Two flaws in PHP, the software behind most websites, can let attackers take over servers. Cloudflare blocks attacks, but only a PHP update fixes the problem.
Two serious flaws in PHP, the software that runs a huge share of the web, were made public on October 21. Together they are called php2shell. Cloudflare, a company that sits in front of many websites, began blocking attacks aimed at them hours before the announcement. That help is real, but it is a backup. The actual fix is updating PHP.
Researchers from Calif.io, Wiz, OpenAI and Quarkslab disclosed the flaws, tracked as CVE-2026-109618 and CVE-2026-109619. They affect every server running PHP 5.4 or later. An attacker can send specially crafted web requests that may crash a server, expose private data, or run the attacker's own code.
Both flaws come from how PHP handles memory when something goes wrong. If a request fails partway, for example because PHP runs out of memory, PHP can later use data that was not set up properly or memory it already released. Attackers can take advantage of that mistake.
PHP runs almost 70% of websites, including WordPress and Magento stores. The flaws are in PHP itself, not in a single plugin or theme. So updating your site code or plugins does not fix them. Cloudflare also said the flaws leaked before the official release date, and it saw attack traffic aimed at its customers.
Cloudflare added firewall rules, which are filters that block suspicious web traffic. Protection was switched on by default from 3:02 am UTC on October 21 for customers on all plans, including Free. It had been deployed about 9 hours before public disclosure.
The rules also look at what the website sends back, not just what arrives. That helps spot a successful attack and cuts false alarms. Cloudflare said attackers tried changing their requests to slip past the rules, and its analysts are still watching and updating them.
Sites behind Cloudflare's firewall have a safety net, and Free users need to do nothing to get it. Paid plan users should check that their setup is in block mode. Even so, Cloudflare tells customers to patch PHP. Sites that do not use PHP are not part of this story.
The alert box above lists the steps. The key one is asking your web host or developer to apply the latest PHP security update. Limiting uploads can help in the meantime, but it does not replace the fix.
Cloudflare says it will update its rules if attackers find new tricks in the coming hours and days. Changes will appear in its public changelog. Site owners should follow the PHP advisory for affected versions and fix instructions.
Cloudflare's firewall buys time, but only updating PHP itself closes the php2shell flaws, so ask your host or developer today.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
