🚨PHP Vulnerabilities Affect 70% of Websites
Your PHP site is at risk, but Cloudflare has your back
TL;DR
Two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect 70% of websites. Cloudflare's WAF protects customers automatically, but PHP updates are still necessary.
Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, were just disclosed, affecting all web servers running PHP 5.4 or later. These flaws can lead to denial of service, remote code execution, and data exposure. If you're using PHP, this is a big deal. Cloudflare has rolled out WAF protections for their customers, but you still need to update your PHP software. PHP powers 70% of websites, so if you're running a PHP app, you're likely affected. Cloudflare's new Managed Response Firewall Default rules are already in place for all plans, including Free.
Key Points
Two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect all web servers running PHP 5.4 or later.
Cloudflare's WAF protections are automatically enabled for Free and paid customers, covering php2shell attacks.
New Cloudflare Managed Response Firewall Default rules (Rule ID afffe22785674c80a31875c848d2242a) are deployed for all plans.
Full transaction detection, a new WAF capability, analyzes both sides of HTTP transactions to reduce false positives.
Cloudflare's Managed Free Ruleset (Ruleset ID 77454fe2d30c4220b5701f6fdfb893ba) protects Free customers against php2shell.
Why It Matters
If you're running a PHP app on a web server, these vulnerabilities could allow attackers to execute malicious code, expose customer data, or disrupt services. Cloudflare's WAF protections are a good start, but updating PHP software is crucial. PHP powers 70% of websites, making this a widespread issue.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.