Cloudflare deploys protections against php2shell vulnerability blog.cloudflare.com

Cloudflare says it deployed WAF protections for two PHP flaws, CVE-2026-109618 and CVE-2026-109619, which researchers from Calif.io, Wiz, OpenAI and Quarkslab disclosed as “php2shell.” The flaws could enable denial of service, data exposure or remote code execution; Cloudflare’s protections are enabled by default for customers with its WAF, but the company says administrators should still update PHP.