Cloudflare shielded customers 9 hours before PHP disclosure
Calif.io, Wiz, OpenAI, and Quarkslab disclosed two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as php2shell. They affect all web servers running PHP 5.4 or later and may allow denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic. Cloudflare deployed web application firewall (WAF) protections in early October 2026, about 9 hours before public disclosure. Starting October 21 at 3:02 am UTC, customers using the free or paid WAF were protected by default.
Cloudflare is part of a coordinated effort with the...


