CriticalAPTCVE-2026-109618
Cloudflare deploys protections against php2shell vulnerability
Cloudflare Blog·Source published ·1 min read
What happened?
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic. Cloudflare has been part of a coordinated effort to deploy mitigations to protect the Internet, working with PHP foundation, OpenAI and Wiz among others.
Key details
- Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 known as php2shell.
- The flaws affect all web servers running PHP 5.4 or later and may allow denial of service, remote code execution and data exposure.
- Cloudflare deployed WAF protections about nine hours before public disclosure and customers were protected by default starting October 21 3:02 am UTC.
- Cloudflare developed full transaction detection, a new WAF capability that combines request and response signals within the same HTTP transaction to identify exploits with higher confidence.
- Updating website code or plugins alone does not fix these vulnerabilities; administrators must update the PHP software running their applications.
Affected
- All web servers running PHP 5.4 or later are affected.
Fixes and mitigations
- Restricting unnecessary uploads and limiting upload sizes can reduce exposure but does not replace the PHP fix.
What to look for
- Attackers were mutating attack payloads to try to bypass Cloudflare protections, observed through volume of matches and rule logic cross-referencing.
Summarised by SecOraLens from Cloudflare Blog. Always read the original source before acting. How SecOraLens verifies advisories.