Cloudflare Detects Early Exploitation Attempts Targeting Two Leaked PHP Vulnerabilities

Cloudflare says it is seeing early attempts to exploit two critical PHP vulnerabilities whose details surfaced before the PHP security team’s planned release. The company has deployed an initial set of Web Application Firewall (WAF) rules to block known exploit patterns. Cloudflare says the rules are available to all customers, including those on free plans, and that it is updating them as new patterns appear.

The warning raises the urgency for teams running PHP websites, but the firewall rules are only a temporary layer of protection. Cloudflare’s chief technology officer, Dane Knecht, said customers should patch as soon as PHP publishes its security update. At the time of writing, the release is scheduled for 14:00 UTC on October 21, or 19:30 IST.

Public reports track the flaws as CVE-2026-109618 and CVE-2026-109619. The PHP security team has rated both critical, with a CVSS v4.0 score of 9.2. Researchers and security reports describe them as remote code execution vulnerabilities, a type of flaw that could let an attacker run code on a vulnerable server. However, PHP has not yet published full technical details, including the affected components, precise attack paths, or confirmed vulnerable versions.

The information became public before the planned disclosure and security update. The PHP team announced an earlier release date after the leak, and said it could move the release forward again if technical details became public or it found evidence of active exploitation. Cloudflare’s warning now indicates attempts are emerging, although the company has not shared evidence or details that would allow readers to assess their scale or success.

A WAF checks web requests and can block traffic that matches known harmful patterns. These rules can reduce exposure while administrators prepare updates, but they cannot replace fixes to the underlying PHP code.

New PHP2Shell exploit patterns may also evade rules written for known requests. Cloudflare says it is adjusting its protections as new vectors appear, but it has described the rules as a stopgap.

Organizations should identify every internet-facing system that runs PHP, including sites built with content-management systems and software that bundles its own PHP runtime. Administrators should monitor PHP’s official security notices and their operating-system or hosting provider’s update channels.

Once fixed releases are available, they should verify the affected versions and apply the right update promptly. Teams should also check that their WAF is enabled and that relevant rules are set to block, not merely log, suspicious requests, as Cloudflare has advised paying customers.

After patching, defenders should review web-server and PHP logs for unusual requests and check whether PHP worker processes launched unexpected programs. Security teams should investigate suspicious activity rather than assuming that a WAF block means a system was never reached. If a server shows signs of compromise, preserve logs and follow the organization’s incident-response process.

The incident also shows how a vulnerability disclosure leak can compress defenders’ preparation time. PHP’s broad use across websites and hosting services means administrators may need to locate runtimes outside their main application inventory.

Reports say the flaws may affect older PHP versions, but the official affected-version list is still pending, so organizations should avoid relying on preliminary claims.

For continuing coverage, see Cyber Security News’ report on PHP’s planned emergency security update and its coverage of other recent PHP vulnerabilities.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.