php2shell Flaws Hit ~70% of Websites; Cloudflare Shipped WAF Rules 9 Hours Early

Cloudflare Blog · rss · 2026-10-21

Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP vulnerabilities, CVE-2026-109618 / CVE-2026-109619 (php2shell), affecting all servers running PHP 5.4+. They allow denial of service, remote code execution, and data exposure. PHP powers 70% of websites, including WordPress and Magento.

Root cause: both bugs sit in PHP's memory handling when request processing fails — after an error, PHP may use uninitialized or already-freed memory as valid data, letting crafted HTTP requests crash processes, leak data, or execute code. The flaws are in the PHP runtime, so updating plugins isn't enough; PHP itself must be upgraded.

Cloudflare's response:

• Coordinated with the PHP Foundation, OpenAI and Wiz; WAF rules developed since early October and deployed 9 hours ahead of public disclosure, default-on for free and paid plans
• Attack traffic was observed after the flaw leaked pre-release, with attackers mutating payloads to bypass rules
• Introduced full transaction detection, a new WAF capability combining request- and response-side signals in the same HTTP transaction, blocking matching origin responses in-flight with fewer false positives; php2shell protections are its first managed detections
• Recommendation: patch PHP per the official advisory even with WAF enabled

Original post →

More from Infra

• NVIDIA expands supply chain: substrate capacity to grow 2.5x, Amkor packaging up 300% — nvidia · 2026-10-21
• Micron pitches co-design memory roadmap as key to meeting AI demand — BenBajarin · 2026-10-21
• Memphis votes to temporarily ban new data center construction for 135 days — Polymarket · 2026-10-21
• Micron details AI-class NAND: high-IOPS and high-bandwidth lines for KV cache and long context — BenBajarin · 2026-10-21
• Micron: HBM production will keep stressing DRAM wafer supply through 2030 — BenBajarin · 2026-10-21
• Gemini 4 Argon processed ~25 trillion tokens within 3 days of launch, Google says — Polymarket · 2026-10-21

Infra channel →