1-minute read
What a defender needs to know
Cloudflare says attackers mutated PHP2Shell traffic against its customers while its WAF rules blocked known attempts. The two PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619, can lead to remote code execution. Both appear in CISA’s Known Exploited Vulnerabilities annotations. Cloudflare’s newer detection joins the request with the origin’s response from the same HTTP transaction and can block a matching reply before delivery; the origin still processes the request.
Find the PHP applications behind your Cloudflare zones. In Security > Security Rules, confirm the Managed Response Firewall Default is active and, on paid plans, that the Cloudflare Managed Ruleset is in block mode. In Security > Security Analytics > Events, filter for the PHP rule IDs and inspect the path, action and rule type. The related upload-progress issue, CVE-2026-115560, has a specific exception: Cloudflare’s rule number 6 covers the default session.upload_progress.name, so check that setting on each origin before counting on the rule.
Update affected upstream PHP branches to at least 8.2.35, 8.3.36, 8.4.27 or 8.5.12 for the first two CVEs, or verify a distribution backport, then restart serving workers. Confirm the running build after the restart. Cloudflare says the upload-progress issue also affects 8.5.12 and awaits a subsequent PHP release; keep that distinct from the first two fixes. Match WAF events with origin logs if a request reached a PHP worker.