Cloudflare deploys protections against php2shell vulnerability

Cloudflare deployed automated web application firewall protections to shield web applications from two critical vulnerabilities in the PHP runtime, known collectively as php2shell. As detailed in Cloudflare Blog's report, the edge network activated mitigations on October 21 at 3:02 am UTC, roughly nine hours ahead of public disclosure. The automated defenses apply by default to all customer accounts across free and enterprise subscription tiers, preventing remote code execution, denial of service, and information disclosure before origin servers receive patched runtimes.

This breakdown covers the technical mechanics behind the CVE-2026-109618 and CVE-2026-109619 vulnerabilities, the deployment of full transaction detection, and the follow-up advisory for PHP session uploads. It is written for system administrators, security engineers, and DevOps leads managing PHP infrastructure across self-hosted and cloud environments. The analysis outlines how edge rules mitigate exposure, which configuration limits bypass filtering, and what steps teams must execute to achieve permanent runtime remediation.

01Coordinated edge defenses and traffic mutations

Security researchers from Calif.io, Wiz, OpenAI, and Quarkslab disclosed the paired php2shell vulnerabilities on October 21. Cloudflare developed defensive signatures beginning in early October 2026 through a coordinated industry effort alongside Wiz, OpenAI, and the PHP Foundation. By deploying protections to the global edge network before public release, Cloudflare established an upstream shield while software teams prepared standalone runtime updates.

Following the edge activation, security analysts recorded active attack traffic aimed directly at customer origins after vulnerability details leaked prior to the official schedule. Adversaries repeatedly mutated their HTTP payloads to circumvent perimeter filters, triggering automated telemetry at the proxy layer. Analysts evaluated match volumes against active rule logic, refining detection strings in real time as threat actors shifted their exploitation patterns.

Customers utilizing either free or commercial plans received these mitigations automatically without manual configuration. Cloudflare maintained continuous monitoring across edge nodes to counter emerging payload variations as attackers attempted secondary bypass techniques. While perimeter filters neutralize known exploits, engineering teams emphasize that managed firewall layers serve as defense-in-depth measures while server administrators apply upstream software patches.

02Unsafe memory cleanup across runtime versions

The php2shell flaws affect the PHP runtime engine on all web servers running version 5.4 or later. Because the PHP language underpins nearly 70 percent of all websites, core runtime defects present broad exposure for content management engines like WordPress and Magento. Attackers exploit these flaws by transmitting specially crafted HTTP requests that force edge parsers into abnormal termination states.

Under ordinary execution, PHP allocates dedicated memory blocks during request handling and releases those resources once the script completes. If processing halts unexpectedly during memory exhaustion or script faults, the engine fails to clean up memory structures safely. The resulting corruption enables an attacker to force fatal errors, manipulate uninitialized structures, crash running worker processes, or execute arbitrary code.

The underlying risks stem from two distinct memory management failures during abnormal request termination. Under CVE-2026-109618, memory exhaustion interrupts execution before internal data initializes, leading the cleanup routine to treat unfinished structures as valid memory. Under CVE-2026-109619, a fatal request error leaves dangling references in persistent worker processes, allowing subsequent HTTP requests to access freed memory and expose sensitive application data.

03Managed ruleset deployment across subscription tiers

Cloudflare distributed the primary php2shell detection rules across two separate managed ruleset packages. For non-paying accounts, rules operate under the Cloudflare Managed Free Ruleset, designated by identifier 77454fe2d30c4220b5701f6fdfb893ba. These baseline signatures execute automatically across free domains, requiring no operational changes unless an administrator decides to customize baseline behavior within the platform control panel.

Commercial subscribers on Professional, Business, and Enterprise tiers receive protection through the Cloudflare Managed Ruleset, cataloged under identifier efb7b8c949ac4650a09736fc376e9aee. Cloudflare advised commercial administrators to confirm that the deployment status remains set to block mode. Both ruleset packages deploy seven distinct inspection signatures that identify remote code execution attack sequences attempting to trigger memory management faults.

Security operators can review blocked traffic by navigating to Security Analytics within the dashboard and filtering events by specific rule identifiers. The inspection interface highlights whether an enforcement action originated from a managed baseline signature or a customer-scoped rule. Teams with complex web applications can adjust ruleset execution parameters to isolate specific paths while preserving blanket coverage across active endpoints.

04Bidirectional transaction analysis and response filtering

Protecting systems against php2shell required inspection capabilities that exceed conventional perimeter request filtering. Request payloads alone often lack sufficient structural context to differentiate hostile input from valid multipart web traffic without introducing false positives. To verify whether a malicious payload succeeded, the security proxy must analyze signals generated by the origin server during execution.

Cloudflare addressed this constraint by implementing full transaction detection, a security capability that couples incoming HTTP request parameters with outgoing server responses within the same transaction. If an origin server begins transmitting leaked memory or exhibits signature states indicating a successful exploit, the response rule blocks the payload before it leaves the edge network. This bidirectional correlation stops compromised output from reaching external adversaries.

The php2shell defensive package represents the first managed security configuration operating on top of full transaction detection. The engine deploys as the Cloudflare Managed Response Firewall Default across all subscription accounts, including free users. Administrators can verify operational status on the Security Rules management page, ensuring downstream infrastructure remains protected against unpatched data leaks.

05Session upload progress flaw and coverage limits

On October 23, the PHP project published an informational security advisory for an additional vulnerability tracked as CVE-2026-115560. This flaw resides in the native session upload progress component and impacts fully patched PHP releases, including branch 8.5.12. Upstream maintainers scheduled an official source fix for deployment in the subsequent regular release cycle.

Cloudflare confirmed that its existing rule designated as rule number six protects sites against known CVE-2026-115560 exploit attempts. However, this edge coverage applies only to web environments that use PHP's default session upload progress field name. Sites configured with a customized session.upload_progress.name setting fall outside the scope of the managed rule and remain unprotected at the proxy layer.

Because perimeter inspection cannot mitigate every custom environment, administrators must apply upstream vendor patches to their underlying PHP installations. Updating higher-level CMS themes, plugins, or application code cannot resolve flaws residing inside the binary runtime. Teams operating on managed hosting must ensure providers update system packages, while restricting unnecessary upload permissions to minimize surface exposure.