Cloudflare Adds Seven WAF Rules Against PHP2Shell RCE Flaws in PHP
Cloudflare shipped seven emergency WAF rules on October 21 to block exploits of two critical PHP remote code execution flaws (CVE-2026-109618 and CVE-2026-109619), but it calls them a stopgap, and patching to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 remains the only full fix.
Cloudflare deployed an emergency WAF release on October 21 containing seven new rules targeting exploit traffic for PHP2Shell. Protection started at 3:02 am UTC, covering free and paid WAF customers by default.
Free plans receive the rules through the Cloudflare Managed Free Ruleset, while Professional, Business, and Enterprise tiers need to confirm deployment in block mode. The changelog lists the new detections as Generic Rules - Anomalous Execution rules numbered 1 through 7, all set to block. An earlier changelog version listed four rules split evenly between blocking and logging.
The rules mitigate CVE-2026-109618 and CVE-2026-109619, which carry a 9.2 CVSS v4.0 score and enable unauthenticated remote code execution across PHP versions 5.4 through 8.5.11. PHP shipped fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Drupal, WordPress, Joomla, and Magento face demonstrated attacks. Chief technology officer Dane Knecht stated that attacks were already emerging and called the rules a stopgap for sites unable to patch immediately.
Drupal stated that updating PHP is the sole complete mitigation because the flaws reside in PHP itself, meaning Drupal updates do not fix them. CISA, the FBI, and the NSA urged organizations to patch or take systems offline. Additionally, Drupal released CVE-2026-108097 fixes in core Field UI versions 11.4.10, 11.3.19, and 10.6.19 on October 14, alongside CVE-2026-108099 fixes for the contributed Entity List module version 3.0.10.