Anyone running PHP 5.4 or later should update the PHP runtime itself, because two newly disclosed flaws known as php2shell sit below the application layer. Updating a plugin or site code will not fix them.
Calif.io, Wiz, OpenAI and Quarkslab disclosed the bugs on October 21 as CVE-2026-109618 and CVE-2026-109619. A specially crafted HTTP request could cause denial of service, remote code execution or data exposure. If a host manages your PHP, ask it to apply the security update. Limiting upload sizes may reduce exposure, Cloudflare said, but it is no substitute for the patch.
Both bugs involve memory handling when a request fails midway. In the first, PHP runs out of memory before some internal data is initialized, then uses that unfinished data during cleanup. In the second, a fatal error leaves PHP holding references to memory that is freed when the request ends. A later request handled by the same process can follow those stale references and access memory it should not.
Cloudflare said it worked with the PHP Foundation, OpenAI, Wiz and others on mitigations. By its account, firewall rules were live for free and paid plans by 3:02 am UTC on October 21, about nine hours before disclosure. The company also said the details leaked ahead of the official release date, that it saw attack traffic aimed at its customers, and that attackers altered their payloads to slip past its rules.
The more interesting detail is how the defense works. Request data alone often cannot separate an exploit from legitimate traffic, so Cloudflare built what it calls full transaction detection. It weighs the request and the origin server's response together and can block a response before it reaches the requester. These are the first managed detections to use it. Reading responses is a sensible way to cut false positives, but it only buys time, and the company itself tells customers to patch.
PHP runs almost 70% of websites, according to Cloudflare, including platforms such as WordPress and Magento. Whether response-side inspection stays a one-off for php2shell or becomes a standard part of the firewall is an open question.