Cloudflare has added two PHP vulnerabilities called php2shell to its firewall. The vulnerabilities, dubbed CVE-2026-109618 and CVE-2026-109619, could enable an attacker to run malicious code, steal sensitive data, or disrupt services. Calif.io, Wiz, OpenAI and Quarkslab were among the companies that made their public disclosures.

The dangers are present on much of the web. Applications on popular platforms like WordPress and Magento could be at risk, as could be servers running PHP 5.4 or newer. These vulnerabilities are serious security issues, as PHP is used by almost 70% of websites.

Cloudflare claims that the vulnerabilities were exposed before the company’s web application firewall (WAF) rules were activated. Protection was turned on automatically for all free and paid WAF customers on October 21st at 3:02am UTC. The safeguards were co-developed with the PHP Foundation, OpenAI, Wiz, and others.

Attackers Were Already Testing the Waters

Cloudflare encountered a problem before the php2shell flaws reached their scheduled disclosure date. According to the company, details had leaked, and attackers were already sending malicious traffic towards its customers.

The intruders did not give up when their first attempts failed. They changed their payloads to get around existing defences. Cloudflare’s security teams examined the rules triggered by these requests and studied the detection mechanisms behind them. This allowed them to track the attackers’ changing methods.

But a suspicious request tells only part of the story. It may indicate an attempt to exploit a weakness without proving that the attempt worked. The server’s response can help establish what happened.

Why php2shell Is Dangerous

The two flaws concern PHP’s handling of memory when an HTTP request fails during processing. PHP usually reserves memory for an operation and releases it afterwards. An unexpected error can interrupt this process. Under certain conditions, the runtime may then read uninitialised data or access memory it has already released, creating an opening for exploitation.

PHP’s memory errors can give attackers more than one way into a system. A crafted HTTP request may exhaust available memory, interrupt a process, expose confidential information, or, in some circumstances, permit unauthorised code execution. The outcome depends on the flaw and the conditions in which it occurs.

CVE-2026-109618 centres on incomplete initialisation. When PHP runs out of memory, internal data may remain unfinished. The runtime can later mishandle that data during cleanup, treating it as valid when it is not.

CVE-2026-109619 creates a different danger. A fatal error can leave references pointing to memory that is no longer valid after a request ends. If the process handles another request, those references may lead PHP to access memory it should no longer use.

Cloudflare Expands WAF Detection

Cloudflare has added full transaction detection to its web application firewall. The feature considers both sides of an HTTP exchange: the incoming request and the server’s reply. Together, these signals provide stronger evidence of malicious activity and help limit false alarms.

Cloudflare’s new detection system can stop a suspicious server response before it reaches the person who made the request. The php2shell safeguards mark the first managed detections built with this capability.

The company has made protection available across its plans. Free users receive it through the Cloudflare Managed Free Ruleset. Customers on Professional, Business, and Enterprise plans should check that the Cloudflare Managed Ruleset is active in blocking mode. Another safeguard, Managed Response Firewall Default, adds a blocking rule for high-confidence attack signatures and covers customers on every plan.

Cloudflare’s security analysts will continue watching for new attacks and changing detection rules as attackers develop different methods.

Updating PHP Is Still Necessary

Firewall protection will lower risk, but it will not fix the vulnerable software. These flaws are inherent in PHP and will not be resolved by updating website code or plugins. The PHP runtime needs to be updated by administrators. Managed hosting users should check with their hosting company to ensure that the necessary security patches are applied.

When updating PHP, administrators should not disable Cloudflare’s WAF protection. They can also limit exposure by limiting unnecessary file uploads and establishing reasonable size limits. Both measures are merely a band-aid solution. 

To investigate possible attacks, security teams can use Cloudflare’s Security Analytics and Events interface. The filtering by rule ID gives the ability to see matching traffic, the response taken and the affected paths. 

These can reduce the risk, but not eliminate it. The affected PHP software must be updated for anyone running them. The cause is addressed by monitoring and filtering buy protection; correcting vulnerable runtime.