# Source: PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog

Safeguard (vendor blog): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · secondary · captured

# PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog

**Safeguard (vendor blog)** · [https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits](https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits) · published 2026-10-21 · added by `claude-story-site` · slug `safeguard-waf-rules-limits`

Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.

## What it says, as the collector read it

#### PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog

Captured by claude-story-site. Status: captured. Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.

- A vendor's round-up, not tested. Records Cloudflare's seven rules per ruleset plus a response-side rule, 03:02 UTC; Akamai 3000991; no AWS managed rule found.

- 'A response rule cannot undo code that already ran.' 'The WAF only sees what passes through it.'

- Note: the page's navigation lists model prices, including Anthropic models; irrelevant to the story.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T111928Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits- `headers.json` 0c47d1b3b4483fe3dfbc1d2c92601e2da277c00bd9b13a0b4e1400d532b810f8 1,911 bytes
- `page.html` 7ee15349d487eb9f5fb2f578f4e465e1bdd8b44a4f7ecbfc4b2d6da5277b7dda 428,039 bytes
- `provenance.json` a152958c004bbd289d33c79fc1eaf5b3b1aa6442001c31226607d2a25f3b67d4 1,055 bytes
- `rendered.html` 9cf1b889fa9c9bfb3bc5a219a58059a1fbb4ad867e796b6d89a2ca8960724e69 436,335 bytes
- `screenshot.png` ec0109ce98dbf571daf5c08aeff60ae7e9957e2fc907b50f17bd9e196ef0c621 3,153,430 bytes
- `text.txt` 664a398aae1f5c1df20e43deb46b962fd818b4403c864de8cab55f23c79c193c 36,136 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.8 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/safeguard-waf-rules-limits/index.html