Cloudflare deploys default WAF protections for newly disclosed PHP vulnerabilities (php2shell)
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities, before public disclosure. The rules use request and response signals to block exploit attempts and prevent exposed data from reaching attackers.
Why it matters
Sites running PHP behind Cloudflare may receive default WAF filtering against these vulnerabilities without changing their own code. This reduces exposure during the window between disclosure and patching.
Who should care
Website operators, ecommerce brands, and developers running PHP applications behind Cloudflare.
What you can do
Confirm that Cloudflare's managed WAF rules are enabled for your zone, and apply the official PHP patch to your servers as soon as it is available.