Если у вас есть деньги на хорошего специалиста по безопасности, то скорее всего вы уже работаете со мной … закройте эту статью или see how you can add a real AI mascot to your website. If you don't have the budget, read on.
In short, critical vulnerabilities have been discovered in PHP. They received a score of 9.2 out of 10 on the CVSS 4.0 scale, which corresponds to a critical severity rating. Under certain conditions, they may allow attackers to execute commands on the server without prior authorization. About the threat reportedReuters on October 21. According to the news agency, the issue affected infrastructure in several European countries, and some organizations chose to temporarily take their websites offline to reduce the risk of potential cyberattacks.
The issue has been dubbed PHP2Shell and is associated with the CVE-2026-109618 and CVE-2026-109619 vulnerabilities, which may allow attackers to execute code on the server without authorization. Cloudflare, for its part, has deployed additional security rules. However, not all website owners can update their server software immediately.
In this situation, it is important not to rely on a single setting, but to systematically strengthen security at the PHP, hosting, and Cloudflare levels.
1. First, update PHP
The most reliable way to resolve the issue is to install a patched version of PHP. According to the developers' official announcement, fixes have been released for the following branches:
- PHP 8.5.12;
- PHP 8.4.27;
- PHP 8.3.36;
- PHP 8.2.35.
If an earlier release from one of these branches is in use, it must be updated to the patched version or a newer release containing the necessary fixes.
You can check the latest recommendations on the official PHP website.
If your hosting provider does not offer the listed versions, you should not simply switch to an even older version of PHP. For PHP 8.1 and earlier branches, ask your provider whether patched builds with backported security fixes are available. If no such builds are available, you should plan to migrate to a supported version.
Important: updating WordPress, its theme, and plugins does not by itself address PHP vulnerabilities. The fix must be installed in the server environment itself.
2. If updating PHP is not currently possible
Not all website owners can change server settings themselves. On standard shared hosting, the PHP version and its runtime settings may be controlled by the hosting provider.
In this case, contact the support team as soon as possible and ask:
- which PHP version is being used for the website;
- whether the patches for CVE-2026-109618 and CVE-2026-109619 have been applied;
- whether a patched build is available under the current plan;
- what temporary security measures can be implemented until the update.
If the provider cannot supply a patched version, ask them to suggest a secure migration option. Do not change critical PHP settings yourself without understanding how they may affect the website.
For server administrators, the PHP developers have also described temporary measures that reduce the risk of certain exploitation scenarios. These include limiting the size of HTTP requests and uploads, disabling the mechanism session.upload_progress and applying some additional error-handling settings.
These settings should be handled with care. For example, changing memory_limit or upload limits may affect how the website functions. They should be applied in accordance with the official PHP recommendations and server configuration.
None of the measures listed provides a complete fix for the vulnerabilities. Full recommendations are available at php.net.
3. Check Cloudflare protection
Cloudflare reported that it had deployed special Web Application Firewall (WAF) rules to protect against PHP2Shell. According to the company, the protection was made available to customers with WAF enabled, including those on the free plan, before the vulnerabilities were publicly disclosed.
This means that website owners using Cloudflare should first check their current settings rather than create arbitrary rules themselves.
The following actions are recommended:
Step 1. Make sure the website is proxied through Cloudflare.
In the DNS section, check the domain and subdomain records www. For DNS records that should be routed through Cloudflare, proxying must be enabled, as indicated by the orange cloud.
This helps route the relevant HTTP and HTTPS traffic through Cloudflare's security infrastructure. However, you must separately ensure that direct access to the server cannot bypass this protection.
Step 2. Review the WAF rules.
Open the Cloudflare dashboard, select the domain, and go to Security, then Security rules or Managed rules.
Make sure the available Cloudflare managed ruleset is enabled. For the Free plan, the company has announced the addition of rules to the Cloudflare Managed Free Ruleset.
Do not disable active security rules or change their actions unless necessary. If custom rules are available for your site, make sure they are enabled.
Step 3. Monitor security events.
In Security Events or Security Analytics, review blocked requests, WAF triggers, and unusual activity.
However, not every blocked request should be considered evidence of a successful attack. Logs help identify suspicious requests, but do not by themselves confirm that the server has been compromised.
You can read more about security measures in Cloudflare's official statement on PHP2Shell.
4. Prevent Cloudflare from being bypassed
Even if a website uses Cloudflare, the server may still be directly accessible via its IP address. In this case, requests can bypass the WAF and other rules configured in Cloudflare.
If your hosting provider allows you to manage server access, restrict incoming HTTP and HTTPS connections so that only authorized sources, including Cloudflare's current IP address ranges, can access the web server.
Before changing the rules, check the server configuration and any other services in use. A mistake could make the website unavailable or disrupt email and other services.
On shared hosting, this type of configuration usually needs to be arranged with the provider.
5. Check SSL/TLS
In the Cloudflare dashboard, open the SSL/TLS section and check the encryption mode used for connections between the visitor, Cloudflare, and the origin server.
If the server has a valid certificate that supports authentication, it is recommended to use Full (strict).
This mode protects the connection between Cloudflare and the server from a range of risks associated with incorrect encryption configuration and certificate validation. However, it does not fix PHP vulnerabilities or replace software updates.
Do not switch modes at random: first make sure that the certificate on the server is configured correctly.
6. Check file uploads and automated requests
Vulnerabilities can be exploited through specially crafted HTTP requests. It therefore makes sense to check what types of data and files the site accepts from visitors.
If file uploads are not required, they can be disabled. If they are required, you should restrict the permitted file types and upload sizes, as well as check the server-side request size limits.
Restrictions must be applied with the site's functionality in mind. Overly strict rules can interfere with posting comments, using forms, uploading images, and exchanging data with mobile apps.
You should not block all POST requests or completely prohibit file uploads without first assessing the impact. This is not a universal solution to the problem.
7. Check for hacking attempts
Installing the patch closes known vulnerabilities, but it does not guarantee that the server was not compromised earlier.
After updating PHP, administrators should check the web server and PHP logs, unusual file changes, new user accounts, suspicious processes, and unexpected outbound connections.
If signs of compromise are detected, conduct an additional investigation, remediate the impact, and change any passwords and access keys that may have been affected.
If a breach is suspected, do not limit your response to deleting individual suspicious files. It is important to determine how the attacker may have gained access and whether they retained the ability to return.
8. What Website Owners Should Do Right Now
Use the following checklist to ensure you do not miss any essential steps:
- Check the PHP version on the server.
- Install the patch or obtain confirmation from the hosting provider that it has already been installed.
- If the patch is unavailable, coordinate temporary protective measures and an update plan.
- Make sure Cloudflare is proxying the website's web traffic.
- Verify that the managed WAF rules are enabled.
- Check SSL/TLS and whether Cloudflare can be bypassed by accessing the server directly.
- Review file upload and request size limits.
- Check the logs for suspicious activity.
Home
PHP2Shell vulnerabilities require prompt action, but there is no need to panic and immediately take every PHP website offline. Assess the condition of the specific server and apply the available security measures.
Cloudflare can reduce the risk of vulnerability exploitation through its WAF, but it is not a substitute for patching PHP itself. If your hosting provider does not yet offer a patched version, contact them, ask whether patches can be applied, and use the temporary mitigations recommended by the developers.
Priority number one: patched PHP. Priority number two: active Cloudflare rules and restricting unnecessary access to the server. Combining these measures can significantly reduce the risk while the site owner and hosting provider work to resolve the issue.
Comments0
Leave a comment
Enter your email—we'll send you a one-time code. No password or registration required.
Your email is only used for the login code and notifications about replies (you can unsubscribe using the link in the email). It is not published or shared with third parties. After you log in, a cookie is stored for 30 days. You can download or delete your data in your account.
Enter the code
Code sent to . If the email doesn't arrive within a few minutes, check your Spam and Promotions folders.
Your name and comment will be displayed publicly. Your email address will not be published.
I want a comment system like this for my website