Two vulnerabilities in the PHP runtime, both rated 9.2 out of 10 in severity and both remotely triggerable over ordinary HTTP, are forcing one of the faster coordinated responses the web stack has seen. PHP’s maintainers announced on Monday that fixes were roughly 12 hours out, with an explicit warning: as Ars Technica reported, the advisory told admins to be ready the moment the release lands, because “we reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are being called php2shell. They were disclosed by Calif.io, Wiz, OpenAI and Quarkslab, according to Cloudflare’s write-up, which says they can allow denial of service, remote code execution and data exposure when an application processes specially crafted HTTP traffic. Security firm watchTowr says it has confirmed the vulnerabilities are real. On coverage, the sources differ slightly: Cloudflare says every web server running PHP 5.4 or later is affected, while watchTowr describes the leaked material as claiming everything from PHP 5 — released in 2004 — onward. Either bound covers roughly two decades of releases. PHP runs almost 70% of websites, per Cloudflare’s figure, which is the denominator that makes a runtime-level bug here an Internet-scale event.
The advisory was triggered by an unconfirmed leak, reportedly including a video of a tool dubbed PHP2Shell executing code on servers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0 and 8.83.29, Drupal 11.4.10 and WHMCS 9.0.9 — the span of the PHP ecosystem, from blogs to e-commerce. Ars was unable to locate the original report; its contents remain unverified.
The bug: memory that outlives its error #
The mechanism, as Cloudflare describes it, sits in PHP’s error path. Under normal operation PHP allocates memory to hold the data for a request and releases it when the work finishes. If processing aborts unexpectedly — running out of memory is the example given — the cleanup does not happen safely. PHP then handles the error using data structures that were never fully initialised, or memory it has already freed. The two CVEs differ in when during that failure sequence the unsafe access occurs.
An attacker reaches this code with crafted HTTP requests. Large requests are one way to put the allocator under pressure, but this is not a resource-exhaustion bug: by controlling what occupies that invalid memory, an attacker can crash a PHP process, read out sensitive data, or in the worst case execute supplied code. Because the flaws are in the runtime itself, no amount of application or plugin patching closes them. Administers either update PHP — 5.4 through current releases — or, on managed hosting, get their provider to. Restricting uploads and capping upload sizes reduce the attack surface but are not substitutes for the fix.
Nine hours of cover before disclosure #
The leak landed before the patches did, and Cloudflare says it observed attack traffic against its customers in that window — plus attackers mutating payloads in real time, tracked by matching rule-hit volumes against rule logic. Cloudflare had been building mitigations since early October 2026 as part of a coordinated effort with the PHP Foundation, OpenAI and Wiz, and flipped them on about 9 hours ahead of public disclosure. From 3:02 am UTC on October 21, every Cloudflare customer with the WAF enabled, including the free tier, was protected by default. Free-plan protection ships in the Managed Free Ruleset (ID 77454fe2d30c4220b5701f6fdfb893ba); paid plans via the Managed Ruleset (ID efb7b8c949ac4650a09736fc376e9aee), where customers were told to confirm the deployment is in block mode.
Notably, the signatures that caught these exploits could not have been written as request-only rules. Whether the exploit actually worked is often only visible in what the origin sends back.
Full transaction detection #
That gap is the reason for a new WAF capability Cloudflare rolled out the same day and used first for php2shell: full transaction detection, which evaluates an HTTP request together with its response, plus response rules that block a matching origin response before it reaches the requester. A second Cloudflare post explains the false-positive arithmetic behind it. A broad request signature catches more attacks but also matches legitimate traffic, which breaks applications; signatures narrow enough to never misfire let ambiguous traffic through. The response is the extra evidence that resolves the ambiguity.
The worked example is a path traversal: a request for /download?file=../../config/database.ini is recognisably hostile on its own, but the request alone cannot say whether the application rejected it, ignored it or complied. If the origin answers 200 OK with a body containing database credentials, the correlation of traversal attempt plus configuration-file content is a far stronger signal than either half alone — configuration-like text also appears in documentation and example downloads. A response rule then swaps the origin’s reply for a WAF block page with HTTP 403, keeping the file from the attacker. One limit states plainly: blocking the response cannot undo whatever the origin already did while handling the request.
Detection and mitigation are separated by design: detections analyse traffic and attach metadata; rules decide what to do with it, so teams can watch matches in Security Analytics before writing blocking policy. Managed detections ship to all plans through the Cloudflare Managed Response Firewall Default ruleset; custom response rules are available to everyone, capped at three rules per customer with Log and Block actions. Rules on the response body are not yet available — so a match like the config-file example currently leans on status codes, headers and detection metadata rather than body inspection. Cloudflare says managed detections for free plans will focus on high-profile vulnerabilities, with a broader catalogue for paying customers, and points to AI agents that scan persistently, adapt payloads from feedback and chain vulnerabilities as the threat these detections are built against.
Cloudflare’s own advice concedes the WAF’s place in the stack: patch PHP anyway and keep the WAF on as defence in depth. The open numbers now are how much of that 70% of the web updates its runtime in the next days, and whether the mutated payloads already in flight stay inside what the new rules cover — Cloudflare says its changelog will carry each new rule as variants emerge.