Security researchers have disclosed critical PHP security flaws that leave web servers vulnerable to denial of service, remote code execution, and data exposure. Publicly disclosed on October 21 by Wiz, Calif.io, OpenAI, and Quarkslab, the two core vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Known collectively as php2shell, these vulnerabilities impact all web servers operating on PHP 5.4 or later versions.
Because PHP powers nearly 70 percent of websites worldwide, including popular platforms like WordPress and Magento, the vulnerabilities carry broad exposure across the internet. In response, web infrastructure provider Cloudflare worked with the PHP Foundation, Wiz, and OpenAI to roll out automated mitigations before the coordinated disclosure. Cloudflare announced details of its mitigations on the Cloudflare blog, explaining how automated firewall defenses shield applications while server operators patch runtime dependencies.
Understanding the php2shell PHP security flaws
The core issue behind these PHP security flaws stems from how the PHP runtime handles system memory during request processing errors. Under normal operations, PHP reserves memory for incoming HTTP data and releases that memory once execution ends. When unexpected interruptions occur, such as a process exhausting available memory, PHP fails to clean up internal structures safely.
Because these PHP security flaws stem from core memory handling bugs, attackers can manipulate the state of the engine when an unexpected halt occurs. An attacker can send specially constructed HTTP requests designed to trigger resource limits or fatal errors. Large payloads represent one method for exhausting memory allocations, but the underlying danger extends far beyond basic server downtime. By controlling the data that PHP encounters inside invalid memory blocks, an attacker can crash worker processes, expose sensitive configuration values, or execute arbitrary code.
The two vulnerabilities diverge in when the unsafe memory interaction occurs:
- CVE-2026-109618: PHP encounters an out-of-memory error and interrupts execution before internal data structures finish initialization. During the subsequent cleanup phase, PHP treats this uninitialized data as valid, creating an immediate execution risk.
- CVE-2026-109619: A fatal error terminates a request, but PHP retains active references to memory buffers released at the end of execution. When that same worker process receives a subsequent request, it follows those dangling pointers into invalid memory, potentially leaking sensitive application data.
Because both flaws reside inside the core PHP runtime binary rather than application templates or plugins, updating CMS extensions will not resolve the threat. Server administrators must update the underlying PHP packages on their hosts.
Cloudflare Deploys Full Transaction Detection
To defend against exploit payloads targeting these PHP security flaws, Cloudflare introduced full transaction detection within its Web Application Firewall. Standard WAF rules inspect incoming request data, but single-sided inspection can trigger false positives or miss payloads that mutate during delivery. Cloudflare noted that attackers were actively altering exploit strings to bypass basic rules once information leaked ahead of public disclosure.
Full transaction detection analyzes both the incoming HTTP request and the origin server’s HTTP response within the same transaction. While some malicious patterns appear clearly within request headers, the origin response contains necessary confirmation signals. By evaluating response status codes and body content alongside request attributes, the firewall determines whether an exploit attempt succeeded on the origin. If a match occurs, the response firewall blocks the response payload before it ever reaches the requester, preventing data exfiltration or active shell control.
Cloudflare deployed seven managed rules covering CVE-2026-109618 and CVE-2026-109619 across both free and paid accounts:
- Free Accounts: Protected automatically under the Cloudflare Managed Free Ruleset (Ruleset ID
77454fe2d30c4220b5701f6fdfb893ba). Rule IDs range from4e315666e8e344cdb64119a3b5ccf32fthrough07f0b6ddaabf40b1b2042dade8d613fa. Free customers do not need to take manual action to enable these protections. - Paid Accounts: Deployed in block mode under the Cloudflare Managed Ruleset (Ruleset ID
efb7b8c949ac4650a09736fc376e9aee). Rule IDs span fromc1d409ad838f47f59446f21cc438d5ddthrough71389aa259617437392ce149c48143645. Administrators on Professional, Business, and Enterprise tiers should verify that their managed ruleset operates in block mode. - Managed Response Firewall: The Managed Response Firewall Default configuration was deployed across all tiers to enforce response-side transaction blocks. Administrators can verify rule activity by reviewing the Security Rules interface within the Cloudflare dashboard.
October 23 Advisory: Session Upload Vulnerability
Two days after the initial release, on October 23, the PHP project issued an additional informational advisory for CVE-2026-115560. This flaw affects PHP’s built-in session upload progress tracking mechanism. The issue impacts fully patched versions, including PHP 8.5.12, with a permanent fix scheduled for the next official maintenance release.
Cloudflare confirmed that rule #6 within existing managed rulesets mitigates exploit traffic for CVE-2026-115560, provided the origin server uses PHP’s default upload progress field name. If a site administrator has configured a custom value for the session.upload_progress.name directive in php.ini, the standard rule will not match the traffic automatically.
Remediation Steps for Website Owners
While edge firewalls provide immediate mitigation against incoming exploit patterns, web teams must treat edge rules as an interim layer rather than a permanent replacement for patching PHP security flaws. Origin servers remain vulnerable to direct requests that bypass edge proxies if attackers discover origin IP addresses.
To secure infrastructure, administrators should take the following technical actions:
- Apply upstream PHP patches as soon as repository maintainers provide updated runtime packages for your operating system distribution.
- Verify that your edge security policies have active rules deployed in block mode by reviewing security event logs under your analytics dashboard.
- Lower risk exposure on unpatched systems by restricting maximum request body sizes and disabling unneeded upload endpoints.
- Ensure server firewalls block all direct HTTP connections from the public web, forcing all incoming web requests to transit your edge reverse proxy.
- Audit your
php.iniconfiguration for custom directives, especially around session upload tracking parameters, to verify rule compatibility.
Where This Fits in Real Builds
When Wasif Ahmed deploys hosting stacks, infrastructure automation, or custom CRM integrations, edge security and runtime maintenance form a single line of defense. Edge firewalls handle perimeter traffic, but application runtimes require consistent patch management to keep workloads safe.
Teams running custom applications often rely on custom software development to modernize codebases, while public assets benefit from audited web designing standards that eliminate insecure legacy scripts. Keeping underlying runtime engines updated ensures that edge protection remains a safety net rather than the sole barrier against PHP security flaws.
Engineers must coordinate server configuration updates alongside software deployments. When origin servers rely entirely on third-party proxies without system patching, gaps emerge during internal routing, staging migrations, and direct API access points.
Frequently asked questions about PHP security flaws
Can a web application firewall replace binary package updates?
No. While edge rules block known signatures, resolving PHP security flaws completely requires compiling or installing patched binaries directly on the host server. Firewalls serve as a defensive buffer while administrators prepare and deploy upstream package updates.
Why are PHP 5.4 and newer versions affected?
The underlying memory management logic that mishandles premature terminations was introduced in earlier engine releases and carried forward. As a result, installations spanning legacy PHP 5.4 setups through modern PHP 8.x runtimes share the vulnerable execution cleanup paths.
How can administrators inspect blocked exploit attempts?
Administrators using Cloudflare can navigate to Security, select Security Analytics, and open Events. By filtering records using the specific managed rule IDs provided in the advisory, teams can review matched paths, HTTP methods, and source network details to confirm whether attackers targeted their environments.
Operational security relies on disciplined execution across every layer of the technology stack. Edge filtering mitigates weaponized requests in real time, but eliminating PHP security flaws permanently requires maintaining patched, supported runtimes across all production servers.
If you need assistance reviewing your website architecture or hardening your server configurations against emerging threats, reach out to Wasif Ahmed to discuss securing your infrastructure.
