{"id":"CVE-2026-115560","kind":"vulnerability","aliases":["CVE-2026-115560"],"related":[],"title":"Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog","description":"Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog\n\nOctober 21, 2026\n\n# Cloudflare deploys protections against php2shell vulnerability\n\nDaniele Molteni\n\nDan Jones\n\n and \n\nKuber Nandwani\n\nUpdate - On October 23, the PHP project published an informational advisory for a related vulnerability, CVE-2026-115560, in PHP's session upload progress feature. It affects fully patched PHP releases, including 8.5.12, and will be fixed in PHP's next regular release.\n\nAll Cloudflare WAF customers are protected against known exploit attempts if their site uses PHP's default upload progress field name. Customers who have changed `session.upload_progress.name` are not covered by the WAF rule.\n\nThe existing rules \"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6\" protects against this vulnerability.\n\nMore information to follow.\n\nOctober 21, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic.\n\nCloudflare has been part of a coordinated effort to deploy mitigations to protect the Internet, working with PHP foundation, OpenAI and Wiz among others. Cloudflare has developed and deployed web application firewall (WAF) protections since early October 2026, which were deployed about 9 hours ahead of public disclosure. Starting on October 21 3:02 am UTC, Cloudflare customers using our free or paid WAF were protected by default against php2shell.\n\nCloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers. We observed how attackers were mutating the attack payload to try to bypass our protections by tracking the volume of matches and cross-referencing with the rule logic.\n\nProtecting against php2shell required more than standard request-based rules. Request data alone does not always provide enough evidence to distinguish an exploit from legitimate traffic. The origin’s response adds context, helping identify whether an exploit succeeded while reducing the risk of false positives.\n\nTo deliver this protection, we developed full transaction detection, a new Cloudflare WAF capability that combines signals from the request and response within the same HTTP transaction. Response rules can then block a matching origin response before it reaches the requester. The php2shell protections are the first managed detections we have released using this capability.\n\nCustomers should patch their PHP repos even with WAF protections providing an additional layer of defense-in-depth mitigation. Our security analysts continue monitoring attack activity and update the rules when and if new techniques and variations emerge in the hours and days ahead. You can track new rules in the changelog.\n\nThe protections are available and deployed automatically on all plans with WAF deployed, including Free users.\n\n## Copy link What we know about the vulnerabilities\n\nPHP is used by almost 70% of websites. The php2shell vulnerabilities affect the PHP runtime itself and can allow attackers to execute malicious code on vulnerable servers, expose customer data, or disrupt services. Because PHP underpins widely used platforms such as WordPress and Magento, these flaws could potentially affect a large number of applications across the Internet.\n\nThe two vulnerabilities involve how PHP handles memory when something goes wrong while processing a HTTP request. Normally, PHP allocates memory to store the data it needs to process a request, then releases it when that work finishes. If processing stops unexpectedly, for example because it runs out of memory, PHP fails to clean up the memory safely. These vulnerabilities arise when PHP handles an error and then tries to use data that was not fully set up or memory that has already been released.\n\nAn attacker can send specially crafted HTTP requests to trigger these conditions. Large requests are one way to put memory under pressure, but the problem goes beyond consuming server resources. By manipulating the data PHP encounters in this invalid memory, an attacker may be able to crash a PHP process, expose sensitive information, or execute code provided by the attacker.\n\nThe two vulnerabilities differ in when the unsafe memory access happens:\n\nVulnerability\n\nWhat goes wrong\n\nCVE-2026-109618\n\nPHP runs out of memory and interrupts its work before some internal data has been properly initialized. During cleanup of that request, PHP may use this unfinished data as though it were valid.\n\nCVE-2026-109619\n\nA fatal error interrupts a request, leaving PHP holding references to memory that is released when the request ends. When the same PHP process handles a later request, it may follow those outdated references and access memory that is no longer valid and expose sensitive data.\n\nThese flaws are in the PHP runtime, so updating website code or a plugin(s) alone does not fix these vulnerabilities. Administrators need to update the PHP software running their applications. If a hosting provider manages PHP, ask the provider to apply the security update.\n\nAdministrators can follow the PHP advisory for affected versions and remediation instructions. Keep Cloudflare WAF protections enabled while patching. Restricting unnecessary uploads and limiting upload sizes can also reduce exposure, but these measures do not replace the PHP fix.\n\n## Copy link New rules\n\nFor Free customers, new rules have been released under the Cloudflare Managed Free Ruleset (Ruleset ID 77454fe2d30c4220b5701f6fdfb893ba). Free customers don’t have to take any actions to enable the protection. To override the ruleset behavior, you can refer to our documentation.\n\n| Rule Description | Rule ID |\n| --- | --- |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) | 4e315666e8e344cdb64119a3b5ccf32f |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | 00c10e6cc4da4bd08722adeebcd95984 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | 48ddf592361e4fdb97a8a85982dab691 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 | 3556683d512a47f2937899c524b1a4c6 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 | da07c85852e34625bb478496302ede46 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 | 19373a83abb840e18ab3ce5a7975ce1b |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 | 07f0b6ddaabf40b1b2042dade8d613fa |\n\nProtection for paid plans has been released as part of the Cloudflare Managed Ruleset (Ruleset ID efb7b8c949ac4650a09736fc376e9aee). If you are on a Professional, Business, or Enterprise plan, review your Managed Ruleset deployment to confirm it has deployed block mode.\n\n| Rule Description | Rule ID |\n| --- | --- |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) | c1d409ad838f47f59446f21cc438d5dd |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | f9a45927414245e3a64bb12d0a0c2f64 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | 771c654ae1154d4daa72f4e1545d163c |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 | 217005865f0145f392300bac212afcc9 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 | 38efdb17ea594501bb55a1d71867b12e |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 | 4148ae686fdb4d01be673fab9d9c073d |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 | 1389aa259617437392ce149c48143645 |\n\nTo better identify exploit attempts, Cloudflare developed full transaction detection, a new WAF capability that analyzes both sides of the same HTTP transaction. While some malicious payloads can be identified using the request alone, the response contains useful signals that can be used to create rules with higher confidence, reducing false positives. A matching full transaction rule can block the origin response before it reaches the requester. Learn how it works in our full transaction detection blog post.\n\nThe new Cloudflare Managed Response Firewall Default has been automatically deployed for customers on all plans, including Free. To verify that the response rules are active, you can visit the Security > Security Rules page. Read the full transaction blog to learn how to customize its deployment.\n\nThe new Cloudflare Managed Response Firewall Default detection is protecting your traffic.\n\n## Copy link Review events and customize protection\n\nTo analyze blocked requests, visit Security > Security Analytics > Events. Filter by the rule IDs in the table above and inspect the matched request, action, and path. Events identify whether the action came from a managed or custom rule. Customers who need to tailor the protection can update the scope of the Managed Ruleset to the parts of an application where it is relevant.\n\n## Copy link Update PHP and keep the protection enabled\n\nCloudflare customers using our Managed Ruleset are protected by default. We recommend following the advisory recommendation and applying the vendor update to your PHP repos as soon as possible while keeping the WAF protection enabled as an additional protection. Our WAF analysts will continue to update protections as new techniques emerge.","summary":"PHP's session upload progress feature has a flaw, which the PHP project disclosed on October 23 in an informational advisory. The sources do not say what an attacker gets from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","poc-public","lab-disclosure","cloudflare","php","self-hosted"],"not_affected_if":[],"how_to_check":"- Check whether the session upload progress feature is enabled and whether `session.upload_progress.name` has been changed from its default in your PHP configuration.\n- Check your installed version with `php --version`; the sources say `8.5.12` is affected.","fix":"- Move PHP to the next regular release once published; the sources do not name a fixed version.\n- Keep Cloudflare WAF protection enabled while waiting for the fix, if you use Cloudflare.\n- Limiting upload sizes and restricting unnecessary uploads may reduce exposure, per Cloudflare, but the sources say this does not replace the PHP fix.","status":"open","published_at":"2026-10-21T13:56:45+00:00","first_seen_at":"2026-10-24T17:18:15+00:00","triaged_at":"2026-10-25T05:02:27+00:00","updated_at":"2026-10-25T06:53:49+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:02:27Z","model":"claude-haiku-5-5","output":{"fix":"- Move PHP to the next regular release once published; the sources do not name a fixed version.\n- Keep Cloudflare WAF protection enabled while waiting for the fix, if you use Cloudflare.\n- Limiting upload sizes and restricting unnecessary uploads may reduce exposure, per Cloudflare, but the sources say this does not replace the PHP fix.","reach":"unknown","title":"PHP: session upload progress flaw affects fully patched releases","impact":"medium","summary":"PHP's session upload progress feature has a flaw, which the PHP project disclosed on October 23 in an informational advisory. The sources do not say what an attacker gets from it.","category":"runtime","nicknames":[],"who_cares":["php","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker outcome not stated in the sources","analyst_note":"Find the PHP project's informational advisory for CVE-2026-115560 (linked from https://blog.cloudflare.com/php-vulnerabilities-waf-protection/) to confirm impact, the fixed version and the one-line mitigation setting.","how_to_check":"- Check whether the session upload progress feature is enabled and whether `session.upload_progress.name` has been changed from its default in your PHP configuration.\n- Check your installed version with `php --version`; the sources say `8.5.12` is affected.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources say fully patched PHP releases, including 8.5.12, are affected, so any PHP server with this upload progress feature is in scope. Cloudflare's WAF rule does not cover sites that changed `session.upload_progress.name`. If a hosting provider manages PHP, ask it to apply the fix.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001782,"input_tokens":6872,"output_tokens":2189,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-109618':167C,196C '-109619':170C,200C '-115560':11A,14A,98C '-2026':10A,13A,97C,166C,169C,195C,199C '02':294C '2026':67C,278C '21':66C,181C,292C '23':43B,84C '3':293C '5.4':213C '6':171C '70':550C '8.5.12':113C '9':283C 'across':599C 'activ':494C 'add':398C 'addit':480C 'advisori':47B,91C 'affect':107C,207C,556C,593C 'ahead':285C,512C 'alloc':621C 'allow':219C,563C 'almost':549C 'alon':380C 'alway':383C 'among':263C 'analyst':490C 'applic':235C,271C,598C 'attack':55B,164C,221C,333C,341C,345C,493C,564C 'attempt':133C 'automat':527C 'avail':524C 'base':376C 'block':444C 'blog':8A,64C 'bypass':350C 'calif.io':182C 'capabl':426C,467C 'caus':223C 'chang':148C 'changelog':520C 'clean':655C 'cloudflar':1A,7A,22B,57C,63C,68C,125C,241C,265C,297C,311C,424C 'code':162C,228C,568C 'combin':428C 'context':399C 'continu':491C 'coordin':247C 'copi':537C 'could':591C 'cover':152C 'craft':238C 'cross':361C 'cross-referenc':360C 'custom':127C,145C,298C,319C,337C,468C,573C 'cve':9A,12A,96C,165C,168C,194C,198C 'dan':76C 'daniel':74C 'data':231C,379C,574C,626C 'date':329C 'day':511C 'default':140C,308C 'defens':484C 'defense-in-depth':483C 'deliv':414C 'denial':224C 'deploy':2A,58C,69C,250C,269C,281C,313C,526C,533C 'depth':486C 'detect':421C,461C 'develop':267C,418C 'disclos':40B,187C 'disclosur':21B,288C 'disrupt':576C 'distinguish':388C 'earli':276C 'effort':248C 'emerg':506C 'enough':385C 'even':474C 'evid':386C 'exampl':645C 'execut':163C,229C,566C 'exist':158C 'exploit':132C,390C,404C 'expos':572C 'exposur':232C 'fail':653C 'fals':411C 'featur':32B,105C 'field':143C 'finish':639C 'firewal':272C 'first':459C 'fix':117C 'flaw':35B,590C 'follow':179C 'foundat':259C 'free':301C,535C 'full':419C 'fulli':108C 'get':56B 'goe':612C 'handl':608C 'help':400C 'host':26B 'hour':284C,509C 'http':239C,438C,617C 'identifi':401C 'includ':112C,534C 'inform':46B,90C,177C 'internet':255C,601C 'involv':605C 'jone':77C 'know':541C 'known':131C,202C 'kuber':79C 'lab':20B 'lab-disclosur':19B 'larg':595C 'later':215C 'layer':481C 'leak':324C 'legitim':392C 'link':538C 'logic':366C 'magento':588C 'malici':567C 'manag':460C 'match':358C,446C 'may':218C 'memori':609C,622C,651C,658C 'mitig':251C,315C,487C 'molteni':75C 'monitor':492C 'multipl':314C 'mutat':343C 'name':144C 'nandwani':80C 'need':628C 'new':423C,502C,516C 'next':121C 'normal':619C 'number':596C 'observ':332C,339C 'octob':42B,65C,83C,180C,277C,291C 'offici':327C 'openai':184C,260C 'origin':395C,447C 'other':264C 'paid':303C 'part':244C 'patch':109C,470C 'payload':346C 'php':23B,27B,38B,86C,100C,110C,119C,138C,160C,191C,212C,258C,472C,545C,558C,579C,607C,620C,652C 'php2shell':5A,61C,72C,204C,310C,369C,455C,554C 'plan':530C 'platform':583C 'poc':17B 'poc-publ':16B 'posit':412C 'potenti':592C 'process':236C,615C,630C,641C 'progress':31B,104C,142C 'project':39B,87C 'protect':3A,59C,70C,129C,172C,253C,274C,306C,352C,367C,416C,456C,477C,522C 'provid':384C,478C 'public':18B,287C 'publish':88C 'quarkslab':186C 'reach':451C 'reduc':407C 'referenc':362C 'regular':122C 'relat':94C 'releas':111C,123C,328C,464C,634C 'remot':161C,227C 'repo':473C 'request':375C,378C,432C,453C,618C,632C 'request-bas':374C 'requir':370C 'respons':397C,434C,440C,448C 'risk':409C 'rule':156C,159C,365C,377C,441C,498C,517C 'run':211C,648C 'runtim':15B,559C 'safel':659C 'say':52B 'secur':489C 'self':25B 'self-host':24B 'server':210C,571C 'servic':226C,577C 'session':29B,102C 'session.upload_progress.name':149C 'signal':429C 'sinc':275C 'site':136C 'someth':611C 'sourc':49B 'special':237C 'standard':373C 'start':289C 'stop':642C 'store':624C 'succeed':405C 'success':312C 'target':335C 'techniqu':503C 'track':192C,354C,515C 'traffic':240C,334C,393C 'transact':420C,439C 'tri':348C 'two':188C,603C 'underpin':580C 'unexpect':643C 'updat':81C,496C 'upload':30B,103C,141C 'use':137C,299C,465C,547C,582C 'user':536C 'utc':296C 'variat':505C 'volum':356C 'vulner':6A,62C,73C,95C,175C,189C,206C,322C,544C,555C,570C,604C 'waf':126C,155C,273C,304C,425C,476C,532C 'web':209C,270C 'websit':552C 'whether':402C 'wide':581C 'within':435C 'wiz':183C,262C 'wordpress':586C 'work':256C,638C 'wrong':613C","nicknames":[],"mitigations":[{"kind":"waf-rule","since":null,"covers":"Known exploit attempts against CVE-2026-115560 for sites using PHP's default session.upload_progress.name field, via the existing PHP Remote Code Execution Attack rule #6","limits":"Customers who changed session.upload_progress.name are not covered by the WAF rule","source":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:03Z","confidence":0.8,"source_title":"Cloudflare: Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog","customer_action":"patch PHP once the fix ships in the next regular release; keep WAF protection enabled and do not rely on the rule alone"}],"who_affected":"The sources say fully patched PHP releases, including 8.5.12, are affected, so any PHP server with this upload progress feature is in scope. Cloudflare's WAF rule does not cover sites that changed `session.upload_progress.name`. If a hosting provider manages PHP, ask it to apply the fix.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:56:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":1,"sources":[{"source":"lab","external_id":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/#CVE-2026-115560","url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","severity":null,"published_at":"2026-10-21T13:56:45+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog"},{"source":"github-poc","external_id":"al4n4n/CVE-2026-115560","url":"https://github.com/al4n4n/CVE-2026-115560","severity":null,"published_at":"2026-10-25T06:46:12+00:00","modified_at":null,"first_seen_at":"2026-10-25T06:53:49+00:00","fetched_at":"2026-10-25T06:53:49+00:00","note":null}],"documents":[{"id":95,"url":"https://x.com/TheHackersNews/status/2113603328945091038","title":"@TheHackersNews: Why isn't PHP issuing another emergency patch?\n\nThe project considers CVE-2026-1","kind":"post","source":"x","text":"Why isn't PHP issuing another emergency patch?\n\nThe project considers CVE-2026-115560 unlikely to affect real-world configurations.\n\n• No severity score announced\n• No affected version list yet\n• Fix planned for a routine release\n\nhttps://t.co/emO9cOJ5Uk\n\nlikes 55 reposts 10","published_at":"2026-10-23T12:07:57+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":96,"url":"https://x.com/TheHackersNews/status/2113603143561093367","title":"@TheHackersNews: PHP has a one-line mitigation for CVE-2026-115560:\n\nsession.upload_progress.enab","kind":"post","source":"x","text":"PHP has a one-line mitigation for CVE-2026-115560:\n\nsession.upload_progress.enabled=0\n\nThis disables session upload progress until the fix arrives in a routine release.\n\nAlready applied this mitigation for CVE-2026-109619? No further action is needed.\n\nlikes 63 reposts 13","published_at":"2026-10-23T12:07:12+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":98,"url":"https://x.com/TheHackersNews/status/2113602912530444768","title":"@TheHackersNews: The new PHP flaw is separate from the two critical #PHP2Shell bugs patched on Oc","kind":"post","source":"x","text":"The new PHP flaw is separate from the two critical #PHP2Shell bugs patched on October 21.\n\nCVE-2026-115560 is NOT fixed by those emergency updates.\n\nPHP says exploitation requires an unusual session configuration and considers the risk unlikely in practice.\n\nNo attacks reported.\n\nlikes 98 reposts 20","published_at":"2026-10-23T12:06:17+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":2847,"url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/","title":"Cloudflare: Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog","kind":"advisory","source":"lab","text":"Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog\n\nOctober 21, 2026\n\n# Cloudflare deploys protections against php2shell vulnerability\n\nDaniele Molteni\n\nDan Jones\n\n and \n\nKuber Nandwani\n\nUpdate - On October 23, the PHP project published an informational advisory for a related vulnerability, CVE-2026-115560, in PHP's session upload progress feature. It affects fully patched PHP releases, including 8.5.12, and will be fixed in PHP's next regular release.\n\nAll Cloudflare WAF customers are protected against known exploit attempts if their site uses PHP's default upload progress field name. Customers who have changed `session.upload_progress.name` are not covered by the WAF rule.\n\nThe existing rules \"PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6\" protects against this vulnerability.\n\nMore information to follow.\n\nOctober 21, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic.\n\nCloudflare has been part of a coordinated effort to deploy mitigations to protect the Internet, working with PHP foundation, OpenAI and Wiz among others. Cloudflare has developed and deployed web application firewall (WAF) protections since early October 2026, which were deployed about 9 hours ahead of public disclosure. Starting on October 21 3:02 am UTC, Cloudflare customers using our free or paid WAF were protected by default against php2shell.\n\nCloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers. We observed how attackers were mutating the attack payload to try to bypass our protections by tracking the volume of matches and cross-referencing with the rule logic.\n\nProtecting against php2shell required more than standard request-based rules. Request data alone does not always provide enough evidence to distinguish an exploit from legitimate traffic. The origin’s response adds context, helping identify whether an exploit succeeded while reducing the risk of false positives.\n\nTo deliver this protection, we developed full transaction detection, a new Cloudflare WAF capability that combines signals from the request and response within the same HTTP transaction. Response rules can then block a matching origin response before it reaches the requester. The php2shell protections are the first managed detections we have released using this capability.\n\nCustomers should patch their PHP repos even with WAF protections providing an additional layer of defense-in-depth mitigation. Our security analysts continue monitoring attack activity and update the rules when and if new techniques and variations emerge in the hours and days ahead. You can track new rules in the changelog.\n\nThe protections are available and deployed automatically on all plans with WAF deployed, including Free users.\n\n## Copy link What we know about the vulnerabilities\n\nPHP is used by almost 70% of websites. The php2shell vulnerabilities affect the PHP runtime itself and can allow attackers to execute malicious code on vulnerable servers, expose customer data, or disrupt services. Because PHP underpins widely used platforms such as WordPress and Magento, these flaws could potentially affect a large number of applications across the Internet.\n\nThe two vulnerabilities involve how PHP handles memory when something goes wrong while processing a HTTP request. Normally, PHP allocates memory to store the data it needs to process a request, then releases it when that work finishes. If processing stops unexpectedly, for example because it runs out of memory, PHP fails to clean up the memory safely. These vulnerabilities arise when PHP handles an error and then tries to use data that was not fully set up or memory that has already been released.\n\nAn attacker can send specially crafted HTTP requests to trigger these conditions. Large requests are one way to put memory under pressure, but the problem goes beyond consuming server resources. By manipulating the data PHP encounters in this invalid memory, an attacker may be able to crash a PHP process, expose sensitive information, or execute code provided by the attacker.\n\nThe two vulnerabilities differ in when the unsafe memory access happens:\n\nVulnerability\n\nWhat goes wrong\n\nCVE-2026-109618\n\nPHP runs out of memory and interrupts its work before some internal data has been properly initialized. During cleanup of that request, PHP may use this unfinished data as though it were valid.\n\nCVE-2026-109619\n\nA fatal error interrupts a request, leaving PHP holding references to memory that is released when the request ends. When the same PHP process handles a later request, it may follow those outdated references and access memory that is no longer valid and expose sensitive data.\n\nThese flaws are in the PHP runtime, so updating website code or a plugin(s) alone does not fix these vulnerabilities. Administrators need to update the PHP software running their applications. If a hosting provider manages PHP, ask the provider to apply the security update.\n\nAdministrators can follow the PHP advisory for affected versions and remediation instructions. Keep Cloudflare WAF protections enabled while patching. Restricting unnecessary uploads and limiting upload sizes can also reduce exposure, but these measures do not replace the PHP fix.\n\n## Copy link New rules\n\nFor Free customers, new rules have been released under the Cloudflare Managed Free Ruleset (Ruleset ID 77454fe2d30c4220b5701f6fdfb893ba). Free customers don’t have to take any actions to enable the protection. To override the ruleset behavior, you can refer to our documentation.\n\n| Rule Description | Rule ID |\n| --- | --- |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) | 4e315666e8e344cdb64119a3b5ccf32f |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | 00c10e6cc4da4bd08722adeebcd95984 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | 48ddf592361e4fdb97a8a85982dab691 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 | 3556683d512a47f2937899c524b1a4c6 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 | da07c85852e34625bb478496302ede46 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 | 19373a83abb840e18ab3ce5a7975ce1b |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 | 07f0b6ddaabf40b1b2042dade8d613fa |\n\nProtection for paid plans has been released as part of the Cloudflare Managed Ruleset (Ruleset ID efb7b8c949ac4650a09736fc376e9aee). If you are on a Professional, Business, or Enterprise plan, review your Managed Ruleset deployment to confirm it has deployed block mode.\n\n| Rule Description | Rule ID |\n| --- | --- |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) | c1d409ad838f47f59446f21cc438d5dd |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | f9a45927414245e3a64bb12d0a0c2f64 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | 771c654ae1154d4daa72f4e1545d163c |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 | 217005865f0145f392300bac212afcc9 |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 | 38efdb17ea594501bb55a1d71867b12e |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 | 4148ae686fdb4d01be673fab9d9c073d |\n| PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 | 1389aa259617437392ce149c48143645 |\n\nTo better identify exploit attempts, Cloudflare developed full transaction detection, a new WAF capability that analyzes both sides of the same HTTP transaction. While some malicious payloads can be identified using the request alone, the response contains useful signals that can be used to create rules with higher confidence, reducing false positives. A matching full transaction rule can block the origin response before it reaches the requester. Learn how it works in our full transaction detection blog post.\n\nThe new Cloudflare Managed Response Firewall Default has been automatically deployed for customers on all plans, including Free. To verify that the response rules are active, you can visit the Security > Security Rules page. Read the full transaction blog to learn how to customize its deployment.\n\nThe new Cloudflare Managed Response Firewall Default detection is protecting your traffic.\n\n## Copy link Review events and customize protection\n\nTo analyze blocked requests, visit Security > Security Analytics > Events. Filter by the rule IDs in the table above and inspect the matched request, action, and path. Events identify whether the action came from a managed or custom rule. Customers who need to tailor the protection can update the scope of the Managed Ruleset to the parts of an application where it is relevant.\n\n## Copy link Update PHP and keep the protection enabled\n\nCloudflare customers using our Managed Ruleset are protected by default. We recommend following the advisory recommendation and applying the vendor update to your PHP repos as soon as possible while keeping the WAF protection enabled as an additional protection. Our WAF analysts will continue to update protections as new techniques emerge.","published_at":"2026-10-21T13:56:45+00:00","relation":"advisory","confidence":null,"note":null},{"id":3430,"url":"https://github.com/al4n4n/CVE-2026-115560","title":"al4n4n/CVE-2026-115560","kind":"poc","source":"github","text":"CVE-2026-115560: PHP session upload-progress serialize_handler mismatch → pre-auth object injection → RCE. Check/exploit/verify scripts + Docker lab + Suricata/Sigma detection rules.\n\nstars 0","published_at":"2026-10-25T06:46:12+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}