Cloudflare deploys default WAF protections for php2shell PHP vulnerabilities affecting PHP 5.4+ servers

Cloudflare says it deployed WAF mitigations for CVE-2026-109618 and CVE-2026-109619, known as php2shell, about 9 hours before public disclosure, with default protection for Free and paid WAF customers starting October 21 at 3:02 am UTC. The PHP runtime flaws affect PHP 5.4 or later and may allow denial of service, remote code execution, or data exposure via specially crafted HTTP traffic. Cloudflare also introduced full transaction detection, which uses both request and origin response signals, but says administrators should still patch PHP because WAF protection is only an additional layer.

For teams running PHP behind Cloudflare, the immediate decision is to verify the managed ruleset is enabled, or in block mode for paid plans, while prioritizing the PHP runtime update. The trade-off is that full transaction detection may reduce false positives by using response context, but it also depends on Cloudflare’s managed rules and continued updates as attackers mutate payloads; the article does not specify affected PHP patch versions or whether non-Cloudflare deployments have equivalent mitigations.