Cloudflare Blocks Exploitation Attempts Targeting Two Critical PHP Vulnertabilities

Key Takeaways

• Cloudflare has observed initial attempts to exploit two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, ahead of their official patch release.
• Both vulnerabilities are rated with a CVSS v4.0 score of 9.2, indicating critical severity and potential for remote code execution.
• Cloudflare has deployed Web Application Firewall (WAF) rules to mitigate known exploit patterns for all its customers, including those on free plans.
• The PHP security team plans to release official patches on October 21, 2026, at 14:00 UTC, with an earlier release possible if active exploitation increases.
• Organizations running PHP applications are urged to prepare for immediate patching once official updates become available, as WAF rules offer only temporary protection.

Early Exploitation Attempts Target Critical PHP Flaws

Cloudflare reports detecting nascent exploitation attempts against two critical PHP vulnerabilities whose details emerged prematurely before the PHP security team’s scheduled patch release. In response, the cybersecurity firm has implemented an initial set of Web Application Firewall (WAF) rules designed to thwart known attack vectors. These protective measures are now active for all Cloudflare users, including those utilizing free services, and the company confirmed it is continuously updating these rules as new exploit patterns materialize.

This alert underscores the immediate need for organizations managing PHP-driven websites to prepare for urgent action. Cloudflare’s Chief Technology Officer, Dane Knecht, emphasized that while WAF rules provide an interim defense, they are not a substitute for applying official security updates. Knecht advised customers to prioritize patching their systems as soon as PHP releases its security update, which is currently slated for 14:00 UTC on October 21, 2026.

Knecht stated via social media: “PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show… https://t.co/wMz9tDTWwH“

Critical Remote Code Execution Vulnerabilities Identified

The vulnerabilities in question are publicly tracked as CVE-2026-109618 and CVE-2026-109619. The PHP security team has assigned both a critical severity rating, each carrying a CVSS v4.0 score of 9.2. Security researchers and reports characterize these flaws as remote code execution (RCE) vulnerabilities, meaning a successful exploit could allow an attacker to execute arbitrary code on a compromised server. However, comprehensive technical details, including the specific affected components, precise attack methodologies, and a definitive list of vulnerable PHP versions, have not yet been officially released by the PHP team.

The information regarding these vulnerabilities became public prior to the planned coordinated disclosure and security update. Following this leak, the PHP team adjusted its release timeline, indicating a potential to accelerate the patch deployment further if more technical specifics become public or if evidence of widespread active exploitation emerges. Cloudflare’s recent warning suggests that such exploitation attempts are indeed beginning, though the company has not provided details on their scale or success rate.

WAF Rules Offer Temporary Shield, Not a Permanent Fix

A Web Application Firewall functions by inspecting incoming web requests and can block traffic that aligns with identified malicious patterns. While these WAF rules can significantly reduce exposure and buy administrators crucial time to prepare for updates, they cannot fundamentally resolve the underlying vulnerabilities within the PHP codebase. Furthermore, novel exploit techniques, such as new PHP2Shell patterns, might bypass existing WAF rules. Cloudflare has confirmed it is continuously adapting its protections as new attack vectors are discovered, but it has consistently framed these WAF rules as a temporary measure.

What You Should Do

• Identify PHP Assets: Conduct a thorough inventory of all internet-facing systems that utilize PHP, including content management systems (CMS) and applications that bundle their own PHP runtimes.
• Monitor Official Channels: Closely follow PHP’s official security announcements and your operating system or hosting provider’s update channels for the release of official patches.
• Prioritize Patching: Once fixed versions are available, verify the affected versions and apply the appropriate updates immediately across all identified PHP installations.
• Verify WAF Configuration: Ensure that your WAF is enabled and that relevant rules are configured to actively block, rather than merely log, suspicious requests.
• Review Logs Post-Patching: After applying patches, meticulously review web server and PHP logs for any unusual requests or indications of unexpected programs launched by PHP worker processes.
• Incident Response: If any system shows signs of compromise, preserve all logs and adhere strictly to your organization’s established incident response protocols.
• Avoid Speculation: Do not rely on preliminary or unconfirmed reports regarding affected PHP versions; await the official list from the PHP team.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.