TWO PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as php2shell, were disclosed by Calif[.]io, Wiz, OpenAI and Quarkslab. The flaws affect the PHP runtime from version 5.4 onward and arise from unsafe memory handling when errors occur during HTTP request processing. Attackers could trigger denial of service, remote code execution, or data exposure by sending specially crafted HTTP traffic. Given PHP underpins many widely used platforms such as WordPress and Magento, the issues potentially affect a large portion of the web.
Cloudflare states it deployed mitigations as part of a coordinated response, working with the PHP Foundation, OpenAI and Wiz, among others. The protections, implemented as WAF rules, went live across all plans with WAF enabled, starting on 21 October 2026 at 03:02 UTC, i.e., ahead of public disclosure.
Cloudflare describes a new full-transaction detection capability that analyses both request and response data within the same HTTP transaction to better distinguish exploits from normal traffic and to block malicious responses before they reach clients. While administrators should apply the vendor updates to PHP software, Cloudflare emphasises that keeping WAF protections enabled adds a further layer of defence. New rules are available for Free accounts, with additional Managed Rules for paid plans, and ongoing monitoring will continue as attackers adapt.