cyber.hendryadrian.com
Security News · blog.cloudflare.com

Cloudflare Updates PHP CTF WAF Protections and Invites More Research

· Original article ↗

Summary

Cloudflare says PHP CTF submissions helped strengthen its php2shell WAF protections and add detections. The challenge, focused on two PHP vulnerabilities, remains open for materially distinct, reproducible bypass submissions.

Key points

  • Cloudflare says researcher submissions helped harden existing WAF protections for php2shell and create new detections.
  • The challenge remains open for materially distinct, reproducible WAF bypass submissions through Cloudflare’s HackerOne program.
  • The CTF targets CVE-2026-109618 and CVE-2026-109619 in a sandbox running PHP 8.5.11 behind Cloudflare’s default WAF rules.
  • Eligible reports must demonstrate authorized code or command execution, recover and verify the flag, and include reproducible evidence.
  • Testing is limited to the challenge’s WAF-protected POST endpoints; other services and infrastructure are out of scope.

Article Details

Event Type
Cloudflare launched a PHP Capture the Flag challenge through its Bug Bounty program to test WAF bypass protections for two PHP vulnerabilities.
Impact
Cloudflare reports that challenge submissions have helped harden its php2shell WAF protections and create new detections. The company also says it shipped client updates and mitigations, added WAF rules, and introduced full transaction detection. The challenge targets CVE-2026-109618 and CVE-2026-109619 in an isolated PHP sandbox; the article does not report a successful challenge exploit.

CVE

CVE-2026-109618We are keeping this simple. The challenge focuses on CVE-2026-109618 and CVE-2026-109619, the two PHP vulnerabilities behind php2shell. The target runs stock PHP 8.5.11 (with standard PHP extensions), Apache 2 (viaCVE-2026-109619We are keeping this simple. The challenge focuses on CVE-2026-109618 and CVE-2026-109619, the two PHP vulnerabilities behind php2shell. The target runs stock PHP 8.5.11 (with standard PHP extensions), Apache 2 (via

Vendors

CloudflareDetails of managed-rule changes are available in the Cloudflare WAF changelog.HackerOneresearchers to continue submitting materially distinct, reproducible bypasses through the Cloudflare HackerOne program. We will share further information and feedback as the challenge progresses. Thank you again for

Products

Apache 2PHP vulnerabilities behind php2shell. The target runs stock PHP 8.5.11 (with standard PHP extensions), Apache 2 (via mod_php), and an empty index.php inside a Cloudflare Container, with our default WAF protectionCloudflare WAFDetails of managed-rule changes are available in the Cloudflare WAF changelog.PHPUpdate — October 30, 2026: Thank you to everyone who has participated in the PHP Capture the Flag challenge. We have received a strong response from the security research community, and the submissions have helped us

Related Articles