Cloudflare has enabled protections against php2shell for customers running its web application firewall (WAF), covering Free users as well as paid subscribers. The two vulnerabilities affect servers using PHP versions 5.4 onward and can let attackers disrupt services, expose data or run malicious code through specially crafted HTTP requests. Cloudflare says default coverage began at 3:02 a.m. UTC today, roughly nine hours before the vulnerabilities became public.
Free customers receive the rules automatically without having to enable them, while Cloudflare advises Professional, Business and Enterprise customers to verify that their Managed Ruleset is configured to block traffic. The firewall protections do not remove the need to patch PHP itself, and changing application code or updating plugins alone will not repair the underlying flaws. Administrators whose hosting provider maintains PHP should ask that provider to install the security update.
Calif.io, Wiz, OpenAI and Quarkslab disclosed the vulnerabilities today under the identifiers CVE-2026-109618 and CVE-2026-109619. Cloudflare says information about the flaws leaked ahead of the planned disclosure and that it detected attacks against its customers. The company also observed attackers changing their payloads in attempts to evade its defenses.
The protections introduce a Cloudflare WAF capability called full transaction detection, which examines a request together with the server response it produces. Cloudflare says request inspection alone cannot always separate an exploit attempt from legitimate activity, while responses provide additional evidence and help reduce false positives. Rules using this capability can stop a matching response from reaching the requester, and php2shell is its first use in managed detections.
Both flaws concern unsafe memory handling when PHP encounters errors during request processing. With CVE-2026-109618, an out-of-memory interruption can leave PHP using incompletely initialized data during cleanup. With CVE-2026-109619, a fatal error can leave stale memory references that the same PHP process accesses when handling a subsequent request, potentially exposing sensitive information.
Cloudflare says PHP powers almost 70% of websites and supports platforms including WordPress and Magento. It recommends keeping WAF protections active during patching and says restricting uploads or reducing their permitted size can lower exposure without replacing the PHP fix. Customers investigating blocked traffic can use Security Analytics events, filter for the relevant rule identifiers and examine the request, action and path.
