Cloudflare says it deployed WAF mitigations for all free and paid tier customers to combat two PHP flaws by default, about nine hours ahead of public disclosure
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell.
Cloudflare
Context & Ripple Effects
PHP’s development team had signaled fixes for two 9.2-rated flaws, and then released security updates for critical unauthenticated RCE vulnerabilities affecting web request-serving installations. Reports described the issue as spanning PHP versions back to PHP 5, making exposure a web-infrastructure problem rather than a narrow application bug.
Cloudflare’s move adds a network-layer control to the patch cycle for sites behind its service. It matters because the mitigation was made the default across free and paid tiers before the disclosure window opened, while the PHP project’s updates remain the underlying remediation.
First-order effects
Cloudflare customers receive default WAF coverage against the known php2shell exploit vectors without needing to change their service tier or enable a rule manually.
PHP site operators still need to apply the vendor security fixes, since a WAF mitigation protects observed attack paths rather than replacing remediation of the affected software.
Second-order effects
Other CDN, WAF and managed-hosting providers face pressure to turn threat intelligence into broadly available default protections during high-severity disclosure windows.
For web operators, incident response becomes a two-track task: verify edge protections while scheduling and validating PHP updates across request-serving systems.
Third-order effects
The episode points toward coordinated vulnerability response in which maintainers patch the root cause while edge-security providers distribute interim controls across large customer bases.
As research identifies broadly deployed flaws faster, the differentiator for security platforms shifts toward how quickly validated detection signals become safe default coverage, not merely whether rules are available.
The trend: Critical web-software disclosures are increasingly handled through layered response, pairing upstream patches with pre-disclosure edge mitigations for exposed services.
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up…
Researchers at @wiz_io put Gemini 4 Argon to the test against complex cyber threats. In real-world testing, it found more than two times more vulnerabilities than baseline models — catching a critical risk that previous frontier models missed. See how they did it ↓
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://blog.cloudfla…
“Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.” — www.wiz.io/blog/php2she...
Of course, the PHP vulnerabilities were allegedly discovered by AI — “In this post, we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase for more than a decade” — www.wiz.io/blog/php2she...
Oh damn it's as bad as expected: If you are running anything on PHP turn it the hell off RIGHT NOW until you can patch it. — Yes this means every single Wordpress, Drupal, and Wikimedia install. — www.wiz.io/blog/php2she...
If you self host software, you really should put it behind either Cloudflare or Vercel's firewall The firewall rules & data they have on how people try to run exploits are so critical right now
Next time you are on the market for a new WAF, keep this in mind: Cloudflare protected its clients 9 hours before the public disclosure of php2shell. …
overwhelmed by the php vulns and not sure how or where to get started? we've added a copyable prompt to the cloudflare blog that you can feed your agent https://blog.cloudflare.com/ ... [image]
Cloudflare is already detecting early attacks from the zero day RCEs for PHP, which powers many Malaysian websites. MKN, NACSA, National Cybersecurity Committee, MCMC have not issued any warnings nor are they doing anything about it. They're more worried about the Waze juice. [em…