Cloudflare has deployed mitigations to its Web Application Firewall (WAF) to protect all customers from two critical vulnerabilities in the PHP programming language, collectively dubbed 'php2shell'. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow for remote code execution on affected servers and were disclosed by a coalition including Calif.io, Wiz, and OpenAI.
Notably, Cloudflare implemented these protections for both its free and paid users approximately nine hours before the vulnerabilities were made public. The company reported observing early exploitation attempts and has been updating its defenses as new attack vectors emerge. The vulnerabilities are considered highly severe, affecting a wide range of PHP versions and potentially impacting a large portion of the web, as PHP underpins an estimated 70-80% of websites.