Cloudflare deploys protections against php2shell vulnerability
AI Summary
Cloudflare has developed and deployed Web Application Firewall (WAF) protections against the php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting the PHP runtime. These runtime flaws involve unsafe memory access during error handling or memory exhaustion, potentially leading to denial of service, data exposure, and remote code execution. To address these threats effectively without high false positives, Cloudflare introduced full transaction detection, a new capability combining HTTP request and response signals. While WAF rules are deployed automatically across all plans, administrators must still patch their PHP repositories.
Key Takeaways
- CVE-2026-109618 and CVE-2026-109619 affect PHP 5.4 and later.
- Full transaction detection analyzes both HTTP requests and responses to reduce false positives.
- Administrators must update PHP software directly rather than relying solely on code fixes or WAF rules.
Why it matters
The php2shell vulnerabilities affect the PHP runtime itself across versions 5.4 and later, impacting a massive portion of web applications. Because updating application code or plugins does not resolve runtime memory safety issues, engineers and administrators must apply vendor updates alongside edge protections.
Conversation 0
Be the first to share your perspective.