Does Cloudflare Protect Against PHP2Shell?
Yes, partly. Cloudflare turned on WAF rules for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on every plan, including Free, before the vulnerability was disclosed. The rules block known attack patterns for traffic that goes through Cloudflare. They do not fix PHP on your server.
Short answer: on Cloudflare Free you have nothing to switch on. On paid plans, check that the Managed Ruleset is set to block. Either way, still update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Cloudflare PHP2Shell rules by plan
According to Cloudflare's blog post, the rules went live at 03:02 UTC on October 21, 2026, about nine hours before the official disclosure. They are on by default for all plans with the WAF deployed.
| Plan | Where the PHP2Shell rules are | What you need to do |
|---|---|---|
| Free | Cloudflare Managed Free Ruleset, rules named "Generic Rules - Anomalous Execution" 1 to 7 | Nothing; they are on by default |
| Pro, Business, Enterprise | Cloudflare Managed Ruleset, seven PHP2Shell rules | Confirm the ruleset is deployed and set to block |
| All plans | "Default block for High confidence Signatures", which checks both the request and the response | Nothing; on by default |
Cloudflare's post lists every rule ID if you want to find them in the dashboard under Security, then WAF, then Managed rules.
What Cloudflare's PHP2Shell rules do not cover
- Traffic that does not pass through Cloudflare. A DNS record set to DNS only (grey cloud), another domain hosted on the same server, or a direct connection to the server's IP address all reach PHP without the WAF.
- New variants. Cloudflare saw attackers changing their payloads to get past its rules within hours, and says it will keep updating them. A rule can only block what it recognises.
- The bug itself. PHP is still vulnerable until it is updated. Cloudflare describes its rules as defense in depth, not a fix.
How to make Cloudflare protection count
- Make sure every hostname that serves PHP is proxied (orange cloud).
- Stop direct access to the origin: allow web traffic only from Cloudflare's IP ranges at your firewall, or use Cloudflare Tunnel.
- On paid plans, open Security, WAF, Managed rules and confirm the Cloudflare Managed Ruleset is deployed with the block action.
- Apply the temporary php.ini mitigations until you can update.
- Update PHP, restart PHP-FPM or Apache, and confirm with the PHP2Shell checker.
Blocked requests in your Cloudflare Security events are common scans and do not on their own mean your site was hacked. If your server was reachable without Cloudflare and unpatched on October 20 or 21, use the post-patch checklist.
Other WAF and CDN protection for PHP2Shell
| Provider | Status |
|---|---|
| Akamai | App & API Protector customers protected; new rule 3000991 "PHP Remote Code Execution Attack Detected" |
| Imperva | Cloud WAF protected out of the box; Elastic WAF and WAF Gateway need a software update |
| Automattic | WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr sites protected, no action needed |
| Fastly, Google Cloud, AWS, Microsoft, Vercel | Named as partners that prepared mitigations; no specific rule published that we could find |
For the current attack picture, see is PHP2Shell exploited in the wild.
Cloudflare and PHP2Shell FAQ
Does Cloudflare protect against PHP2Shell?
Cloudflare deployed WAF rules for PHP2Shell at 03:02 UTC on October 21, 2026, before the official disclosure. They are on by default on all plans with the WAF deployed, including Free. They block known attack patterns but do not fix PHP.
Do I need to do anything on the Cloudflare Free plan?
Cloudflare says Free plan users need no action: the rules are in the Cloudflare Managed Free Ruleset, which is on by default. You still need to update PHP on your server.
Is Cloudflare enough, or do I still need to patch?
You still need to patch. Cloudflare calls its rules defense in depth, not a fix, and attackers were already changing their payloads to get past the rules. Every vendor says updating PHP is the only complete fix.
Does Cloudflare protect my server if someone connects to its IP directly?
No. The rules only see traffic that passes through Cloudflare's proxy. DNS records set to DNS only, other domains on the same server and direct connections to the server's IP address are not covered.
Do other CDNs and WAFs protect against PHP2Shell?
Akamai, Imperva and Automattic (WordPress.com, WordPress VIP, Pressable) said their customers are protected. Fastly, Google Cloud, AWS, Microsoft and Vercel were named as partners that prepared mitigations, but we found no specific rule names from them.