PHP php2shell Vulnerabilities: What Business Owners Should Do Now

If your business website runs PHP, a newly disclosed vulnerability is a reason to check your security arrangements. The flaws, known as php2shell, affect the PHP runtime and may let attackers disrupt a service, expose data or run malicious code on a vulnerable server.

Cloudflare says it deployed WAF protections for the vulnerabilities, including on Free plans. That is useful extra protection, but it does not replace updating PHP. The practical first step is to find out who manages the PHP software behind your website and confirm that it will be patched.

What happened

On October 21, Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. They affect web servers running PHP 5.4 or later. An attacker may trigger them by sending specially crafted HTTP traffic to an affected application.

The flaws involve PHP’s handling of memory when request processing goes wrong. In one case, PHP may use internal data that was not fully initialized after an error. In another, a later request may follow outdated references to memory that has already been released.

Depending on the circumstances, an attack may crash a PHP process, expose sensitive information or execute attacker-provided code. Large requests can put memory under pressure, but the issue is not simply that a request uses too many server resources.

PHP underpins widely used platforms such as WordPress and Magento. The source says PHP is used by almost 70% of websites, which helps explain why this runtime issue could matter to many businesses. Your own exposure depends on the PHP software and services running your site.

Cloudflare describes the disclosure as part of a coordinated effort. It says it had developed WAF mitigations before public disclosure, deployed them about nine hours ahead of that disclosure, and observed attack traffic targeting customers.

Why a WAF is not the PHP fix

A web application firewall can inspect web traffic and block activity that matches its protections. Cloudflare says its protections for php2shell are available automatically on plans with WAF deployed, including Free users. It also says its analysts continue monitoring attack activity and updating rules as techniques change.

But a WAF is a layer of defence, not a substitute for fixing vulnerable software. The flaws are in the PHP runtime, so changing website code or updating a plugin alone does not resolve them. The necessary action is to update the PHP software running the application.

Cloudflare also notes that request data alone may not reliably distinguish an exploit from legitimate traffic. Its new full transaction detection capability combines signals from a request and the origin’s response in the same HTTP transaction. Response rules can block a matching origin response before it reaches the requester.

That approach is a useful example of why security controls can work in layers: detection at the network edge may reduce risk while a business arranges a software update. Still, no WAF rule should be treated as proof that an outdated server is safe. Keep the PHP patch on your task list even if your firewall reports protection.

What the Cloudflare update means for your site

Cloudflare says the protections are deployed automatically on all plans with WAF enabled. Free customers do not need to take action to enable the new rules. For paid Professional, Business or Enterprise plans, Cloudflare advises customers to review their Managed Ruleset deployment and confirm it has deployed in block mode.

The source lists the rule “PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6” as protecting against a related vulnerability disclosed in an update on October 23. That update concerns CVE-2026-115560 in PHP’s session upload progress feature. The advisory says it affects fully patched PHP releases, including 8.5.12, and will be fixed in PHP’s next regular release.

There is an important condition: Cloudflare says its WAF protection for that related vulnerability covers sites using PHP’s default upload progress field name. Customers who have changed `session.upload_progress.name` are not covered by that rule. If this setting applies to your site, raise it with your developer or hosting provider rather than assuming the WAF covers it.

Cloudflare’s protection also depends on having its WAF deployed. If you use another provider or security service, do not assume it has the same rules. Ask the provider what protection is in place and what action it recommends.

What business owners should check

Start by identifying who controls the server or hosting account. Many business owners do not manage PHP directly. A website agency, developer or hosting provider may handle it, but you should still request a clear answer about the version in use and the update plan.

Ask these questions:

• Does the website or any application it uses run PHP?
• Who is responsible for updating the PHP runtime: your team, developer or host?
• Has the PHP security update been applied, or when will it be applied?
• Is a WAF deployed, and are the relevant protections enabled in block mode where required?
• Does the site use a changed `session.upload_progress.name` setting?

The PHP advisory is the source for affected versions and remediation instructions. Cloudflare also advises keeping its WAF protections enabled while patching. If your host manages PHP, ask the host to apply the security update and confirm when that work is complete.

Restricting unnecessary uploads and limiting upload sizes can reduce exposure, according to the source. Treat these as supporting measures, not a replacement for updating PHP. If your site’s security arrangements are unclear, a website audit can help you identify questions to resolve about the site and its setup.

Make security ownership clearer

This incident is also a reminder that responsibility can be spread across a business owner, a website developer and a hosting provider. If nobody knows who handles runtime updates, a security notice can sit unanswered. Write down who owns each task and how you will confirm it has been done.

For future work, include software maintenance and security updates in your website or hosting discussions. If you are planning a new site or a substantial rebuild, make ongoing maintenance part of the scope, not an afterthought. Our website development service can help businesses plan and build their web presence, while a professional service website is designed for firms that need to explain services and handle enquiries.

What to do next

1. Contact your developer or hosting provider today and ask whether your site runs PHP and who manages its updates.
2. Request confirmation that the PHP security update for CVE-2026-109618 and CVE-2026-109619 has been applied, or ask for a remediation plan based on the PHP advisory.
3. If you use Cloudflare, verify that the WAF is deployed. For Professional, Business or Enterprise plans, check that the Managed Ruleset is in block mode.
4. Ask whether the site has changed `session.upload_progress.name`, because Cloudflare says its rule for CVE-2026-115560 does not cover changed names.
5. Keep the WAF enabled during patching, restrict unnecessary uploads, and record who will monitor future updates.

You can read Cloudflare’s explanation of the php2shell protections for its account of the vulnerabilities, WAF rules and related advisory. Use it alongside the PHP advisory when discussing the fix with whoever manages your site.