Cloudflare opens PHP CTF for php2shell WAF bypasses
Original title: Introducing the Cloudflare PHP Capture the Flag challenge
HackerOne participants must get code execution on PHP 8.5.11, read a resetting flag, and privately report a distinct bypass.
Cloudflare launched a limited-time PHP Capture the Flag through its HackerOne bug bounty after last week’s php2shell vulnerabilities. A stock PHP 8.5.11 and Apache 2 sandbox sits behind default WAF rules for CVE-2026-109618 and CVE-2026-109619. Eligible reports must show remote code execution, recover /flag, verify it in the interface, and document a materially distinct bypass. Cloudflare says the WAF is not a substitute for applying PHP updates.
Unconfirmed: The post does not say whether anyone has already bypassed the WAF or exploited the PHP flaws in the wild.
- The sandbox uses mod_php, an empty index.php, and resets every few minutes.
- Only POST requests to the challenge hostname’s /php/* endpoints are in scope.
- File disclosure without code execution, or partial chains, is not eligible.
- Cloudflare decides duplicates and rewards; equivalent encodings do not count as unique.
- The post also notes eight compromised eMudhra intermediate certificates last week.
Impact: Remote PHP code or command execution behind the WAF
| Product | Affected |
|---|---|
| PHP | 8.5.11 in the challenge sandbox |
- 1.Follow the latest PHP security advisories and apply the relevant updates.
- 2.Submit eligible bypasses privately on HackerOne with a full reproducible request chain.
- Vendors
- Cloudflare
- Products
- PHPApacheCloudflare WAF
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
4 min read at blog.cloudflare.com
We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer.
By Celso Martinho · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.