The global web infrastructure faces a significant security challenge following the coordinated disclosure of two critical vulnerabilities in the PHP runtime, collectively tracked under the moniker "php2shell." Unveiled by security researchers from Calif.io, Wiz, OpenAI, and Quarkslab on October 21, the flaws—designated as CVE-2026-109618 and CVE-2026-109619—affect all web servers running PHP version 5.4 or later. Because PHP underpins nearly 70 percent of all websites on the internet, including massive content management systems and e-commerce platforms like WordPress and Magento, the vulnerabilities have widespread implications for applications across the digital ecosystem.
The discovery prompted an immediate, coordinated response from industry stakeholders, including the PHP Foundation, OpenAI, Wiz, and Cloudflare. Attackers quickly began probing and mutating payloads to exploit the flaws, even catching wind of the security issue before its official public disclosure. In response to the unfolding threat, security infrastructure providers moved swiftly to deploy mitigations hours ahead of the formal announcement, shielding millions of internet properties from potential denial-of-service conditions, data exposure, and remote code execution attacks.
Understanding the php2shell Vulnerabilities
The underlying mechanics of CVE-2026-109618 and CVE-2026-109619 stem from how the PHP runtime manages memory during unexpected interruptions in HTTP request processing. Under normal operating conditions, the PHP engine allocates specific blocks of memory to handle and process incoming request data, releasing those resources cleanly once the task concludes. However, when processing halts abruptly—such as when an application encounters a critical memory limit or a fatal runtime error—PHP can fail to clean up its memory safely.
The vulnerabilities manifest when the runtime attempts to handle these errors and subsequently references data that was either incompletely initialized or already released. Specifically, CVE-2026-109618 occurs when PHP runs out of memory and abruptly interrupts its work before internal data structures are fully established. During the subsequent cleanup phase, the engine may mistakenly treat this unfinished, half-baked data as valid information, opening the door to malicious manipulation.
Conversely, CVE-2026-109619 involves fatal errors that interrupt a request while leaving the PHP engine holding active references to memory slated for release. When that same underlying PHP process picks up and handles a subsequent, unrelated request later, it can follow those outdated references back into invalid memory space. This dangerous crossover can lead to severe stability crashes, arbitrary code execution, or the exposure of sensitive customer data residing in the exposed memory segments.
Because these security flaws reside directly within the core PHP runtime environment, simply updating website source code, themes, or individual plugins is insufficient to mitigate the risk. System administrators and web hosting providers must update the underlying PHP software packages themselves to apply the official vendor patches provided by the PHP project.
Innovative Full Transaction Detection Deployed by Cloudflare
Mitigating active exploitation of the php2shell vulnerabilities required moving beyond traditional request-based filtering rules. In many real-world scenarios, analyzing incoming request data alone does not provide enough definitive evidence to reliably distinguish a sophisticated exploit attempt from legitimate, benign user traffic. To solve this dilemma and minimize false positives, security engineers developed an advanced defense mechanism known as full transaction detection.
This new Web Application Firewall (WAF) capability combines inspection signals from both the incoming request and the outgoing response within the exact same HTTP transaction. By analyzing the origin server’s response, the WAF gains critical context regarding whether an attempted exploit actually succeeded. If a malicious interaction is identified, response rules can block the matching origin response before it ever reaches the requesting client. The php2shell protections mark the very first managed detections released using this innovative full transaction architecture.
Cloudflare integrated these defenses natively into its global network, automatically shielding customers across all account tiers—including Free plans—starting on October 21. For free-tier users, protections were embedded directly within the Cloudflare Managed Free Ruleset, while paid subscribers on Professional, Business, and Enterprise tiers received protection via the standard Cloudflare Managed Ruleset. Security teams have deployed specific rule sets carrying designated identifiers to catch various attack mutations. Free plan users are protected by rules such as Rule ID 4e315666e8e344cdb64119a3b5ccf32f and subsequent variations up to rule ID 07f0b6ddaabf40b1b2042dade8d613fa, while paid tiers utilize corresponding rule identifiers ranging from c1d409ad838f47f59446f21cc438d5dd to 1389aa259617437392ce149c48143645.
Ongoing Advisories and Additional PHP Session Vulnerabilities
As organizations work to apply upstream patches, the security landscape surrounding PHP continues to evolve. On October 23, just days after the initial disclosure, the PHP project published an informational advisory detailing a related vulnerability identified as CVE-2026-115560. This newly disclosed flaw targets PHP’s built-in session upload progress feature. Crucially, the issue impacts even fully patched PHP releases—including version 8.5.12—and is scheduled for a definitive fix in the project’s next regular software release cycle.
Existing perimeter defenses have been updated to address these overlapping concerns. Cloudflare confirmed that its WAF rules, specifically including rule variants like "PHP Remote Code Execution Attack #6," automatically protect against related exploit attempts, provided that websites retain the default configuration for PHP’s upload progress field name. However, administrators who have manually customized the session.upload_progress.name parameter in their configuration files are not covered by this specific default rule and may require tailored oversight.
Security analysts emphasize that while perimeter defenses and WAF rules provide an essential, immediate layer of defense-in-depth mitigation, they do not replace the necessity of proper software patching. Website administrators and hosting providers are strongly urged to review the official PHP advisories, apply core runtime updates as quickly as possible, and maintain active WAF protections to intercept evolving attack techniques. Organizations can review blocked security events and inspect matched request paths by navigating to security analytics dashboards to ensure their applications remain secure against ongoing threat activity.
