Cloudflare deploys PHP php2shell vulnerability protection
What happened
According to an October 21 report, Cloudflare has deployed protection against the PHP php2shell vulnerabilities by default for all free and paid WAF users, about nine hours before public disclosure. The report lists CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.4 and above and enabling denial of service, remote code execution and data leaks. To counter these flaws, Cloudflare introduced full-transaction detection, combining request and response signals to identify attacks for the first time. The protection now covers its free and paid WAF users by default.
Written by AI from the coverage · updated 1 hour ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageCloudflare deploys protections against php2shell vulnerability
Cloudflare 已为所有免费及付费 WAF 用户默认部署针对 PHP php2shell 漏洞（CVE-2026-109618、CVE-2026-109619）的防护，比公开披露提前约 9 小时。该漏洞影响 PHP 5.4 及以上版本，可导致拒绝服务、远程代码执行和数据泄露。Cloudflare 为此推出全事务检测能力，首次结合请求与响应信号识别攻击。
Heat over time
Not enough continuous observations to draw a trend yet.