PHP2Shell and Cloudflare: what the WAF blocks and what you still have to do

Does Cloudflare protect my site from PHP2Shell?

Partly. Cloudflare deployed WAF rules for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) at 03:02 UTC on 21 October 2026, about nine hours before the public disclosure. The rules block known attack patterns for traffic that passes through Cloudflare. They don’t change the vulnerable PHP on your server, and Cloudflare itself says the fix is updating PHP.

Cloudflare also reported that it observed attack traffic against its customers and that attackers were changing their payloads to get around the rules. Dane Knecht of Cloudflare wrote that new rules kept landing in the WAF changelog as variants appeared.

Which Cloudflare plans get the PHP2Shell rules?

Every plan, including Free. The rules are in two managed rulesets:

Both received seven emergency rules named “Generic Rules - Anomalous Execution” on 21 October 2026, set to block. Cloudflare also added a response-side rule to its new managed response firewall, available on all plans.

What is Cloudflare’s “full transaction detection”?

It is a new WAF capability Cloudflare released for PHP2Shell. The WAF looks at the request and your server’s response together, and a response rule can block a matching response before it reaches the attacker. Cloudflare says request data alone is not always enough to tell an exploit from normal traffic, so the response signal adds confidence and cuts false positives.

How do I check my Cloudflare settings for PHP2Shell?

Check three things in the Cloudflare dashboard:

1. Ruleset mode (paid plans): the Cloudflare Managed Ruleset is deployed for your zone and its action is block, not log.
2. Blocked requests: under Security → Security Analytics → Events, filter by the rule IDs listed in Cloudflare’s post to see what was stopped.
3. Proxy status: the DNS records for your site are proxied (orange cloud). A DNS-only record sends visitors straight to your server, around the WAF.

Can attackers bypass Cloudflare and attack my server directly?

Yes, if your server accepts connections from anywhere. The WAF only sees requests that go through Cloudflare. If someone knows or finds your server’s IP address, they can send requests straight to it. Cloudflare’s guide to protecting your origin server explains how to accept traffic only from Cloudflare. That reduces exposure, but the PHP on the server is still vulnerable until you update it.

Do I still need to update PHP if I use Cloudflare?

Yes. PHP2Shell is in the PHP runtime, and PHP’s own announcement says only an update is a complete solution. Update to the fixed release for your branch:

Find your version with the PHP2Shell checker, then follow the PHP2Shell patch guide for your setup. If you can’t update today, see the CVE-2026-109618 workaround for official stopgaps and their limits.

Does Cloudflare protect against PHP2Shell on WordPress?

The same rules apply to any PHP site behind Cloudflare, WordPress included. Updating WordPress, themes or plugins doesn’t fix PHP2Shell; see PHP2Shell and WordPress. For other providers’ WAF rules, including AWS WAF, see PHP2Shell WAF rules.