[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-cloudflare-dares-researchers-to-bypass-its-php-firewall-rules":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12416,"cloudflare-dares-researchers-to-bypass-its-php-firewall-rules","Cloudflare Dares Researchers to Bypass Its PHP Firewall Rules","Cloudflare put a deliberately vulnerable PHP server behind its firewall and offers bounties for bypasses, but only for techniques it has not seen.","Cloudflare is inviting security researchers to break its web application firewall (WAF, the filter that blocks malicious requests before they reach a site) using a live capture the flag challenge built around two serious PHP vulnerabilities.\n\nThe target is a deliberately vulnerable setup: stock PHP 8.5.11, Apache 2 via mod_php, and an empty index.php, running inside a Cloudflare Container. Cloudflare's default rules for CVE-2026-109618 and CVE-2026-109619, the two flaws behind a bug the company calls php2shell, sit in front of it. A file named \u002Fflag lives in the sandbox, and the whole thing resets every few minutes. To qualify, a researcher must get past the WAF, run code through an authorized POST request, read the flag, verify it in the challenge interface, and file a private report on HackerOne.\n\nThe rules are the interesting part. Awards go only to a materially distinct WAF bypass method, even for the same CVE. Reports using the same bypass mechanism count as duplicates, whatever the payload or exploit technique, and cosmetic changes such as equivalent encodings do not count. Only the first complete, reproducible report is considered. In other words, Cloudflare is not paying for new PHP exploits. It is paying for new ways around its own filter.\n\nAn update dated October 30 said the response had been strong, and that submissions had already helped the company harden its php2shell protections and add new detections. The challenge remains open, and the company posted details of the managed-rule changes in its WAF changelog.\n\nThat speed is the case for the exercise. Pattern-matching filters tend to fail on inputs their authors did not anticipate, and the company said AI is helping attackers find new vectors faster. A bounty that rewards only novel bypasses turns outside researchers into a steady supply of those inputs.\n\nCloudflare also states the limit of its own product: a WAF can block responses that would leak data, but it cannot undo what an attacker already did at the origin server. The firewall buys time. Patching PHP is still the fix.","[\"cloudflare\",\"waf\",\"php\",\"bug-bounty\"]","2026-10-27T13:00:00.000Z","2026-11-08T01:02:11.812Z","2026-11-08T01:02:11.995Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The lead's claim that the challenge opened 'on October 27' appears nowhere in the source, which only says 'today' and carries an October 30 update, so remove or source that date; also cut the closing line about what Cloudflare 'has not said' and end on a real concluding point.","resolved","security",[32,33,34,35],"cloudflare","waf","php","bug-bounty",[37],{"name":38,"url":39},"Cloudflare Blog","https:\u002F\u002Fblog.cloudflare.com\u002Fphp-ctf\u002F",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7110,"2026-11-08T14:34:09.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1099,"2026-11-08T15:24:01.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Deals","deals",620,"2026-11-08T08:00:00.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Policy","policy",604,"2026-11-07T15:48:26.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",336,"2026-11-08T21:00:00.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Hardware","hardware",316,"2026-11-08T14:36:39.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",222,"2026-11-07T16:19:17.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",154,"2026-11-08T15:42:52.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",150,"2026-11-06T16:50:01.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",125,"2026-11-06T22:15:59.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",111,"2026-11-08T21:27:29.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",94,"2026-11-08T20:52:05.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]