Cloudflare Detects Early Exploitation Attempts Targeting Two Leaked PHP Vulnerabilities

What happened?

Cloudflare says it is seeing early attempts to exploit two critical PHP vulnerabilities whose details surfaced before the PHP security team’s planned release. The company has deployed an initial set of Web Application Firewall (WAF) rules to block known exploit patterns. Cloudflare says the rules are available to all customers, including those on free plans, and that it is updating them as new patterns appear. The warning raises the urgency for teams running PHP websites, but the firewall rules are only a temporary layer of protection.

Key details

• Cloudflare is observing early exploitation attempts against two critical PHP vulnerabilities leaked before the official disclosure.
• The PHP security team rated both flaws as critical with a CVSS v4.0 score of 9.2 and describes them as remote code execution vulnerabilities.
• WAF rules are a temporary stopgap and cannot replace patching the underlying PHP code; new exploit patterns like PHP2Shell may evade existing rules.
• Organizations should identify all internet-facing PHP systems, monitor official PHP security notices, and verify affected versions once fixed releases are available.
• After patching, defenders should review web server and PHP logs for unusual requests and unexpected PHP worker process activity, and investigate rather than assume WAF blocks mean safety.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.