A group of tech companies, including OpenAI, Wiz, and Calif.io, have disclosed two critical security vulnerabilities in the PHP programming language, identified by the identifiers CVE-2026-109618 and CVE-2026-109619, collectively known as php2shell. These vulnerabilities affect all web servers running PHP versions 5.4 and later, opening the door to risks of remote code execution, denial of service, and sensitive data leakage.
How the vulnerabilities work
The php2shell vulnerabilities arise from a flaw in how PHP handles memory when errors occur during the processing of HTTP requests. Under normal circumstances, PHP allocates memory for requested data and then frees it, but if processing stops unexpectedly, the language may fail to clean up the memory securely. Attackers exploit this condition by sending specially crafted HTTP requests to manipulate invalid memory, leading to process crashes or unauthorized data access.
Cloudflare's technical response
Cloudflare preempted the public disclosure of these vulnerabilities by approximately 9 hours, deploying Web Application Firewall (WAF) protection rules for all its customers, including free plan users. For the first time, the company utilized a new technical capability called "Full Transaction Detection".
This technology goes beyond traditional rules that rely solely on analyzing user requests by combining signals derived from the request and response within a single HTTP transaction. This allows the system to block the origin server's response if it is found to contain exploitation indicators, reducing the likelihood of false positives and increasing protection accuracy.
What changes practically for users?
- Automatic protection: The new rules have been automatically activated for all Cloudflare customers without requiring manual intervention.
- Multi-layered defense: Although WAF protection is available, the company emphasizes that this protection serves as an additional layer of defense and does not replace the need for site administrators to update their PHP versions immediately according to developer recommendations.
- Continuous monitoring: Cloudflare security analysts continue to monitor exploitation attempts and update rules to counter any evasion techniques attackers might devise.
Users can review event logs via the Cloudflare dashboard (Security > Security Analytics > Events) to ensure protection is active and to track any attack attempts that were blocked using the specific rule identifiers in the security update.