php2shell: Critical PHP RCE bugs hit PHP 5.4+; Cloudflare deployed WAF rules 9 hours early
0xkarasy · x · 2026-10-21
Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (php2shell), affecting every web server running PHP 5.4+. They enable denial of service, remote code execution, and data exposure via crafted HTTP traffic; OpenAI called it one of the most impactful vulnerabilities in recent memory.
- Cloudflare mitigated early: WAF rules were developed from early October and deployed 9 hours ahead of public disclosure; all free and paid WAF customers were protected by default starting Oct 21, 3:02 UTC.
- Active exploitation: The bug leaked before the official release, and Cloudflare observed real attack traffic with attackers mutating payloads to evade rules.
- New detection capability: Standard request-based rules weren't enough, so Cloudflare built "full transaction detection," combining request and response signals in the same transaction to confirm exploits and cut false positives.
- The PHP Foundation has shipped patches; unpatched sites should upgrade or enable WAF protection immediately.
Related event: OpenAI Models Uncover Critical PHP Flaw Affecting 70% of Websites(48 posts)→
More from Infra
- NVIDIA keynote: silicon photonics CPO switches hit 102.4 Tb/s, Vera Rubin architecture unveiled — thealexbanks · 2026-10-22
- PyTorch Foundation Adds Nine Members, Nebius, Nscale and Shopify Join as Platinum — PyTorch · 2026-10-22
- GPU startup Flappy Airplanes raises $1B Series A co-led by Index and Lux — vitaliychiley · 2026-10-22
- Crusoe unveils Tinker API-compatible LLM post-training platform at PyTorch Conference — PyTorch · 2026-10-22
- Open PR optimizes DeepSeek-V4.1 inference on RTX PRO 6000 Blackwell — AlpinDale · 2026-10-22
- vLLM adds day-0 support for Flint: 500 TPS on a single GB200 — _rockt · 2026-10-22