Cloudflare Launches PHP Capture‑the‑Flag Challenge to Test WAF Against New PHP RCE Vulnerabilities (CVE‑2026‑109618, CVE‑2026‑109619)
What Happened — Cloudflare announced a limited‑time Capture‑the‑Flag (CTF) exercise that places a deliberately vulnerable PHP 8.5.11 installation behind its default Web Application Firewall (WAF) rules. The challenge focuses on two publicly disclosed PHP remote‑code‑execution flaws (CVE‑2026‑109618 and CVE‑2026‑109619) that were exploited in the recent “php2shell” attacks. Participants must bypass the WAF, achieve code execution inside the sandboxed container, and retrieve a protected /flag file. The sandbox is reset every few minutes, and successful exploits are reported through Cloudflare’s HackerOne bug‑bounty program. Cloudflare also rolled out new WAF signatures and a “full‑transaction detection” feature to block these exploits for all customers, including those on free plans.
Why It Matters for Trust & Control Assurance — The CTF demonstrates how continuous, real‑world testing of WAF rules validates the effectiveness of a core control objective: maintain secure configuration and monitoring of web‑application defenses.
Who Is Affected — SaaS platforms, e‑commerce sites, and any organization that publishes PHP‑based web applications behind a CDN/WAF.
Recommended Actions
- Verify that your WAF includes signatures for CVE‑2026‑109618 and CVE‑2026‑109619.
- Map the WAF rule set to the control objective of “secure configuration and continuous monitoring” and collect evidence of rule updates.
- Conduct periodic penetration‑testing or CTF‑style exercises to prove that exploit attempts are detected and blocked.
Technical Notes —
- Attack vector: Remote‑code‑execution via PHP runtime (stock PHP 8.5.11, Apache 2, mod_php).
- Vulnerabilities: CVE‑2026‑109618, CVE‑2026‑109619 (both RCE).
- Mitigations: Cloudflare WAF rule updates, full‑transaction detection feature.
Source: Cloudflare Security Blog