Cloudflare Opens Response-Side WAF Rules to All Plans as Google Cloud Pushes php2shell Fixes

Hackers Already Trying to Exploit Serious PHP Flaw

One exploitation attempt was sourced to an IP address based in China, says security provider VulnCheck. The flaw affects PHP, a scripting language used by an estimated 70% of websites.

Cloudflare blocks php2shell exploits 9 hours before PHP flaws went public

Seven WAF rules per ruleset went live at 3:02 UTC on Free and paid plans, plus a new response rule. Cloudflare saw attack traffic, so what still needs patching?

Cloudflare Opens Response-Side WAF Rules to All Plans as Google Cloud Pushes php2shell Fixes

Cloudflare's WAF can now check an origin's response alongside the request and block replies that show an exploit worked, on every plan including Free. Google Cloud, meanwhile, is patching serverless PHP runtimes and urging customers to move to PHP 8.2 or newer.

Cloudflare deploys protections against php2shell vulnerability

Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic.Cloudflare has been

Cloudflare CEO Reports Millions of PHP2Shell Exploit Attempts

Cloudflare's Matthew Prince reports millions of PHP2Shell exploit attempts, including activity before disclosure. PHP has released security fixes.

AI-Assisted Research Uncovers Critical PHP2Shell RCE Vulnerabilities

Frontier AI models have identified two critical remote code execution (RCE) vulnerabilities in the PHP language runtime that remained undetected through a decade of manual security audits. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute arbitrary code on servers running affected versions of PHP. AI-assisted analysis identified these memory-corruption flaws, which […]