Cloudflare Responds to Critical PHP RCE Vulnerabilities: Why WAF Enforcement Matters

Key takeaways

• On October 20, 2026, the PHP security team disclosed CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution vulnerabilities each rated 9.2 CVSS v4.0.
• VirusTotal identified 5.1 million IP addresses running PHP, including 758,000 on end-of-life versions, though these figures are not confirmed vulnerable systems.
• Cloudflare added two Block rules to its Free Ruleset and four rules to its Managed Ruleset on October 21, but the rules only block attacks if the customer’s WAF is enabled and enforcing them.
• Reach Drift detected Cloudflare’s vendor-initiated rule updates and confirmed the relevant rules were enabled with their actions set to Block. Upgrading to patched PHP versions remains the recommended fix.

Two critical PHP vulnerabilities have been disclosed, potentially exposing millions of web servers to remote code execution. Cloudflare has already responded by deploying emergency WAF protections.

For Reach customers using Cloudflare WAF, Reach Drift automatically detected the new rules and confirmed they were enabled and configured to block malicious traffic.

Two Critical PHP Vulnerabilities With Widespread Potential Impact

On October 20, 2026, the PHP security team announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 CVSS v4.0.

Both vulnerabilities can allow unauthenticated remote code execution (RCE), potentially allowing attackers to compromise vulnerable web servers without credentials.

The potential exposure is substantial. According to VirusTotal’s analysis:

• 5.1 million IP addresses were identified as running PHP.
• 758,000 IP addresses disclosed end-of-life PHP versions.
• 85,000 IP addresses were running the latest PHP releases available before the emergency patches.

These figures represent PHP’s internet-facing footprint, not confirmed vulnerable systems.

PHP released security patches on October 21, scheduled for 14:00 UTC (7:00 AM PDT), and recommends upgrading affected installations immediately.

Cloudflare Deploys Emergency WAF Protections

Cloudflare moved quickly to deploy new WAF rules ahead of the PHP security release.

Its October 21 updates included:

• Cloudflare Free Ruleset: Two new rules configured to Block.
• Cloudflare Managed Ruleset: Four additional rules, two configured to Block and two to Log.

Cloudflare deployed these protections automatically, but blocking depends on each customer’s WAF configuration. If the WAF is disabled or operating in log-only mode, the new rules will not provide the intended blocking protection.

Reach Drift Confirms the New Rules Are Enabled and Configured to Block

For Reach customers using Cloudflare WAF, Reach Drift automatically detected these vendor-initiated updates as Cloudflare deployed them.

Reach captured the new rules, identified Cloudflare as the source of the changes, and confirmed that the relevant rules were enabled with their actions set to Block.

This gives security teams visibility into exactly what changed and whether the new protections are configured for enforcement, without having to manually inspect their WAF configurations.

Understanding Your Exposure and Existing Protections

Not every organization runs PHP, and not every PHP deployment is affected by these vulnerabilities.

For organizations with potentially affected systems, the next step is to determine whether vulnerable assets exist and what protections are already in place.

Reach can help with both through our new Compensating Controls module:

• Identify affected assets: Correlate vulnerability findings with your asset inventory to identify systems potentially affected by these CVEs.
• Validate security coverage: Determine whether Cloudflare WAF is protecting those assets and whether the relevant blocking rules are configured for enforcement.
• Identify protection gaps: Highlight vulnerable assets without confirmed compensating protections to help prioritize remediation.

Cloudflare’s WAF protections can help reduce exposure, but upgrading to patched PHP versions remains the recommended way to fully address the vulnerabilities.

How Reach Can Help

Reach continuously monitors changes to your security controls, whether they’re initiated by your team or deployed by a vendor. This gives you visibility into what changed and whether your protections remain configured as intended.

If your organization may be affected by these PHP vulnerabilities, we’d be happy to help assess your exposure and validate your existing protections.

To learn more, visit www.reach.security or contact the Reach Team.