php2shell: Cloudflare blocks critical PHP runtime vulnerabilities via WAF

Two critical vulnerabilities in the PHP runtime, known as php2shell, were disclosed on 21 October. Cloudflare announced it had deployed rules in its web application firewall to block exploitation attempts, and did so before the official advisory was even published.\n\n## What the two vulnerabilities are\n\nThe vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, concern memory management when PHP terminates HTTP request processing abnormally—for instance, due to memory exhaustion. At that point, PHP may end up using uninitialized data or references to already-freed memory. CVE-2026-109618 concerns RCE via out-of-memory corruption: memory exhaustion handling can leave internal request data partially initialized, and request cleanup can then use that invalid data. CVE-2026-109619 concerns RCE via stale global state: a PHP worker may maintain references to freed request memory, and a subsequent request handled by the same worker may use that stale state.\n\nAccording to the AlmaLinux advisory, PHP published fixes on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with official release scheduled for 14:00 UTC according to data gathered by SOCRadar. The CVSS v4.0 score assigned by the PHP security team is 9.2 for both. Unsupported PHP versions (8.1 and earlier) remain outside the official patch scope: according to a TuxCare analysis, upstream patches only from 8.2 to 8.5, so PHP 8.1, 8.0, 7.x and 5.x receive nothing from php.net.\n\n## Cloudflare's response\n\nCloudflare reports it developed the rules from early October, deploying them around 9 hours before public disclosure. From 03:02 UTC on 21 October, all customers with active WAF, including those on the Free plan, are protected by default. The company notes it observed attack traffic even before official publication, with attempts to mutate payloads to bypass the rules.\n\nTo reliably block exploits, Cloudflare introduced a new feature called full transaction detection, which correlates signals from both the request and response within the same HTTP transaction, allowing it to block a response from the origin before it reaches the client. The rules are distributed across two separate rulesets: the Managed Free Ruleset (ID 77454fe2d30c4220b5701f6fdfb893ba) for free customers, with 7 dedicated rules, and the Managed Ruleset (ID efb7b8c949ac4650a09736fc376e9aee) for Professional, Business and Enterprise plans, also with 7 rules. Paid plan customers should verify that the Managed Ruleset is deployed in block mode.\n\n## The 23 October update\n\nTwo days later, on 23 October, the PHP project published an advisory on a third vulnerability, CVE-2026-115560, in the session upload progress function. It also affects already-patched versions, including 8.5.12, and will be resolved in the next regular release. Cloudflare clarifies that the existing rule "PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6" also covers this vector, but only for sites using the default field name for upload progress: those who have customized session.upload_progress.name are not covered by the WAF rule.\n\n## What to do\n\nThe WAF is not a substitute for patching. Those managing PHP servers themselves must update to the correct version of their branch; those relying on a hosting provider should request confirmation of the update. As an additional temporary mitigation, pending the fix for CVE-2026-115560, disabling session.upload_progress.enabled in php.ini or the FPM pool, followed by restarting all PHP workers, is worthwhile.