Source · vendor · primary · captured

Cloudflare deploys protections against php2shell vulnerability

Cloudflare · https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ · published 2026-10-21 · added by collector-researchers · slug cloudflare-blog-php2shell-waf

Dated OCTOBER 21, 2026. Says the vulnerability 'was leaked before the official release date and we observed attack traffic targeting our customers'. WAF protection live from Oct 21 03:02 UTC (~9h before disclosure). Lists disclosers as 'Calif.io, Wiz, OpenAI and Quarkslab'. 'PHP is used by almost 70% of websites.'

A web application firewall may provide some protection unt…PHP is used by almost 70% of websitesCloudflare observed attack traffic targeting its customers…Amazon and Cloudflare saw sites being probed for the flawEdge protections went live hours before disclosure: Cloudf…2026-10: Cloudflare starts developing WAF protections 'sin…2026-10-21 03:02 UTC: Cloudflare's WAF protections go live…2026-10-21: CISA alert 'Critical Vulnerabilities in PHP Re…almost 70% websitesabout 9 hours before disclosure, Cloudflare's WAF rules we…Cloudflare

What it says, as the collector read it

Cloudflare blog: "Cloudflare deploys protections against php2shell vulnerability"

  • URL https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ ; dated "OCTOBER 21, 2026". Captured 2026-10-22T08:12:16Z.
  • Disclosers: "Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities" — the only researcher-beat source naming Quarkslab as a 2026 discloser (others credit Quarkslab for the 2024 audit only).
  • Probing / leak: "Cloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers. We observed how attackers were mutating the attack payload to try to bypass our protections".
  • Timing: WAF protections developed "since early October 2026", "deployed about 9 hours ahead of public disclosure. Starting on October 21 3:02 am UTC".
  • 70%: "PHP is used by almost 70% of websites." (websites, not "the internet").
  • No attack volumes in the post. Volumes attributed to Matthew Prince (thousands -> millions) in secondary coverage are NOT in this post — find his X post.
  • Partners: "working with PHP foundation, OpenAI and Wiz among others".

Claims that cite it

ClaimWho says itStatusPrimarySources
A web application firewall may provide some protection until systems are patched
Swiss BACS: 'Even a web application firewall alone is not sufficient.' Cloudflare says its rules blocked the traffic it saw and that attackers mutated payloads to get past them.
CISAdisputed3/3CISA BACS Cloudflare
PHP is used by almost 70% of websites
None of the three cites the survey it comes from. A share of websites using PHP is an upper bound on exposure, not a count of vulnerable systems.
Cloudflare; OpenAI ('an estimated 70%'); Wiz body textreported3/3Cloudflare OpenAI on X Wiz
Cloudflare observed attack traffic targeting its customers after the leak, with attackers mutating payloads
Primary party, no volumes.
Cloudflarereported1/1Cloudflare
Amazon and Cloudflare saw sites being probed for the flaw
Both companies have since said so themselves.
Alan Woodward, via the BBC; confirmed by both companies' own postsconfirmed2/3BBC News Cloudflare Amazon
Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akamai and Fastly on 21 October; Fortinet signatures by 22 October
Every vendor says the same two things: it is a stopgap, and patch anyway.
the vendorsconfirmed5/5Cloudflare Imperva Threat Research Akamai Security Research Fastly Fortinet Community

Events that cite it

WhenEventTime is
2026-10Cloudflare starts developing WAF protections 'since early October 2026'.stated
2026-10-21 03:02 UTCCloudflare's WAF protections go live for all customers, about nine hours ahead of disclosure.stated
2026-10-21CISA alert 'Critical Vulnerabilities in PHP Require Immediate Patching': take systems offline if you cannot update. NSA press release 'PHP2Shell'. UK NCSC alert. CCCS AL26-026. CERT-FR ALE-014. ACN AL07/261021. Cloudflare, Wiz, Calif, the PHP Foundation and Daubois publish their accounts.stated

Numbers from this source

FigureOfStatus
almost 70%websitesreported
about 9 hoursbefore disclosure, Cloudflare's WAF rules went live for all customersconfirmed

Exploitation signals from this source

The bytes

capture 20261022T081216Z · HTTP 200 · https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
  • headers.json 904849b322ddad92fccc55d4ce8527d9c4138d07d61937ce1da5602ea2bef244 7,260 bytes
  • page.html 421005107f81d30d16850fdbf830446d6fd544746dfa7d201be9b4bd3f656e72 301,730 bytes
  • provenance.json 7f98162527014e2989dfaa73146a26c079c634ddf24eff95ae99fad7ea43beb0 1,045 bytes
  • rendered.html a0d3c37cde7c1721a08b028748a412672817c45958d05cc7fedaede582b5537b 373,881 bytes
  • screenshot.png 1784904e6fdda092941881d0e5c85d73801054f216295ca43b17f76e7f5cd34b 989,488 bytes
  • text.txt 302408765abf45e3ae84473d9050c1c65b35c2858e5b53be4fee29dda4de2823 10,205 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →