Cloudflare has deployed new Web Application Firewall (WAF) rules to mitigate two critical vulnerabilities in the PHP programming language, identified as CVE-2026-109618 and CVE-2026-109619. These flaws, collectively referred to as php2shell, can lead to denial-of-service attacks, remote code execution, and sensitive data exposure.
The protection was activated on October 21, 2026, approximately nine hours before the vulnerabilities were publicly disclosed. Cloudflare implemented these measures in coordination with the PHP Foundation, OpenAI, and Wiz. The company observed active exploitation attempts against its customers even before the official disclosure.
The deployment marks the first use of Cloudflare's new Full Transaction Detection capability, which analyzes both incoming requests and server responses to improve accuracy. Free and paid customers with WAF enabled received the protection automatically, though paid users are advised to ensure the rules are set to block mode.
Despite the WAF protection, Cloudflare emphasizes that these measures are not a substitute for official software updates. Administrators are urged to install the official PHP patches as soon as possible to permanently resolve the underlying security flaws, as WAF rules may not catch all future attack variants.
