// CloudflareMEDIUM
Cloudflare announced measures on October 27, 2026, against serious PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. The company shipped client updates, deployed WAF mitigations, and launched a limited-time PHP Capture the Flag security challenge to test bypasses. WAF protections are available across all Cloudflare plans, including Free.
- Cloudflare stock highlights new PHP security challenge(opens in a new tab)
- Timeline of PHP2Shell - DEV Community(opens in a new tab)
// Get alerts for Cloudflare