours before disclosure
  • The real fix is updating the PHP runtime; the WAF buys you time
  • The protection is the first to use full transaction detection, looking at request and response together

If you run PHP sites or WordPress, check your WAF settings and get the PHP update going right away!

Related posts