Developing
All figures come from Cloudflare, which sells the protection, and the "nine hours" differs from the 10.5 hours to the 13:30 UTC release.
In 60 seconds
- Cloudflare says its WAF blocked php2shell exploitation from 3:02 UTC on October 21 and that it saw attack traffic and a leak before release.
- Protections: 7 rules in the Free Managed Free Ruleset, 7 in the paid Managed Ruleset and 1 response rule using a new "full transaction detection" capability.
- The flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed by Calif.io, Wiz, OpenAI and Quarkslab.
- Cloudflare says: "Customers should patch their PHP repos", and that updating website code or plugins alone does not fix them.
Impact Layer
- What changed
- A major CDN reports exploit attempts and rules deployed before the vulnerabilities were public.
- Why it matters
- It shows the window before public disclosure was not safe, and that firewalls are a second layer, not a fix.
- Who is affected
- Site owners behind Cloudflare, WordPress and PHP administrators and SEOs.
- Martech stack area
- SEO & Search, CMS
- Stack impact
- Patch PHP, and check that your WAF managed rules are enabled in block mode; also protect any origin reachable outside the proxy.
- Business impact
- Moderate All figures and characterisations come from Cloudflare, which sells the protection, and have not been independently verified. Attack volumes, blocked request counts and block-mode share are not stated.
- What to watch
- Independent confirmation and attack volume data.
Cloudflare’s WAF blocked php2shell exploitation from 3:02 UTC on October 21, 2026, about nine hours before public disclosure, according to PPC Land’s reading of Cloudflare’s post by Daniele Molteni, Dan Jones and Kuber Nandwani. Cloudflare also says it saw attack traffic and that the flaw leaked before release.
The flaws and protections
- CVE-2026-109618 and CVE-2026-109619, disclosed by Calif.io, Wiz, OpenAI and Quarkslab.
- 7 rules in the Free Managed Free Ruleset, 7 rules in the paid Managed Ruleset and 1 response rule in the Managed Response Firewall Default, using a new “full transaction detection” capability that inspects origin responses.
Other sources
CERT-EU scores each flaw CVSS 9.2 and reports PHP fixes at 13:30 UTC, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare gives no score, and its “PHP 5.4 or later” range differs from CERT-EU’s listed branches.
Guidance
“Customers should patch their PHP repos”, and updating website code or plugins “alone does not fix these vulnerabilities”. Cloudflare calls the WAF a defence-in-depth layer.
Not stated
Attack volumes, blocked-request counts, affected zones, when the leak occurred, which event counts as “public disclosure” (against the 13:30 UTC release the gap is about 10.5 hours), the share of paid customers in block mode and how origins reachable outside the proxy are protected.
Our read
A firewall rule is a stopgap. The fix is the PHP update.
Sources
- PPC Land: Cloudflare blocks php2shell exploits 9 hours before PHP flaws went public (opens in a new tab)
Source for Cloudflare's claims, deployed protections and what is not stated.