Cloudflare has implemented default Web Application Firewall (WAF) defenses against recently revealed PHP vulnerabilities even prior to their public disclosure. These rules utilize signals from both requests and responses to thwart exploitation attempts and prevent data exposure to malicious actors.
On October 23, the PHP project released an informational advisory concerning a related issue, CVE-2026-115560, within PHP's session upload progress function. This affects fully patched PHP versions, including 8.5.12, and a fix is slated for PHP's subsequent standard release. Cloudflare WAF clientele are shielded against known exploit attempts if their site employs PHP's default upload progress field name. However, customers who altered session.upload_progress.name are not covered by this WAF rule.
The existing rule, "PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6," addresses this specific vulnerability. On October 21, Calif.io, Wiz, OpenAI, and Quarkslab publicized two PHP flaws, cataloged as CVE-2026-109618 and CVE-2026-109619, known as php2shell. These flaws impact all web servers running PHP 5.4 or later and could permit an attacker to induce denial of service, remote code execution, or data exposure when an application processes specially crafted HTTP traffic.
Cloudflare has participated in a coordinated effort to deploy safeguards across the Internet, collaborating with the PHP foundation, OpenAI, and Wiz among others. Cloudflare began deploying WAF protections in early October 2026, approximately nine hours before the public announcement. Beginning at 3:02 am UTC on October 21, Cloudflare customers utilizing the free or paid WAF were automatically protected against php2shell.
Observing attack traffic targeting its customers while the vulnerability was leaked before the official release date, Cloudflare noted how attackers were modifying payloads to evade its protections by monitoring match volume and cross-referencing with rule logic. Defending against php2shell necessitated more than standard request-based rules, as request data alone often lacks sufficient evidence to differentiate an exploit from legitimate traffic.
To enhance detection, Cloudflare developed full transaction detection, a new WAF capacity that integrates signals from the request and response within a single HTTP transaction. This allows response rules to block a matching origin response before it reaches the requester. The php2shell protections represent the initial managed detections released using this capability.
The php2shell vulnerabilities stem from how PHP manages memory during errors while processing an HTTP request. When processing halts unexpectedly, such as due to memory exhaustion, PHP may fail to safely clean up memory. These flaws occur when PHP handles an error and subsequently attempts to utilize data that was not fully initialized or memory that had already been released.
The two vulnerabilities differ in the timing of the unsafe memory access. CVE-2026-109618 occurs when PHP runs out of memory and interrupts work before internal data is fully initialized, potentially using this unfinished data during cleanup. CVE-2026-109619 happens when a fatal error interrupts a request, leaving PHP holding references to memory that is released upon request completion; a later request might then access this invalid memory.
Because these flaws reside in the PHP runtime, updating application code or plugins is insufficient for remediation; administrators must update the PHP software itself. Market participants should keep Cloudflare WAF protections active while applying vendor updates, as these measures serve as an additional layer of defense-in-depth.
The php2shell vulnerabilities affect the PHP runtime, and since PHP powers nearly 70% of websites, these flaws have the potential to impact a vast quantity of applications across the Internet, given that PHP underpins widely used platforms such as WordPress and Magento. This situation highlights the critical operational necessity for platform maintainers to address underlying runtime security issues swiftly.
