Cloudflare says it deployed WAF mitigations for all free and paid tier customers to combat two PHP flaws by default, about nine hours ahead of public disclosure
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell.
Cloudflare's default protection layer was in place before the coordinated disclosure, giving its free and paid customers an immediate compensating control while PHP maintainers distribute the underlying fixes.
First-order effects
Cloudflare customers running affected PHP services receive WAF coverage for known exploit paths without changing their plan or configuring rules first.
PHP operators outside that edge layer must rely on the early security updates to remove the underlying remote-code-execution exposure.
Second-order effects
Cloudflare's rollout raises pressure on other hosting, CDN and firewall providers to turn threat intelligence into default protections rather than leave critical rules as opt-in products.
The early circulation of CVE identifiers compresses the interval between patch publication, edge-rule deployment and attempted exploitation, making coordinated disclosure harder to preserve.
Third-order effects
If edge providers repeatedly absorb emergency mitigation work, web-application firewalls become a more consequential security control for self-hosted software, alongside—not in place of—upstream patching.
The episode points toward vulnerability response being organized as a joint maintainer-and-platform workflow, where code fixes and network controls are deployed in parallel.
The trend: Critical software vulnerability response is moving toward coordinated, default-on edge mitigations that buy operators time to apply upstream patches.
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up…
@eastdakota
Matthew Prince on x
We had to invent a new form of WAF to mitigate this latest set of vulnerabilities. Now enabled by default for all customers for free.
@rhyssullivan
Rhys on x
If you self host software, you really should put it behind either Cloudflare or Vercel's firewall The firewall rules & data they have on how people try to run exploits are so critical right now
@burcs
Brandon on x
overwhelmed by the php vulns and not sure how or where to get started? we've added a copyable prompt to the cloudflare blog that you can feed your agent https://blog.cloudflare.com/ ... [image]
@alphaque
Dinesh Nair on x
Cloudflare is already detecting early attacks from the zero day RCEs for PHP, which powers many Malaysian websites. MKN, NACSA, National Cybersecurity Committee, MCMC have not issued any warnings nor are they doing anything about it. They're more worried about the Waze juice. [em…
@mitsuhiko
Armin Ronacher on x
I was super critical for years that Cloudflare turns into a single point of failure for many sites. But the flipside is that it's also has a really good positive leverage affect on security. This is great stuff. https://x.com/... [embedded post]
watchTowr
watchTowr on linkedin
🚨 Yesterday, information leaked about two Remote Code Execution vulnerabilities in PHP, now known as “PHP2Shell” (CVE-2026-109618 …
r/cybersecurity
r on reddit
Wiz got pre-auth RCE on WordPress, Drupal and Joomla through vulnerabilities in PHP itself
r/GeminiAI
r on reddit
Gemini 4 Argon credited for “invaluable contributions” to PHP2Shell vulnerability discovery
@google
@google on x
Researchers at @wiz_io put Gemini 4 Argon to the test against complex cyber threats. In real-world testing, it found more than two times more vulnerabilities than baseline models — catching a critical risk that previous frontier models missed. See how they did it ↓
@cloudflare
@cloudflare on x
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://blog.cloudfla…
r/anime_titties
r on reddit
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
@eastdakota
Matthew Prince on x
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
@dok2001
Dane Knecht on x
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New ru…
@burcs
Brandon on x
it's kind of wild to work at a company that can basically flip a switch and protect 20% of the internet from critical vulns [embedded post]
@tridevgurung
Tridev Gurung on x
we've temporarily taken buymemomo offline as a precaution, which is why you'll be seeing this screenshot. …
@uwu_underground
@uwu_underground on x
Step 1. Fuzz your CloudFlare servers to figure out what gets filtered at the WAF level Step 2. reverse engineer a vulnerability Step 3. Profit [embedded post]
@arvidkahl
Arvid Kahl on x
Another reminder of why our $5/month is extremely well spent. [embedded post]
@cstanley
Christopher Stanley on x
Thanks Dane, Cloudflare has always been a huge shield for the public. Appreciate you all so much. [image] [embedded post]
@blackroomsec
@blackroomsec on x
Reposting this from my own comment so you all see it. Re: PHP patch today. …