Introducing the Cloudflare PHP Capture the Flag challenge
AI Summary
Cloudflare has launched a PHP Capture the Flag (CTF) challenge on HackerOne to test and harden its WAF protections against recent PHP vulnerabilities known as php2shell (CVE-2026-109618 and CVE-2026-109619). Security researchers are invited to bypass default WAF rules protecting a stock PHP 8.5.11 and Apache sandbox, achieve remote code execution, and recover a flag file. Successful submissions require a materially distinct, reproducible bypass and proper reporting through HackerOne.
Key Takeaways
- The CTF focuses on CVE-2026-109618 and CVE-2026-109619 targeting PHP 8.5.11 with Apache 2 via mod_php.
- Participants must achieve remote code execution via authorized POST requests and recover the contents of the /flag file.
- Awards require materially distinct WAF bypass methods; equivalent or duplicate techniques are not eligible.
Why it matters
This CTF provides real-world testing data for web application firewalls and helps security researchers collaborate on finding novel bypass techniques for critical runtime vulnerabilities, ultimately improving defensive capabilities across the web.
Conversation 0
Be the first to share your perspective.