Cloudflare Deploys php2shell Protection
On October 21, 2026, Cloudflare announced the deployment of WAF protection for php2shell. The vulnerability stems from two PHP flaws affecting PHP 5.4 and later versions, potentially leading to denial-of-service attacks, remote code execution, and data breaches. The protection is automatically enabled for all WAF-enabled plans, including free users.
Cloudflare Deploys Protection for php2shell
On October 21, 2026, Cloudflare announced the deployment of WAF protection for php2shell. The vulnerability stems from two flaws in PHP, affecting PHP 5.4 and later versions. It can lead to denial-of-service attacks, remote code execution, and data breaches. The protection is automatically enabled for all plans with WAF turned on, including free-tier users.
The relevant protection was deployed approximately 9 hours before the public disclosure, during which time attack traffic targeting customers was also observed. The company advises administrators to update PHP as soon as possible and to keep WAF protection enabled.
Source: Cloudflare Blog
