Cloudflare deploys protections against php2shell vulnerability
Summary
Cloudflare announces coordinated protections against the php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that affect PHP runtimes. The post describes how Cloudflare deployed WAF protections across all plans, introduced full transaction detection to correlate request and response data, and published new managed rules for both free and paid customers. It emphasizes patching PHP in addition to WAF protection and ongoing monitoring for new exploitation techniques.