Cloudflare has launched a limited-time security challenge that invites researchers to try to bypass its web application firewall protections for two PHP vulnerabilities. The challenge follows a period when compromised certificates and serious PHP vulnerabilities drew attention to internet security risks.
For business owners, the news is not an invitation to test Cloudflare’s challenge. It is a reminder that security controls can help, but they do not replace keeping software up to date. If your website or business application runs PHP, the useful response is to understand what is exposed, check how updates are handled, and know what your team would do if a vulnerability affected your systems.
What Cloudflare is testing
Cloudflare’s challenge places a deliberately vulnerable PHP installation behind its WAF. The company says the target focuses on CVE-2026-109618 and CVE-2026-109619, the two PHP vulnerabilities behind php2shell. Researchers are asked to bypass the WAF, exploit the sandbox, and retrieve a file called `/flag`.
The environment uses stock PHP 8.5.11 with standard PHP extensions and Apache 2 via mod_php. It runs in a Cloudflare Container with an empty `index.php`, while Cloudflare’s default WAF protection rules for the vulnerabilities are enabled in front of it. The sandbox resets every few minutes, including the flag file.
Cloudflare describes the challenge as part of its Bug Bounty program on HackerOne. Participation is limited to authorized testing against the challenge hostname’s WAF-protected `/php/*` endpoints using POST requests. Other Cloudflare services, direct access to the underlying infrastructure, the upstream PHP project, and third-party systems are out of scope. The rules also prohibit denial of service, high-volume scanning, persistence, social engineering, and attacks on other participants.
The Cloudflare announcement gives the challenge scope, reporting requirements, and terms. Those details matter: testing outside the stated authorization is not part of the challenge. Cloudflare says the HackerOne Bounty Terms prevail if they conflict with the blog post, and the challenge may be suspended or terminated.
Why this matters to a business
The challenge is designed to test defenses against specific vulnerabilities. That makes it a useful illustration of a broader point: a security product may block an exploit attempt, but a business still needs to address vulnerable software at its source. Cloudflare explicitly says its WAF is not a replacement for fixing vulnerable software.
Cloudflare says it updated its WAF with new rules to block attackers exploiting the PHP vulnerabilities and introduced full transaction detection. It also says new capabilities were made available on all plans, including Free. These are details about Cloudflare’s response, not a reason to assume every website has the same protection or configuration.
A WAF can help block exposed data from reaching an attacker, according to Cloudflare. But the company also warns that response blocking cannot undo actions already performed at the origin. For a business owner, the practical lesson is to avoid treating a blocked request as proof that the underlying application is safe. Find out whether the vulnerable software is present and whether the relevant update has been applied.
This is especially important when an outside provider manages your website or application. You may not handle PHP directly, but you can still ask who is responsible for updates, how urgent security notices are reviewed, and how you will be told if action is needed. If you are reviewing your site’s foundations, our website audit can help you assess what needs attention.
What a business owner should take from the CTF
A capture-the-flag challenge is a controlled test, not a security update for your own system. Cloudflare’s setup is deliberately vulnerable and isolated. The company asks participants to use test data only because it records attempted metadata and request payloads. It also says not to send credentials, personal information, or other sensitive information.
That boundary is a useful model for your own security work. Testing should be authorized, limited to agreed systems, and designed to avoid real customer information. Do not ask a staff member or contractor to probe a live service unless the owner has clearly authorized the work and defined its scope.
The reporting rules also show what useful security evidence looks like. For eligible findings, Cloudflare asks researchers to provide the endpoint, complete payload and request sequence, relevant headers and body bytes, reproducible proof, an explanation of the bypass and execution, and verification details. A business does not need to copy a bug bounty process for every issue. But clear records help your team understand what happened and what needs fixing.
Cloudflare says a report must demonstrate attacker-controlled PHP code or command execution inside the sandbox through an authorized POST request, recover the current `/flag`, and verify it through the challenge interface. A successful interface check does not itself submit a HackerOne report or establish reporting priority. File disclosure without remote code execution, or execution without successful flag recovery and verification, is not eligible.
The distinction matters for business security too: a warning, a blocked request, and confirmed compromise are different findings. Make sure your provider explains what evidence they have, what systems may be affected, and what actions they recommend. Avoid drawing conclusions from a single alert without checking the details.
Check your software and support arrangements
Cloudflare recommends following the latest PHP security advisories and applying relevant updates. Start by finding out whether your site, online store, portal, or application uses PHP. If you do not know, ask your hosting provider, developer, or technology team. Record who owns the answer and who is responsible for acting on it.
Then review how updates and security notices are handled. Ask your provider how they identify affected software, how they apply relevant updates, and how they confirm the work is complete. If you use a developer or agency, agree on how urgent security issues will be communicated and who can approve changes.
If your business relies on an online store, client portal, or booking service, include those systems in the review. A security issue may affect software managed by a supplier as well as software hosted directly by your business. Our online store development and business website development pages explain the kinds of platforms businesses use, but the security questions apply regardless of who built the site.
Keep your review practical. You do not need to understand exploit payloads to ask whether the software is affected, whether the relevant update is available, and whether it has been applied. If a provider says a WAF rule is in place, ask whether the application itself has also been updated or otherwise addressed.
What to do next
- Ask what runs your website. Confirm whether PHP is used and who manages the application, hosting, and security updates.
- Check for relevant advisories. Cloudflare recommends following the latest PHP security advisories and applying relevant updates. Ask your provider to confirm whether any action is needed for your setup.
- Clarify responsibility. Decide who reviews security notices, approves changes, applies updates, and informs you when work is complete.
- Keep testing authorized. Do not probe systems without permission. If you commission security testing, agree on the targets, methods, and limits first.
- Protect test and business data. Cloudflare warns challenge participants not to send credentials or personal information. Apply the same care when arranging tests of your own systems.
- Treat protective layers as layers. A WAF can be useful, but Cloudflare says it does not replace fixing vulnerable software. Ask about both the protection in front of your site and the software running behind it.
The challenge gives security researchers a controlled way to test Cloudflare’s defenses. For business owners, its clearest lesson is more straightforward: know what software your business depends on, keep it maintained, and make sure security work has a responsible owner.
Sources
- Introducing the Cloudflare PHP Capture the Flag challenge — Cloudflare Blog, Oct 27, 2026
This article was drafted with AI from the sources above, then published only after passing 20 automated checks: every figure must appear in the sources, links must work, and nothing may be invented. Spotted an error? Tell us and we'll correct it.
Want us to do this for you?
We help businesses across 3 continents implement everything you just read — and a lot more.