Cloudflare is inviting security researchers to break its web application firewall (WAF, the filter that blocks malicious requests before they reach a site) using a live capture the flag challenge built around two serious PHP vulnerabilities.
The target is a deliberately vulnerable setup: stock PHP 8.5.11, Apache 2 via mod_php, and an empty index.php, running inside a Cloudflare Container. Cloudflare's default rules for CVE-2026-109618 and CVE-2026-109619, the two flaws behind a bug the company calls php2shell, sit in front of it. A file named /flag lives in the sandbox, and the whole thing resets every few minutes. To qualify, a researcher must get past the WAF, run code through an authorized POST request, read the flag, verify it in the challenge interface, and file a private report on HackerOne.
The rules are the interesting part. Awards go only to a materially distinct WAF bypass method, even for the same CVE. Reports using the same bypass mechanism count as duplicates, whatever the payload or exploit technique, and cosmetic changes such as equivalent encodings do not count. Only the first complete, reproducible report is considered. In other words, Cloudflare is not paying for new PHP exploits. It is paying for new ways around its own filter.
An update dated October 30 said the response had been strong, and that submissions had already helped the company harden its php2shell protections and add new detections. The challenge remains open, and the company posted details of the managed-rule changes in its WAF changelog.
That speed is the case for the exercise. Pattern-matching filters tend to fail on inputs their authors did not anticipate, and the company said AI is helping attackers find new vectors faster. A bounty that rewards only novel bypasses turns outside researchers into a steady supply of those inputs.
Cloudflare also states the limit of its own product: a WAF can block responses that would leak data, but it cannot undo what an attacker already did at the origin server. The firewall buys time. Patching PHP is still the fix.