Two flaws in PHP can hand an unauthenticated attacker distant code execution, and PHP says a demonstrated assault on Apache with mod_php fires earlier than the web site’s personal code runs. Cloudflare switched on default safety in opposition to each at 03:02 UTC on October 21, about 9 hours earlier than public disclosure by its personal rely. The top begin mattered, and it nonetheless leaves gaps that no firewall rule can shut.
What php2shell Is
php2shell is the title for 2 vulnerabilities, CVE-2026-109618 and CVE-2026-109619, every rated 9.2 on the CVSS v4.0 scale by PHP’s safety group. Within the first, PHP runs out of reminiscence partway via a request and leaves some inside information uninitialized, and request cleanup could then deal with that information as legitimate. Within the second, inside state from one request can outlive the reminiscence behind it, and a later request dealt with by the identical employee could use that stale state earlier than PHP resets it. Cloudflare says the issues could enable an attacker to trigger denial of service, distant code execution and information publicity.
PHP says all installations serving net requests are in danger, together with PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it considers the chance highest for mod_php. The advisory for the primary flaw provides that no full exploit has been demonstrated in opposition to PHP-FPM, and its CVSS vector charges assault complexity as excessive. The PHP Basis stated its safety group didn’t establish any useful exploits on the time of launch, though proof-of-concept code had begun to flow into.
Cloudflare says Calif.io, Wiz, OpenAI and Quarkslab disclosed the issues. Wiz says it reported its findings to PHP on August 24, that PHP acknowledged them on September 21, and that AI fashions helped all through the analysis. PHP shipped fixes on October 21 in variations 8.5.12, 8.4.27, 8.3.36 and eight.2.35. Cloudflare says the issues have an effect on all net servers working PHP 5.4 or later. W3Techs places PHP at 69.3 % of the web sites whose server-side language it may well establish, as of October 22, and Cloudflare names WordPress and Magento among the many platforms that rely on it.
Why a WAF Has to Learn the Response
An software can’t defend itself in opposition to these flaws. Datadog’s replica used an unauthenticated POST request that by no means reached software code, so application-level authentication doesn’t block it. A firewall in entrance of the server is likely one of the few locations to intervene earlier than patching, however request inspection has limits. PHP’s advisories record multipart methods among the many recognized methods to set off the out-of-memory situation and title session add progress, which is enabled by default, as a set off for the second flaw. Cloudflare says request information alone doesn’t at all times present sufficient proof to tell apart an exploit from official visitors.
Cloudflare’s reply is full transaction detection, which it described in a companion put up the identical day. The potential evaluates a request along with the origin’s response, and when a blocking rule matches, Cloudflare replaces the origin response with a WAF block web page or a customized response. The php2shell protections are the primary managed detections Cloudflare has launched with it. The companion put up’s instance is a path traversal request for a database configuration file: request inspection can acknowledge the try, however the request alone can’t set up whether or not the applying would expose the file. The response is the place that reply exhibits up.
The design has a restrict that Cloudflare states itself. A response rule can’t undo actions already carried out on the origin. The implication is that response inspection protects information leaving the server higher than it protects the server. Imperva describes one php2shell method that returns about 67 KB of server reminiscence in a Set-Cookie header carrying the session ID, the form of leak response-side detection targets. Code that has already run on the origin is one other matter. Cloudflare has not printed what its php2shell signatures search for, so any hyperlink between them and that leak is inference.
What Every Plan Will get
Cloudflare says free and paid WAF clients have been protected by default from 03:02 UTC on October 21. Free clients must do nothing, as a result of the foundations sit within the Cloudflare Managed Free Ruleset. Skilled, Enterprise and Enterprise clients get seven guidelines within the Cloudflare Managed Ruleset, and Cloudflare asks them to evaluate the deployment and ensure it runs in block mode. Each plan, free included, additionally will get a response-side rule within the Cloudflare Managed Response Firewall Default ruleset that blocks high-confidence signatures by default.
The labels are generic. The foundations learn “Anomalous Execution” adopted by a quantity from one to seven, with no point out of PHP or the CVEs. Cloudflare’s put up says the rule descriptions can be up to date quickly and lists the rule IDs so groups can filter matches below Safety Analytics. Till the labels change, a safety group scanning its dashboard can’t inform from the names which guidelines cowl php2shell.
The Clock Began Earlier than Disclosure
The sequence issues. CVE identifiers started circulating on-line round 15:00 UTC on October 20 with a incorrect launch time and a incorrect CVSS rating of 10.0, based on the PHP Basis, which says no technical particulars had leaked. PHP posted an advance discover at 19:33 UTC and moved its launch up from October 22 to 14:00 UTC on October 21. The muse provides that Calif then by accident printed a video of its proof of idea, which helped others develop their very own proof-of-concept code quicker.
Cloudflare’s guidelines went stay at 03:02 UTC on October 21. Cloudflare counts its lead as about 9 hours, however PHP’s launch landed at 14:00 UTC, which makes the hole nearer to eleven. Cloudflare says it had been creating protections since early October, working with the PHP Basis, OpenAI, Wiz and others. It was not the one vendor with early discover. PHP says Linux distributions and LTS distributors acquired the patches upfront, and Imperva says the researchers briefed it confidentially earlier than disclosure and that its Cloud WAF clients are protected out of the field.
Attackers didn’t anticipate the leak. Amazon Risk Intelligence reported that its MadPot honeypot logged an exploitation try dated October 17, 4 days earlier than disclosure, and stated it stays unclear how the actor obtained exploit data. Cloudflare says it noticed assault visitors in opposition to its clients and noticed attackers mutating payloads to get round its guidelines, although it printed no counts.
Distributors describe makes an attempt greater than successes. watchTowr stated on October 21 that it was observing lively exploitation makes an attempt in opposition to each flaws and didn’t say any succeeded. Amazon says php2shell is now being broadly exploited within the wild, whereas additionally saying it’s unclear whether or not the makes an attempt it noticed would succeed on actual programs. The Hacker Information reported that no supply had confirmed a profitable break-in of a selected server as of its October 21 replace. For an unpatched server exterior Cloudflare’s safety, the earliest recognized assault try predates disclosure by 4 days, and Amazon’s steering displays that: begin investigations from the earliest recognized exploitation, not from the disclosure date.
Patching Is Nonetheless the Solely Full Repair
Cloudflare says plainly that clients ought to patch PHP even with the WAF in place, and it describes its guidelines as a further layer of protection in depth. The failings sit within the PHP runtime, so updating web site code or plugins doesn’t repair them, and clients on managed internet hosting ought to ask their supplier to use the safety replace. PHP’s launch notes say there aren’t any full mitigations and that updating is the one secure selection. A WAF additionally inspects solely the visitors routed via it, so an origin server reachable by one other route will get no cowl.
Patching carries its personal friction. PHP 8.1 and older now not obtain updates from the undertaking, and eight.2 reaches finish of life on December 31, 2026. For 7.4, 8.0 and eight.1, the safety group supplied minimal supply backports for individuals constructing from supply or with out an LTS vendor.
Laravel Forge warned clients that its computerized safety updates don’t patch PHP, as a result of Forge installs PHP from a devoted bundle repository exterior Ubuntu’s personal safety channel. Lengthy-running processes reminiscent of queue employees preserve the outdated PHP till somebody restarts them.
What Operators Ought to Take From It
The sign value watching is the response aspect. Cloudflare says it’s going to broaden protection over time to incorporate detecting information publicity and exfiltration indicators, which suggests its managed guidelines are transferring from judging requests towards judging what servers ship again. php2shell suits that sample, as a result of on the memory-disclosure path the proof exhibits up within the reply.
The implication for operators is simple. Stock each PHP model in manufacturing, patch the supported branches, plan a transfer off 8.1 and earlier, and restart long-running employees after the replace. Amazon additionally advises looking form-upload POST requests for the string PHP_SESSION_UPLOAD_PROGRESS and checking servers for sudden course of execution or file adjustments. The WAF lowers the percentages whereas that work occurs, and Cloudflare itself says attackers are already reshaping their payloads in opposition to it.
Any comparable runtime flaw will take a look at the identical association: distributors with advance discover, a leak that shrinks the window, and clients who nonetheless should do the patching. Clearer rule names and printed assault counts would let these clients decide how a lot time a head begin purchased them.
Two flaws in PHP can hand an unauthenticated attacker distant code execution, and PHP says a demonstrated assault on Apache with mod_php fires earlier than the web site’s personal code runs. Cloudflare switched on default safety in opposition to each at 03:02 UTC on October 21, about 9 hours earlier than public disclosure by its personal rely. The top begin mattered, and it nonetheless leaves gaps that no firewall rule can shut.
What php2shell Is
php2shell is the title for 2 vulnerabilities, CVE-2026-109618 and CVE-2026-109619, every rated 9.2 on the CVSS v4.0 scale by PHP’s safety group. Within the first, PHP runs out of reminiscence partway via a request and leaves some inside information uninitialized, and request cleanup could then deal with that information as legitimate. Within the second, inside state from one request can outlive the reminiscence behind it, and a later request dealt with by the identical employee could use that stale state earlier than PHP resets it. Cloudflare says the issues could enable an attacker to trigger denial of service, distant code execution and information publicity.
PHP says all installations serving net requests are in danger, together with PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it considers the chance highest for mod_php. The advisory for the primary flaw provides that no full exploit has been demonstrated in opposition to PHP-FPM, and its CVSS vector charges assault complexity as excessive. The PHP Basis stated its safety group didn’t establish any useful exploits on the time of launch, though proof-of-concept code had begun to flow into.
Cloudflare says Calif.io, Wiz, OpenAI and Quarkslab disclosed the issues. Wiz says it reported its findings to PHP on August 24, that PHP acknowledged them on September 21, and that AI fashions helped all through the analysis. PHP shipped fixes on October 21 in variations 8.5.12, 8.4.27, 8.3.36 and eight.2.35. Cloudflare says the issues have an effect on all net servers working PHP 5.4 or later. W3Techs places PHP at 69.3 % of the web sites whose server-side language it may well establish, as of October 22, and Cloudflare names WordPress and Magento among the many platforms that rely on it.
Why a WAF Has to Learn the Response
An software can’t defend itself in opposition to these flaws. Datadog’s replica used an unauthenticated POST request that by no means reached software code, so application-level authentication doesn’t block it. A firewall in entrance of the server is likely one of the few locations to intervene earlier than patching, however request inspection has limits. PHP’s advisories record multipart methods among the many recognized methods to set off the out-of-memory situation and title session add progress, which is enabled by default, as a set off for the second flaw. Cloudflare says request information alone doesn’t at all times present sufficient proof to tell apart an exploit from official visitors.
Cloudflare’s reply is full transaction detection, which it described in a companion put up the identical day. The potential evaluates a request along with the origin’s response, and when a blocking rule matches, Cloudflare replaces the origin response with a WAF block web page or a customized response. The php2shell protections are the primary managed detections Cloudflare has launched with it. The companion put up’s instance is a path traversal request for a database configuration file: request inspection can acknowledge the try, however the request alone can’t set up whether or not the applying would expose the file. The response is the place that reply exhibits up.
The design has a restrict that Cloudflare states itself. A response rule can’t undo actions already carried out on the origin. The implication is that response inspection protects information leaving the server higher than it protects the server. Imperva describes one php2shell method that returns about 67 KB of server reminiscence in a Set-Cookie header carrying the session ID, the form of leak response-side detection targets. Code that has already run on the origin is one other matter. Cloudflare has not printed what its php2shell signatures search for, so any hyperlink between them and that leak is inference.
What Every Plan Will get
Cloudflare says free and paid WAF clients have been protected by default from 03:02 UTC on October 21. Free clients must do nothing, as a result of the foundations sit within the Cloudflare Managed Free Ruleset. Skilled, Enterprise and Enterprise clients get seven guidelines within the Cloudflare Managed Ruleset, and Cloudflare asks them to evaluate the deployment and ensure it runs in block mode. Each plan, free included, additionally will get a response-side rule within the Cloudflare Managed Response Firewall Default ruleset that blocks high-confidence signatures by default.
The labels are generic. The foundations learn “Anomalous Execution” adopted by a quantity from one to seven, with no point out of PHP or the CVEs. Cloudflare’s put up says the rule descriptions can be up to date quickly and lists the rule IDs so groups can filter matches below Safety Analytics. Till the labels change, a safety group scanning its dashboard can’t inform from the names which guidelines cowl php2shell.
The Clock Began Earlier than Disclosure
The sequence issues. CVE identifiers started circulating on-line round 15:00 UTC on October 20 with a incorrect launch time and a incorrect CVSS rating of 10.0, based on the PHP Basis, which says no technical particulars had leaked. PHP posted an advance discover at 19:33 UTC and moved its launch up from October 22 to 14:00 UTC on October 21. The muse provides that Calif then by accident printed a video of its proof of idea, which helped others develop their very own proof-of-concept code quicker.
Cloudflare’s guidelines went stay at 03:02 UTC on October 21. Cloudflare counts its lead as about 9 hours, however PHP’s launch landed at 14:00 UTC, which makes the hole nearer to eleven. Cloudflare says it had been creating protections since early October, working with the PHP Basis, OpenAI, Wiz and others. It was not the one vendor with early discover. PHP says Linux distributions and LTS distributors acquired the patches upfront, and Imperva says the researchers briefed it confidentially earlier than disclosure and that its Cloud WAF clients are protected out of the field.
Attackers didn’t anticipate the leak. Amazon Risk Intelligence reported that its MadPot honeypot logged an exploitation try dated October 17, 4 days earlier than disclosure, and stated it stays unclear how the actor obtained exploit data. Cloudflare says it noticed assault visitors in opposition to its clients and noticed attackers mutating payloads to get round its guidelines, although it printed no counts.
Distributors describe makes an attempt greater than successes. watchTowr stated on October 21 that it was observing lively exploitation makes an attempt in opposition to each flaws and didn’t say any succeeded. Amazon says php2shell is now being broadly exploited within the wild, whereas additionally saying it’s unclear whether or not the makes an attempt it noticed would succeed on actual programs. The Hacker Information reported that no supply had confirmed a profitable break-in of a selected server as of its October 21 replace. For an unpatched server exterior Cloudflare’s safety, the earliest recognized assault try predates disclosure by 4 days, and Amazon’s steering displays that: begin investigations from the earliest recognized exploitation, not from the disclosure date.
Patching Is Nonetheless the Solely Full Repair
Cloudflare says plainly that clients ought to patch PHP even with the WAF in place, and it describes its guidelines as a further layer of protection in depth. The failings sit within the PHP runtime, so updating web site code or plugins doesn’t repair them, and clients on managed internet hosting ought to ask their supplier to use the safety replace. PHP’s launch notes say there aren’t any full mitigations and that updating is the one secure selection. A WAF additionally inspects solely the visitors routed via it, so an origin server reachable by one other route will get no cowl.
Patching carries its personal friction. PHP 8.1 and older now not obtain updates from the undertaking, and eight.2 reaches finish of life on December 31, 2026. For 7.4, 8.0 and eight.1, the safety group supplied minimal supply backports for individuals constructing from supply or with out an LTS vendor.
Laravel Forge warned clients that its computerized safety updates don’t patch PHP, as a result of Forge installs PHP from a devoted bundle repository exterior Ubuntu’s personal safety channel. Lengthy-running processes reminiscent of queue employees preserve the outdated PHP till somebody restarts them.
What Operators Ought to Take From It
The sign value watching is the response aspect. Cloudflare says it’s going to broaden protection over time to incorporate detecting information publicity and exfiltration indicators, which suggests its managed guidelines are transferring from judging requests towards judging what servers ship again. php2shell suits that sample, as a result of on the memory-disclosure path the proof exhibits up within the reply.
The implication for operators is simple. Stock each PHP model in manufacturing, patch the supported branches, plan a transfer off 8.1 and earlier, and restart long-running employees after the replace. Amazon additionally advises looking form-upload POST requests for the string PHP_SESSION_UPLOAD_PROGRESS and checking servers for sudden course of execution or file adjustments. The WAF lowers the percentages whereas that work occurs, and Cloudflare itself says attackers are already reshaping their payloads in opposition to it.
Any comparable runtime flaw will take a look at the identical association: distributors with advance discover, a leak that shrinks the window, and clients who nonetheless should do the patching. Clearer rule names and printed assault counts would let these clients decide how a lot time a head begin purchased them.
