How php2shell Flaws Threaten PHP Servers and Cloudflare’s Response

Cloudflare deployed default web application firewall protections against two newly disclosed PHP vulnerabilities known as php2shell. These rules activate automatically for customers on free or paid plans starting October 21, 2026. The protections aim to stop exploit attempts and prevent exposed data from reaching attackers before public disclosure occurred.

What are the php2shell vulnerabilities?

Calif.io, Wiz, OpenAI, and Quarkslab disclosed CVE-2026-109618 and CVE-2026-109619, which affect all web servers running PHP 5.4 or later. The flaws involve how PHP handles memory during error conditions. If processing stops unexpectedly due to memory issues, PHP may fail to clean up memory safely. This can allow attackers to execute malicious code, expose sensitive data, or crash the server by sending specially crafted HTTP requests.

How does Cloudflare detect these exploits?

Standard request-based rules were insufficient because request data alone often cannot distinguish exploits from legitimate traffic. Cloudflare developed full transaction detection, a new capability that combines signals from both the request and the origin’s response within the same HTTP transaction. This method helps identify whether an exploit succeeded while reducing false positives. Response rules can block matching origin responses before they reach the requester.

Why is this campaign significant?

PHP powers nearly 70% of websites, including platforms like WordPress and Magento. Because these vulnerabilities affect the PHP runtime itself, they could potentially impact a large number of applications across the Internet. Cloudflare observed attack traffic targeting customers before the official release date, with attackers mutating payloads to try to bypass protections. Security analysts continue to monitor activity and update rules as new techniques emerge.

What should developers do next?

Cloudflare advises customers to patch their PHP repositories even though WAF protections provide an additional layer of defense-in-depth mitigation. The protections are deployed automatically on all plans with WAF enabled. Developers should track new rules in the changelog and remain vigilant for updates as security analysts refine the rules in response to evolving attack variations and emerging techniques.

What analysts watch for

Teams usually examine web server logs for unusual HTTP request patterns that trigger memory errors or unexpected application crashes. Analysts check whether responses contain sensitive data that should remain internal, indicating a successful exploit. They look for signs of remote code execution, such as unauthorized command outputs or new processes spawned on the server. Persistence mechanisms often involve web shells or modified configuration files. Monitoring for sudden spikes in error rates or resource consumption helps identify ongoing exploitation attempts before full compromise occurs.

What to do and how to stay safe

• Review server logs for unusual HTTP requests that trigger memory errors or application crashes.
• Verify that PHP installations are updated to the latest stable version once patches are available.
• Monitor for unexpected command executions or new processes running on web servers.
• Ensure web application firewall rules are active and updated to reflect current threat intelligence.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.