A coalition of cybersecurity firms and technology companies—including Calif.io, Wiz, OpenAI, and Quarkslab—has publicly disclosed two critical vulnerabilities affecting the PHP programming language. Tracked as CVE-2026-109618 and CVE-2026-109619 and collectively designated as "php2shell," these flaws impact all web servers running PHP 5.4 or later. When applications process specially crafted HTTP traffic, the vulnerabilities can potentially allow malicious actors to execute remote code, cause denial-of-service conditions, and expose sensitive data.
The disclosure follows coordinated efforts across the cybersecurity and open-source communities to deploy rapid mitigations and protect the broader internet ecosystem. Organizations such as the PHP Foundation, OpenAI, and Wiz worked alongside infrastructure providers to address the threat. Cloudflare, responding to a pre-release leak of the vulnerability that saw active exploitation attempts against customer networks, developed and deployed specialized Web Application Firewall (WAF) protections roughly nine hours ahead of the official public disclosure. Starting on October 21 at 3:02 a.m. UTC, all Cloudflare customers utilizing free or paid WAF tiers were protected against php2shell by default.
The rapid emergence of attack traffic during the pre-disclosure leak revealed that malicious actors were actively mutating their attack payloads to probe for weaknesses in initial defense logic. By tracking the volume of rule matches and cross-referencing them against rule structures, threat actors attempted to bypass standard request-based filters. Security engineers quickly determined that conventional request-based rules alone would be insufficient to fully neutralize the threat. Because raw request data does not always provide definitive evidence to distinguish an exploit payload from legitimate user traffic, relying solely on inbound inspection risks either missing sophisticated attacks or triggering false positives.
To solve this challenge and counter the evolving payload mutations, security teams developed a new WAF capability known as full transaction detection. This innovative approach combines signals extracted from both the inbound request and the corresponding outbound response within the exact same HTTP transaction. By analyzing the origin server’s response, the security system gains critical context to verify whether an exploit attempt successfully executed, thereby dramatically reducing false positives and allowing the system to block a matching origin response before it ever reaches the requesting client. The newly deployed php2shell defenses represent the very first managed detection rules to leverage this advanced full transaction capability.
While these automated perimeter defenses provide a crucial layer of defense-in-depth, security analysts emphasize that WAF mitigations do not replace the need for core software updates. Administrators are strongly advised to patch their underlying PHP repositories as soon as possible. Security monitoring remains ongoing as analysts track incoming attack telemetry to update detection logic should new techniques or payload variations emerge.
What We Know About the Vulnerabilities
PHP remains a foundational technology for the modern web, powering nearly seventy percent of all websites, including widely adopted content management systems and e-commerce platforms such as WordPress and Magento. Because the php2shell flaws reside within the PHP runtime environment itself, these vulnerabilities carry massive potential scope, threatening a vast number of applications globally.
The underlying mechanics of CVE-2026-109618 and CVE-2026-109619 involve memory management failures during exceptional conditions when PHP processes HTTP requests. Under normal operating conditions, the runtime allocates specific memory blocks to handle incoming request data and subsequently releases those resources once the processing cycle completes. However, if processing terminates unexpectedly—such as during an out-of-memory event—PHP frequently fails to clean up memory allocations safely. The vulnerabilities are triggered when the runtime attempts to handle such an error while referencing data that was never fully initialized or interacting with memory segments that have already been released.
Attackers can exploit these conditions by transmitting carefully crafted HTTP requests designed to stress server resources or disrupt normal execution flow. While large requests are one common method of inducing memory pressure, the threat extends well past simple resource exhaustion. By successfully manipulating the invalid memory states that PHP encounters during these error conditions, an attacker can crash the PHP process, read sensitive information left lingering in memory, or inject and execute arbitrary code.
The two vulnerabilities differ primarily in the precise moment and manner in which the unsafe memory access occurs. CVE-2026-109618 is triggered when PHP runs out of memory, causing an interruption before internal data structures are properly initialized. During the subsequent cleanup phase, the runtime may mistakenly treat this unfinished data as valid. CVE-2026-109619 occurs when a fatal error interrupts a request, leaving the runtime holding references to memory that is marked for release. When a subsequent request is handled by the same persistent PHP process, it may follow these outdated pointers to access invalid memory, thereby exposing sensitive data.
Because these security flaws are embedded deep within the PHP runtime engine itself, simply updating website source code, themes, or individual plugins will not remediate the risk. System administrators must directly update the PHP software installation powering their applications. Organizations utilizing managed hosting environments should coordinate immediately with their providers to ensure that official security updates are applied.
Deployment and Rule Management
For users on free tiers, specialized detection rules have been rolled out under the Cloudflare Managed Free Ruleset, associated with Ruleset ID 77454fe2d30c4220b5701f6fdfb893ba. Free customers are protected automatically without requiring manual configuration, though administrators retain the ability to customize or override ruleset behaviors according to specific application needs. Specific generic anomalous execution rules mapped to individual rule identifiers have been deployed to monitor and block suspicious activity across these free zones.
For customers utilizing professional, business, or enterprise tiers, equivalent protections have been integrated into the standard Cloudflare Managed Ruleset under Ruleset ID efb7b8c949ac4650a09736fc376e9aee. Administrators on these paid plans are encouraged to review their managed ruleset configurations to verify that the deployment mode is actively set to block traffic rather than log-only mode. Corresponding generic anomalous execution rules have been mapped to distinct identifiers across these paid tiers to ensure comprehensive coverage.
Furthermore, leveraging the newly introduced full transaction detection architecture, specific response firewall rules have been deployed globally across all customer plans, including free accounts. This includes high-confidence signature blocks designed to intercept and neutralize sophisticated attack vectors at the response layer.
Administrators wishing to analyze blocked requests or audit security events can navigate to the security analytics interface within their dashboard to review specific event logs. By filtering logs using the relevant rule identifiers, security teams can inspect matched request paths, actions, and payload characteristics. Where necessary, security teams can tailor the scope of the managed ruleset to focus specifically on vulnerable application endpoints.
While Cloudflare’s managed protections provide immediate, automated defense-in-depth, experts reiterate the importance of applying official vendor patches directly to PHP repositories. Security analysts will continue monitoring global threat telemetry and updating detection rules as new exploitation techniques emerge in the days ahead.
Leave a Reply