Security1 hOctober 21, 2026, 21:20

Cloudflare deploys default WAF rules for two PHP flaws nine hours before disclosure

Cloudflare enabled default WAF mitigations for all free and paid tier customers against two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as php2shell. The protections went live roughly nine hours before the flaws were publicly disclosed by Calif.io, Wiz, OpenAI and Quarkslab.

Techmeme

Open source

Cloudflare deploys default WAF rules for two PHP flaws nine hours before disclosure

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619
Mitigations apply by default to free and paid tiers
WAF rules went live about nine hours before disclosure
The flaws were disclosed by Calif.io, Wiz, OpenAI and Quarkslab

#Cloudflare#PHP#Wiz#OpenAI

WordPress CVE-2026-87902 Exploited Within Hours of Disclosure

Software

JDK 27 ships nine JEPs, compact object headers on by default and PQC in TLS 1.3

Security

Rig Security exits stealth with $12M to secure agentic AI identities

Security

Cloudflare deploys default WAF rules for two PHP flaws nine hours before disclosure

WordPress CVE-2026-87902 Exploited Within Hours of Disclosure

JDK 27 ships nine JEPs, compact object headers on by default and PQC in TLS 1.3

Rig Security exits stealth with $12M to secure agentic AI identities

Three Artifactory flaws under active exploitation allow auth bypass and admin access