Cloudflare says it deployed WAF mitigations for all free and paid tier customers to combat two PHP flaws by default, about nine hours ahead of public disclosure
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell.
Cloudflare
Context & Ripple Effects
PHP’s development team had signaled fixes for two 9.2-rated flaws, and then released security updates for critical unauthenticated RCE vulnerabilities affecting web request-serving installations. Reports described the issue as spanning PHP versions back to PHP 5, making exposure a web-infrastructure problem rather than a narrow application bug.
Cloudflare’s move adds a network-layer control to the patch cycle for sites behind its service. It matters because the mitigation was made the default across free and paid tiers before the disclosure window opened, while the PHP project’s updates remain the underlying remediation.
First-order effects
Cloudflare customers receive default WAF coverage against the known php2shell exploit vectors without needing to change their service tier or enable a rule manually.
PHP site operators still need to apply the vendor security fixes, since a WAF mitigation protects observed attack paths rather than replacing remediation of the affected software.
Second-order effects
Other CDN, WAF and managed-hosting providers face pressure to turn threat intelligence into broadly available default protections during high-severity disclosure windows.
For web operators, incident response becomes a two-track task: verify edge protections while scheduling and validating PHP updates across request-serving systems.
Third-order effects
The episode points toward coordinated vulnerability response in which maintainers patch the root cause while edge-security providers distribute interim controls across large customer bases.
As research identifies broadly deployed flaws faster, the differentiator for security platforms shifts toward how quickly validated detection signals become safe default coverage, not merely whether rules are available.
The trend: Critical web-software disclosures are increasingly handled through layered response, pairing upstream patches with pre-disclosure edge mitigations for exposed services.
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up…
@google
@google on x
Researchers at @wiz_io put Gemini 4 Argon to the test against complex cyber threats. In real-world testing, it found more than two times more vulnerabilities than baseline models — catching a critical risk that previous frontier models missed. See how they did it ↓
@cloudflare
@cloudflare on x
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://blog.cloudfla…
@kennwhite
Kenn White on bluesky
“Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.” — www.wiz.io/blog/php2she...
@ericjgeller.com
Eric Geller on bluesky
Wiz: “These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.” www.wiz.io/blog/php2she...
@mattburgess1
Matt Burgess on bluesky
Of course, the PHP vulnerabilities were allegedly discovered by AI — “In this post, we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase for more than a decade” — www.wiz.io/blog/php2she...
@jcoglan.com
@jcoglan.com on bluesky
you very urgently need to turn off every single running php process right now, no exceptions www.wiz.io/blog/php2she...
@jonty
Jonty Wareing on bluesky
Oh damn it's as bad as expected: If you are running anything on PHP turn it the hell off RIGHT NOW until you can patch it. — Yes this means every single Wordpress, Drupal, and Wikimedia install. — www.wiz.io/blog/php2she...
@rhyssullivan
Rhys on x
If you self host software, you really should put it behind either Cloudflare or Vercel's firewall The firewall rules & data they have on how people try to run exploits are so critical right now
@eastdakota
Matthew Prince on x
We had to invent a new form of WAF to mitigate this latest set of vulnerabilities. Now enabled by default for all customers for free.
Antoine Brossault
Antoine Brossault on linkedin
Next time you are on the market for a new WAF, keep this in mind: Cloudflare protected its clients 9 hours before the public disclosure of php2shell. …
r/CloudFlare
r on reddit
Cloudflare deploys protections against php2shell vulnerability
r/GeminiAI
r on reddit
Gemini 4 Argon credited for “invaluable contributions” to PHP2Shell vulnerability discovery
@burcs
Brandon on x
overwhelmed by the php vulns and not sure how or where to get started? we've added a copyable prompt to the cloudflare blog that you can feed your agent https://blog.cloudflare.com/ ... [image]
@alphaque
Dinesh Nair on x
Cloudflare is already detecting early attacks from the zero day RCEs for PHP, which powers many Malaysian websites. MKN, NACSA, National Cybersecurity Committee, MCMC have not issued any warnings nor are they doing anything about it. They're more worried about the Waze juice. [em…
r/cybersecurity
r on reddit
Wiz got pre-auth RCE on WordPress, Drupal and Joomla through vulnerabilities in PHP itself