Cloudflare部署防护措施应对php2shell漏洞

Cloudflare与PHP Foundation、OpenAI、Wiz等机构协调，针对php2shell漏洞推出防护措施1。该漏洞包含两个编号CVE-2026-109618和CVE-2026-109619，影响所有运行PHP 5.4及更高版本的网络服务器1，可导致拒绝服务、远程代码执行和数据泄露1。

Cloudflare已于10月21日为所有WAF用户自动部署了防护规则，比公开披露提前9小时启动保护1。该防护措施覆盖所有付费套餐及免费用户1。鉴于PHP被全球约70%的网站使用1，这一防护规则的广泛部署具有重要意义。

Cloudflare为此次防护开发了全交易检测这一创新的WAF能力1，以提高防护效果。

Cloudflare has rolled out defensive measures against the php2shell vulnerability in coordination with the PHP Foundation, OpenAI, Wiz, Quarkslab, and Calif.io 1. The vulnerability, tracked under two CVE identifiers—CVE-2026-109618 and CVE-2026-109619—affects all web servers running PHP 5.4 and later versions 1. Potential attack vectors include denial of service, remote code execution, and data exfiltration 1.

Cloudflare deployed Web Application Firewall (WAF) protection rules for all users on October 21 at 3:02 am UTC, nine hours ahead of public disclosure 1. The protection is automatically applied across all service tiers, including free-tier customers 1. In developing its defensive posture, Cloudflare created a new full transaction detection capability to enhance WAF effectiveness 1. Given that PHP powers approximately 70 percent of websites globally, the rapid deployment addresses a substantial portion of the internet infrastructure 1.