PHP2Shell.help
English
Menu
Fixed releases available for PHP 8.2–8.5 Independent community resource · facts verified 22 Oct 2026

PHP2Shell checker / php2shell waf

PHP2Shell WAF rules: what each provider ships, and why it isn't a fix

Several WAFs added PHP2Shell protections on 21 October 2026: Cloudflare (on by default), AWS WAF (rules you add yourself), Fastly Next-Gen WAF (opt-in virtual patch), Imperva (Cloud WAF by default, on-prem after an update) and Tencent Cloud WAF. A WAF only filters known attack patterns in traffic that passes through it. Updating PHP is still the only complete fix.

PHP2Shell.help editorsVerified Official sources ↓

Does a WAF protect against PHP2Shell?

A WAF reduces the risk but doesn’t fix PHP2Shell. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is in the PHP runtime, and PHP’s announcement says only an update is a complete solution. WAF rules block known attack patterns in traffic that passes through the WAF. Attackers are already varying their requests to get around them, and requests that reach your server some other way are never inspected.

Which WAFs have PHP2Shell rules?

These providers published PHP2Shell protections. Everything in the table comes from each provider’s own post, as of 22 Oct 2026:

ProviderWhat they shippedDo you need to act?
CloudflareSeven emergency managed rules on 21 Oct, plus a response-side rule (post)Free: no. Paid: confirm the Managed Ruleset is set to block. See PHP2Shell and Cloudflare
AWS WAFGuidance in AWS bulletin 2026-143: a body-size rule for CVE-2026-109618 and a custom rule for CVE-2026-109619; AWS says it will update its PHP managed rule groupYes: add the rules to your web ACL
Fastly Next-Gen WAFA templated rule (virtual patch) covering both CVEs (post)Yes: enable the templated rule
ImpervaCloud WAF protected out of the box; Elastic WAF 2.2.1 and WAF Gateway V14.7 / V15.5 LTS after updates (post)Cloud WAF: no. Elastic WAF and WAF Gateway: apply the updates
Tencent CloudWAF and Cloud Firewall support protection; Host Security detects it (notice)Check in the console that protection is on

Alibaba Cloud’s security notice (22 October 2026) tells customers using Alibaba Cloud WAF or Cloud Firewall to keep protection switched on, and says this only lowers risk and doesn’t replace the update; it names no specific rules. We found no official PHP2Shell notice from Akamai as of 22 Oct 2026.

What does AWS WAF recommend for PHP2Shell?

AWS lists two compensating controls in security bulletin 2026-143-AWS:

  • For CVE-2026-109618: the SizeRestrictions_BODY rule in the AWS WAF Core rule set, which blocks request bodies over 8 KB (8,192 bytes).
  • For CVE-2026-109619: a custom rule that blocks POST requests containing PHP_SESSION_UPLOAD_PROGRESS in the body together with PHPSESSID in the body or a cookie. The bulletin includes the rule JSON to copy.

AWS says neither is a complete mitigation and it will update the AWS WAF PHP managed rule group. For EC2, Lightsail and Elastic Beanstalk updates, see PHP2Shell on AWS.

Why isn’t a WAF enough on its own?

There are three reasons:

  1. Bypass: the WAF only sees traffic that goes through it. If your server accepts connections directly, an attacker who finds its IP address skips the WAF entirely.
  2. Variants: Cloudflare reported attackers changing payloads to evade its rules before the patch was out. Rules catch known patterns; new variants can slip through until rules are updated.
  3. The flaw stays: the vulnerable PHP is still on your server, along with any other path to reach it.

What should I do besides the WAF?

Update PHP to the fixed release for your branch:

BranchFirst fixed release
PHP 8.28.2.35
PHP 8.38.3.36
PHP 8.48.4.27
PHP 8.58.5.12
8.1 and olderNo new release; official source patches for 7.4, 8.0 and 8.1

Check your version with the PHP2Shell checker and follow the PHP2Shell patch guide. Until you can update, combine the WAF with PHP’s own stopgaps in the CVE-2026-109618 workaround, and check for signs of compromise with our checklist: a WAF added after the leak doesn’t undo an earlier intrusion.

Can a WAF replace the PHP2Shell update?

No. Every provider listed here calls its rules a compensating control, and PHP's announcement says only an update is a complete solution. Use the WAF to buy time and update PHP.

Will these WAF rules break my site?

They can. AWS's suggested body-size rule blocks request bodies over 8 KB, which stops large forms and uploads. Test in count or log mode first where your provider allows it, and watch blocked requests after you switch to block.

Check your PHP for PHP2Shell

Enter the version your website reports. We compare it with the first fixed release for its branch and tell you what to do next.

PHP2Shell checker →

Sources

The core facts on this page (fixed versions, CVE details, vendor packages and agency warnings) come from official sources. Research, news and community posts are labelled as such.