Last week will undoubtedly go down in Internet security history as one of the most turbulent and challenging periods for web infrastructure in recent memory. A rapid succession of high-profile security events tested the resilience of the global digital ecosystem, beginning with the unsettling compromise of eight eMudhra intermediate certificates. This cryptographic failure created a severe possibility of forged certificates that malicious actors could potentially exploit to impersonate legitimate servers. Hot on the heels of that cryptographic incident came the emergence of "php2shell," a collection of severe, highly critical vulnerabilities discovered within PHP, the foundational runtime language that powers a remarkably large portion of the modern web.
As these interconnected events rapidly unfolded across the digital landscape, engineering and security teams at Cloudflare worked tirelessly around the clock to protect their vast customer base and contribute to the broader effort of safeguarding the integrity of the Internet. In response to the crisis, the company quickly shipped critical client updates alongside multiple layers of architectural mitigations. Furthermore, engineers updated Cloudflare’s web application firewall (WAF) with entirely new detection rules specifically engineered to actively block attackers from exploiting the newly surfaced PHP vulnerabilities. To address the sophisticated nature of these threats head-on, Cloudflare also introduced an innovative new security capability known as full transaction detection, designed to scrutinize data flows with unprecedented precision.
True to the company’s longstanding operational philosophy during periods of industry-wide crisis, these newly developed security capabilities were made universally available across all service tiers immediately upon release, including the completely free tier. This ensured that organizations of every size, regardless of their financial resources, gained access to advanced defensive tooling during a moment of acute industry vulnerability.
Put Our WAF to the Test
Protecting complex distributed systems from modern vulnerabilities of this magnitude is perpetually an ongoing, dynamic process rather than a static, one-time event. The rapid and widespread adoption of artificial intelligence by malicious actors has fundamentally transformed the threat landscape, allowing attackers to discover new exploit vectors and weaponize them with unprecedented speed and efficiency. Consequently, gathering real-world data, testing underlying security assumptions, and continuously strengthening defensive perimeters has become more essential than ever before.
To accomplish this proactive defense strategy, Cloudflare officially launched the Cloudflare PHP Capture the Flag challenge, hosted directly through its established Bug Bounty program on HackerOne. To rigorously test the defensive posture of its systems, the organization placed a deliberately vulnerable PHP installation directly behind its advanced WAF, extending an open invitation to the global community of security researchers and ethical hackers on HackerOne. Participants are encouraged to leverage their expertise, attempt to bypass the deployed web application firewall protections, and successfully capture a designated hidden flag.
How This Capture the Flag Works
To maintain clarity and focus, the rules and architecture of the Capture the Flag challenge have been kept intentionally straightforward. The entire competition centers specifically around CVE-2026-109618 and CVE-2026-109619, which are the two critical PHP vulnerabilities collectively driving the threat known as php2shell. The target environment itself runs a stock, unmodified installation of PHP 8.5.11 equipped with standard PHP extensions, running alongside Apache 2 via mod_php. This setup resides inside an empty index.php file hosted within a secure Cloudflare Container instance.
Guarding the perimeter of this vulnerable sandbox are Cloudflare’s default WAF protection rules configured specifically for these vulnerabilities. Deep within the isolated sandbox environment, a secret file simply named /flag sits waiting for anyone capable of breaching the defense-in-depth architecture. To maintain fairness and ensure a level playing field for all participating researchers, the underlying sandbox environment undergoes an automated complete reset every few minutes, which includes wiping and regenerating the contents of the secret flag file.
The core mission presented to participating researchers is straightforward yet immensely challenging: bypass the active WAF protections, successfully exploit the underlying PHP sandbox environment, and recover the exact contents of the /flag file. Researchers are fully permitted to utilize their own custom research tools and methodologies. Comprehensive environment details, detailed scope parameters, and an integrated flag verification form are readily accessible directly on the main challenge page.
Challenge Requirements and Rules
Because this limited-time challenge is conducted under the official umbrella of Cloudflare’s Bug Bounty program on HackerOne, all aspects of participation are strictly governed by standard HackerOne community terms alongside Cloudflare’s specific program rules, collectively referred to as the bounty terms. Researchers who successfully discover an eligible, working bypass must strictly adhere to a specific set of guidelines and procedural requirements in order to claim any potential bounty awards.
It is important to note that simple user interface verification via the challenge portal does not constitute submitting an official HackerOne report nor does it establish reporting priority. Certain types of submissions are explicitly excluded from eligibility, including isolated file disclosure vulnerabilities that do not achieve remote code execution, remote code execution achieved without successful flag recovery and corresponding UI verification, local-only exploits, the mere rediscovery of the already known PHP vulnerabilities, or observations of WAF detection differences and partial attack chains that fail to achieve the full stated objective.
Furthermore, award eligibility strictly requires a materially distinct bypass method or a genuinely unique exploit payload, even if it targets the same underlying PHP Common Vulnerabilities and Exposures identifiers. The generation of new flags, frequent environment resets, altered attempt IDs, or superficial cosmetic changes—including equivalent character encodings—do not qualify as unique submissions. Equivalent submissions will be treated as duplicates, even if the underlying vulnerability remains unpatched at the time of submission; ultimately, only the first complete and reproducible HackerOne report will be considered valid. Cloudflare maintains final authority over all decisions regarding duplicate reports and reward distributions.
Because the platform records attempted metadata and request payloads to assist engineering teams in analyzing incoming security reports, participants are strongly advised to utilize test data exclusively. Researchers must refrain from submitting sensitive credentials, personal information, or any other data they would not wish to be permanently preserved within a security research record. All participants should carefully review Cloudflare’s privacy notice prior to initiating any testing activities.
Active security testing is strictly authorized exclusively against the challenge hostname’s WAF-protected endpoints located at /php/* using the HTTP POST method only. All other Cloudflare services, direct unauthorized access to the underlying infrastructure, the upstream PHP project itself, and any third-party systems remain entirely out of scope. Participants are expressly forbidden from engaging in denial of service attacks, high-volume automated scanning, establishing persistence within the network, social engineering, or targeting other human participants. Additionally, if a researcher encounters rate-limiting responses such as HTTP status codes 429 or 503, they must immediately back off and throttle their request rates.
In the event of any discrepancies or direct conflicts between the statements made in official blog announcements and the binding bounty terms, the official bounty terms shall always prevail. Furthermore, Cloudflare retains the absolute right to suspend, modify, or terminate the challenge at any moment. Once the competition listing is officially removed from the HackerOne platform, the challenge is considered permanently concluded. Researchers should consult Cloudflare’s dedicated HackerOne page for the most up-to-date status information regarding whether the challenge remains open.
Not a Substitute for Patching
While advanced web application firewalls and edge mitigation strategies provide a vital layer of defense, Cloudflare emphasized that defensive tooling is never a permanent replacement for properly patching and fixing inherently vulnerable software. Automated response blocking can successfully prevent exposed data from reaching an unauthorized attacker, but it cannot retroactively undo malicious actions that have already been executed at the origin server. Organizations running PHP within their technology stacks are strongly urged to closely follow the latest security advisories published by the PHP project and apply all relevant software updates promptly.
Last week served as a powerful reminder that helping to build a safer, more resilient Internet frequently requires a concerted, collaborative effort among numerous individuals, including independent security researchers, software maintainers, and dedicated response teams spread across the entire technology industry, all working together through difficult and urgent circumstances.
Cloudflare expressed hope that the newly introduced Capture the Flag challenge provides a valuable and engaging way for the broader security community to participate in this ongoing defensive learning process. Security professionals and researchers interested in testing their skills can visit the challenge portal to examine the environment, as the flag remains hidden and waiting for anyone capable of claiming it.
