The organization is initiating a PHP Capture the Flag exercise, integrated within its existing Bug Bounty program, specifically designed to evaluate the efficacy of its Web Application Firewall (WAF) defenses. Security experts are encouraged to attempt to circumvent these protective measures and obtain the flag, thereby contributing to the enhancement of overall Internet security.
This initiative follows a recent period of significant security events; just last week, eight intermediate certificates belonging to eMudhra were compromised, creating a potential avenue for forged certificates used to impersonate servers. Furthermore, the discovery of php2shell brought to light severe flaws within PHP, the runtime environment underpinning a substantial portion of web applications. Throughout these developments, Cloudflare operated continuously to safeguard its clientele and aid in protecting the broader Internet. The company deployed client updates and implemented numerous safeguards, augmenting its WAF with novel rules to impede attackers exploiting the PHP weaknesses, alongside introducing a new capability known as full transaction detection. In these kinds of crises, these enhanced features were made accessible across all service tiers, including the Free tier.
Recognizing that safeguarding systems against vulnerabilities is a continuous endeavor rather than a singular occurrence, this challenge serves as a practical test for the WAF. The increasing integration of artificial intelligence empowers malicious actors to uncover novel attack vectors with remarkable swiftness and efficiency, making the collection of real-world data to validate assumptions and reinforce defenses absolutely crucial. Consequently, the Cloudflare PHP Capture the Flag challenge is being launched today, operating under the auspices of the Bug Bounty program. A deliberately flawed PHP installation has been placed behind the WAF, and security researchers are invited to attempt bypassing the safeguards to capture a flag via the HackerOne platform.
The mechanics of this Capture the Flag (CTF) are straightforward. The focus is centered on CVE-2026-109618 and CVE-2026-109619, which are the specific PHP vulnerabilities underlying php2shell. The target environment utilizes stock PHP 8.5.11 (including standard PHP extensions), Apache 2 running via mod_php, and an empty index.php situated within a Cloudflare Container, all protected by the default WAF rules configured for these vulnerabilities. Within this isolated environment resides a file named /flag, and this sandbox undergoes a refresh every few minutes, including the flag file itself. The objective presented is to successfully bypass the WAF protections, exploit the PHP sandbox, and retrieve the data contained in /flag. Researchers may utilize their own investigative instruments for this purpose. The challenge portal furnishes details regarding the environment, the scope of the test, and a form for flag verification.
This time-limited competition is managed through Cloudflare's Bug Bounty program on HackerOne. Every facet of this challenge is governed by the HackerOne terms and the specific rules of the Cloudflare HackerOne program, collectively termed the “Bounty Terms.” Should a participant uncover an acceptable bypass, they must adhere to these stipulations to claim the reward:
* All involved parties must register on a HackerOne account and assent to the Bounty Terms prior to engaging in the CTF. * The submission must demonstrate PHP code or command execution controlled by the attacker within the sandbox via an authorized POST request. * This remote code execution (RCE) must then be leveraged to retrieve the current contents of /flag, followed by successful validation of the flag through the CTF's user interface (UI). Verification must occur quickly before a reset; the successful outcome should be preserved for subsequent review. * A private report must be submitted to Cloudflare on HackerOne, ensuring "PHP CTF" is in the title, and providing: * The endpoint, the complete payload, and the sequence of requests, maintaining relevant headers, encoding, and body bytes. * Raw request/response captures or a readable proof of concept adequate to reproduce the entire chain. * An explanation detailing the WAF evasion, the code or command that was executed, and how that execution led to the retrieval of /flag. * The attempt ID, the UI verification result, and the UTC timestamps for both the exploit and verification. The flag should be included privately if necessary for verification. * An outline of what makes the technique or payload substantially unique, along with any related submissions the researcher is aware of.
UI verification does not equate to submitting a HackerOne report or establishing priority for reporting. Exploits that merely disclose file contents without RCE, RCE without successful flag recovery and UI verification, local-only exploits, rediscovering the already known PHP flaws, or differences in WAF detection or incomplete chains without achieving the full goal are ineligible. Rewards necessitate a method or exploit payload that constitutes a material departure, even when targeting the identical PHP CVE. Unique submissions are not granted for new flags, resets, attempt identifiers, or aesthetic modifications, including equivalent encodings. Duplicative submissions are deemed duplicates even if they remain unfixed; only the initial, complete, reproducible HackerOne report will be considered. Cloudflare retains the authority to render final judgments on duplicates and rewards. Metadata regarding attempts and request payloads is recorded by Cloudflare to aid in report analysis, so participants must exclusively use test data. Credentials, private data, or any other information not desired in a research record must not be transmitted. Reviewing Cloudflare’s privacy notice is required before testing commences. Testing is exclusively permitted against the WAF-protected /php/* endpoints of the challenge hostname (POST method only). Accessing other Cloudflare services, the underlying infrastructure directly, the upstream PHP project, or any third-party systems falls outside the defined scope. Actions such as denial of service, high-volume scanning, maintaining persistence, social engineering, or attacks against other participants are prohibited. If a 429 or 503 response is received, activity should cease. In any situation where this blog post conflicts with the Bounty Terms, the Bounty Terms shall take precedence. Cloudflare maintains the prerogative to halt or suspend this challenge at any point. Once the competition is removed from HackerOne, it is officially concluded, so participants should check the Cloudflare HackerOne page for the most current status regarding the challenge's availability.
It must be understood that the WAF provides a layer of protection, but it does not substitute for the necessity of patching vulnerable software. While response blocking can prevent data exposure to an attacker, it cannot reverse actions already completed at the origin. Any entity operating PHP must adhere to the latest PHP security advisories and implement the corresponding updates.
The events of the previous week served as a reminder that the advancement of a superior Internet frequently involves numerous contributors—maintainers, researchers, and industry teams—collaborating on difficult and urgent tasks. The organization hopes this challenge provides a valuable avenue for everyone to participate. Participation can commence by visiting php-rce.cloudflare.app; the flag is present, and the organization is keen to ascertain if participants can acquire it.
The necessity of continuously testing defenses is underscored by the rapid evolution of offensive capabilities, particularly with the widespread adoption of AI accelerating the discovery of new attack vectors. This ongoing need for validation drives the practice of collecting real-world data to strengthen security assumptions.
