Cloudflare deploys protections against the php2shell vulnerability

Cloudflare has deployed WAF protection against two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (collectively called php2shell), going live about 9 hours before public disclosure; free and paid WAF customers have been protected by default since 3:02 UTC on October 21. The vulnerabilities were disclosed by Calif.io, Wiz, OpenAI and Quarkslab, affect web servers running PHP 5.4 and above, and can lead to denial of service, remote code execution and data leakage; the root cause is a memory safety issue in PHP's error handling of HTTP requests. The vulnerabilities leaked before formal disclosure, and Cloudflare observed attack traffic targeting customers as well as attempts by attackers to vary payloads to bypass protections. Because the flaw is in the PHP runtime itself, updating only website code or plugins cannot fix it; administrators need to update the PHP software and keep WAF protection enabled.