Cloudflare deploys WAF protections for critical php2shell PHP vulnerabilities

Two PHP runtime vulnerabilities dubbed php2shell affect all PHP versions from 5.4 onward, potentially allowing denial of service, remote code execution, and data exposure on roughly 70% of websites. Cloudflare developed and deployed WAF mitigations in early October 2026, including a new "full transaction detection" capability that correlates request and response signals to block exploits with fewer false positives. Attack traffic was observed before the official disclosure date, with attackers mutating payloads to evade detection.

How the php2shell vulnerabilities work

• CVE-2026-109618: PHP runs out of memory during request processing, interrupting work before internal data is fully initialized; during cleanup, PHP treats this unfinished data as valid, leading to unsafe memory access
• CVE-2026-109619: A fatal error leaves PHP holding references to memory that gets released when the request ends; a subsequent request handled by the same process may follow these stale references to invalid memory, potentially exposing sensitive data
• Both flaws are in the PHP runtime itself, not application code or plugins—updating website code alone does not fix them; administrators must update the PHP software
• Cloudflare's new full transaction detection analyzes both request and response in the same HTTP transaction, using origin response signals to confirm exploit success and reduce false positives
• Seven "Generic Rules - Anomalous Execution" rules were deployed to both free and paid WAF plans, plus a response-blocking rule for high-confidence signatures

Why it matters

Because PHP underpins WordPress, Magento, and nearly 70% of websites, unpatched systems face broad exposure. Cloudflare's free WAF coverage provides immediate defense-in-depth, but the runtime-level nature of the bugs makes vendor patching essential.