cyber.hendryadrian.com
Security News · blog.cloudflare.com

Cloudflare Deploys WAF Protections for PHP’s php2shell Vulnerabilities

· Original article ↗

Summary

Cloudflare says its WAF protections for CVE-2026-109618 and CVE-2026-109619 are deployed across plans. Its new full transaction detection analyzes request and response signals; customers should still patch PHP.

Key points

  • Cloudflare says its WAF rules for CVE-2026-109618 and CVE-2026-109619 were deployed before public disclosure and protect customers with WAF enabled.
  • The vulnerabilities affect PHP 5.4 and later and may allow denial of service, data exposure, or remote code execution through specially crafted HTTP requests.
  • Cloudflare’s full transaction detection analyzes request and origin-response signals within one HTTP transaction, aiming to identify exploits with fewer false positives.
  • Cloudflare reports observing attack traffic and payload variations targeting customers; it says analysts will continue updating protections.
  • Cloudflare recommends updating PHP despite the WAF protections; code or plugin updates alone do not fix the runtime vulnerabilities.
  • A later update describes related CVE-2026-115560 in PHP’s session upload progress feature. The WAF protection applies when the default upload progress field name is used; customers who changed it are not covered by that rule.

Article Details

Event Type
Cloudflare deployed WAF protections for the PHP vulnerabilities known as php2shell, CVE-2026-109618 and CVE-2026-109619, after reporting that it observed attack traffic targeting its customers.
Impact
The vulnerabilities may allow denial of service, remote code execution, or sensitive data exposure on affected PHP servers. Cloudflare said its WAF protections were deployed automatically for customers using the WAF, but they do not replace updating PHP. Protection for the related CVE-2026-115560 is limited to sites using PHP's default upload progress field name.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers were reported to send specially crafted HTTP requests targeting vulnerable PHP servers, consistent with exploitation of a public-facing application.

CVE

CVE-2026-109618The existing rules "PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6" protects against this vulnerability.CVE-2026-109619The existing rules "PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6" protects against this vulnerability.CVE-2026-115560- On October 23, the PHP project published an informational advisory for a related vulnerability, CVE-2026-115560, in PHP's session upload progress feature. It affects fully patched PHP releases, including 8.5.12,

Vendors

CloudflareAll Cloudflare WAF customers are protected against known exploit attempts if their site uses PHP's default upload progress field name. Customers who have changed session.upload_progress.name are not covered by the WAF

Products

Cloudflare WAFAll Cloudflare WAF customers are protected against known exploit attempts if their site uses PHP's default upload progress field name. Customers who have changed session.upload_progress.name are not covered by the WAFPHPUpdate - On October 23, the PHP project published an informational advisory for a related vulnerability, CVE-2026-115560, in PHP's session upload progress feature. It affects fully patched PHP releases, including

Related Articles