Cloudflare Launches PHP Capture the Flag Challenge on CVE-2026-109618 and CVE-2026-109619

What happened

Last week, two serious vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619, collectively known as php2shell—were disclosed, affecting a runtime that powers a significant portion of the Web. Cloudflare responded by deploying WAF rules to block exploits and introducing a new feature called full transaction detection. These protections were made available across all Cloudflare plans, including Free.

To strengthen ongoing defenses and collect real-world data about how attackers might bypass protections, Cloudflare is now running a PHP Capture the Flag challenge through its HackerOne Bug Bounty program.

How the CTF works

The challenge environment runs stock PHP 8.5.11 with standard extensions, Apache 2 via mod_php, and an empty index.php inside a Cloudflare Container. Cloudflare's default WAF protection rules for the two PHP vulnerabilities are enabled in front of this setup. Participants attempt to bypass the WAF, exploit the PHP sandbox, and recover the contents of a /flag file. The sandbox resets every few minutes, including the flag file, to prevent interference between attempts.

Participants must demonstrate attacker-controlled PHP code execution through an authorized POST request, use that remote code execution to recover and verify the flag through the CTF UI, and then submit a private report to Cloudflare on HackerOne with full technical details: the endpoint, complete payload, request sequence with headers and encoding, raw request/response captures or proof of concept, an explanation of the WAF bypass and code execution chain, and attempt metadata including timestamps.

Eligibility and awards

All participants must sign up for a HackerOne account and agree to the HackerOne terms and Cloudflare HackerOne program rules before participating. Awards require a materially distinct bypass method or exploit payload, even for the same PHP CVE. File disclosures without RCE, RCE without successful flag recovery and UI verification, local-only exploits, or rediscovery of known PHP vulnerabilities do not qualify. Cloudflare makes final duplicate and reward decisions; only the first complete, reproducible report for a given method is considered.

Testing is authorized only against the challenge hostname's WAF-protected /php/* endpoints using the POST method. Out of scope are other Cloudflare services, direct infrastructure access, the upstream PHP project, third-party systems, denial of service attacks, high-volume scanning, persistence, and social engineering. If you receive a 429 or 503 response, you must back off. Cloudflare reserves the right to suspend or terminate the challenge at any time.

Why WAF is not enough

Cloudflare emphasizes that WAF protection is an ongoing defensive measure, not a one-time fix. The widespread adoption of AI is allowing attackers to discover new exploit vectors with unprecedented speed and efficiency. Response blocking by a WAF can prevent exposed data from reaching an attacker, but it cannot undo actions that have already been performed at the origin server.

Organizations running PHP must follow the latest PHP security advisories and apply relevant updates. This challenge is designed to help the security research community identify and report gaps in WAF protections, but it is not a substitute for promptly patching vulnerable software at the source.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.