Cloudflare Launches PHP Security Challenge to Test Its WAF After php2shell
Cloudflare announced a PHP security research challenge on October 27, 2026, inviting researchers to test its web application firewall (WAF) against the critical vulnerabilities known as php2shell.
The announcement follows the October 21 PHP fixes for CVE-2026-109618 and CVE-2026-109619, which can allow remote code execution in affected installations. Cloudflare describes its response in its php2shell protection report, including rules that examine requests and responses.
What researchers are being asked to test
Cloudflare has placed a deliberately vulnerable PHP 8.5.11 installation, running under Apache 2 with mod_php, behind its WAF in an isolated sandbox. Researchers participating through its HackerOne program are invited to demonstrate an eligible bypass.
The rules restrict testing to designated challenge endpoints and require a complete verified result and private reporting. Third-party attacks, out-of-scope scanning and denial-of-service activity are excluded. The official announcement links to the rules and current challenge status; Cloudflare can end the event, so readers should check those sources before participating.
A WAF does not repair PHP
Cloudflare explicitly warns that blocking a response cannot undo actions already performed on the origin server. Filtering traffic can reduce exposure while an update is being deployed, but it does not fix the vulnerable PHP runtime.
For website operators, the priority remains the one described in Critical PHP Security Flaws: Which Versions to Install: install a fixed, supported build, restart or replace affected workers, and verify the runtime that serves web requests. Checking command-line PHP alone may tell you nothing about the version used by an FPM pool, Apache module or container.
The PHP security advisory lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the first fixed upstream releases for these flaws. Use an appropriate fixed release or a vendor-supported package with backported patches; the package version alone may not establish whether a distribution has applied the fix.
Verify the update and application behavior
After updating, review server and WAF logs and investigate unexpected files, processes or failures. A clean HTTP response is not proof that a server has never been compromised.
For ordinary functional checks, the cURL command builder can prepare repeatable requests. The browser Network inspection guide helps track response errors in forms, logins and API calls. These checks help confirm that the application works after the update; they are not vulnerability scans or an incident investigation.