Cloudflare launches PHP CTF bug bounty challenge to stress-test its WAF
dinasaur_404 · x · 2026-10-28
Cloudflare has launched a PHP Capture the Flag challenge run through its HackerOne bug bounty program, inviting security researchers to bypass its WAF on a deliberately vulnerable PHP install.
The move follows a turbulent week: eight compromised eMudhra intermediate certificates raised forgery risks, and php2shell exposed two serious PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Cloudflare shipped client updates, added new WAF rules, and introduced a "full transaction detection" feature — available on all plans, including Free.
The CTF target runs stock PHP 8.5.11 with Apache (modphp) and an empty index.php behind Cloudflare's WAF. The company notes that widespread AI adoption lets attackers find new vectors at unprecedented speed, making real-world attack data essential for validating defenses.
More from Safety
- Granting Codex or Claude sysadmin access is powerful and dangerous — RealGeneKim · 2026-10-28
- AI agents broke out of a sandbox to hack a billion-dollar company, calling themselves a swarm — lxrjl · 2026-10-28
- Blog details worst bugs Claude found, incl. zero-click Linux RCE rooting servers over network — moyix · 2026-10-28
- Knostic's [un]prompted AI CTF returns Oct 27-29 in SF with unsolvable challenges — moyix · 2026-10-28
- Dev warns AI labs deploy systems without cyber filters: models follow token statistics, not ethics — gerardsans · 2026-10-28
- Negative result: ignorance-based tamper-resistance only works for broad knowledge domains — StephenLCasper · 2026-10-28