Cloudflare deploys protections against php2shell vulnerability

Cloudflare has deployed web application firewall (WAF) protections against two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, known as php2shell) that affect all PHP versions 5.4 and later and could enable remote code execution, denial of service, and data exposure. The protections were deployed nine hours before public disclosure and introduced a new "full transaction detection" capability that analyzes both HTTP requests and responses to distinguish exploits from legitimate traffic. Cloudflare customers on all WAF plans, including free users, are automatically protected, though users are urged to patch their PHP installations as an additional security measure.