Cloudflare Warns of Active Exploitation Attempts Against Two Leaked PHP Flaws

Cloudflare has issued a warning about emerging attacks targeting two critical PHP vulnerabilities. In response, the company has implemented emergency web application firewall (WAF) rules while developers await an official security release.

The PHP Foundation has provided advance notice, assigning both vulnerabilities a CVSS v4 score of 9.2, indicating the urgent need for affected environments to prepare for updates.

Dane Knecht, Cloudflare’s Chief Technology Officer, stated that PHP websites protected by Cloudflare already have an initial set of WAF protections in place to cover known exploit vectors.

These rules are available to all customers, including those using the company’s free service. Knecht identifies himself as Cloudflare’s CTO on his public profile.

“We are seeing early attacks emerging and are updating mitigations as new vectors appear,” Knecht wrote in his statement.

Two Leaked PHP Flaws

Cloudflare’s response indicates that exploitation attempts began before the scheduled PHP security release. However, the statements do not disclose details on attack volumes, targeted organizations, successful compromises, or the technical mechanisms behind the vulnerabilities.

This distinction is important: observed attempts at attacks underscore an immediate need for defenses, but they do not independently prove that attackers have successfully compromised PHP servers.

Knecht described the WAF protections as a “stopgap measure,” strongly urging administrators to patch their systems as soon as the PHP Foundation releases the update.

The warning also emphasizes the limitations of the initial rules. Cloudflare states that these rules address known exploit vectors and are being updated as new vectors are identified. Therefore, administrators should not assume that the initial deployment blocks every possible exploitation technique.

The PHP Foundation’s notice schedules the security release for Wednesday, October 21, 2026, at 14:00 UTC (7:30 p.m. IST).

The announcement alerts to two critical vulnerabilities but, in this excerpt, does not provide CVE identifiers, affected version ranges, patched release numbers, exploitation prerequisites, or vulnerability classifications.

PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.

We are seeing early attacks emerging and are updating mitigations as new vectors show… https://t.co/wMz9tDTWwH

— Dane Knecht 🦭 (@dok2001) October 21, 2026

As a result, any claims that either flaw enables remote code execution, authentication bypass, or any specific outcome would be premature without further technical disclosure.

Although the headline says the flaws have been leaked, the excerpts don’t clarify what information leaked, where it appeared, or whether any working exploit code has been made public.

For defenders, the main message is to patch rather than rely on temporary filters. Cloudflare’s emergency rules offer an interim response to known attack vectors. At the same time, administrators are urged to implement the upcoming PHP updates as essential remediation.

Until further details are released, the available statements support heightened readiness without making assumptions about specific exposure.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.