Is your Cloudflare WAF
covering you against php2shell.

Two critical flaws in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) are being exploited since 21 October 2026. Cloudflare deployed blocking rules on every plan nine hours before the disclosure. Whether they reach your traffic depends on your configuration: a managed ruleset that is not deployed, an override that logs instead of blocks, an exception, a hostname that bypasses Cloudflare. This check reads that configuration and tells you, zone by zone.

What the check reads

• Zone Read — the list of zones in the account you choose, with their plan and status.
• Zone WAF Read — the WAF configuration of each zone: which managed ruleset is deployed, its scope, overrides and exceptions, and the state of Cloudflare's seven php2shell rules.
• User Details Read — your name and email, to address the report to you.
• DNS Read optional — which hostnames are proxied: a DNS-only record is not behind the WAF at all.
• Account WAF Read optional — managed rules deployed at the account level (Enterprise).
• Analytics Read optional — how many requests the php2shell rules blocked on each zone in the last days.

You can switch the optional permissions off on Cloudflare's consent screen; the report then says what was not checked.

What you get

One verdict per zone — Protected, Protected with conditions or Not protected — with the evidence behind it (ruleset, version, the rules' actions, exceptions, hostnames) and a link to the exact page of your Cloudflare dashboard for each finding. A copy by email if you ask for one.

What it does not do

• It makes no change to your account: every permission is read-only.
• It keeps no token. The report is kept for seven days at its private address so you can come back to it; with your consent, your contact details and the findings are kept for InCloud to follow up.
• It is not a fix. The rules are a mitigation while you patch: the fix is in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 (older branches only through your distribution), and every PHP worker must be restarted afterwards. Read Cloudflare's post for the background.

Built by InCloud ITES, a Cloudflare Authorised Service Delivery Partner. If your organisation blocks third-party OAuth apps, talk to us and we will run the check with you.