Cloudflare says it switched on default protection against two new PHP flaws for all customers about nine hours before the public heard about them.
Cloudflare says it turned on default protection for every customer against two newly found PHP security flaws, roughly nine hours before researchers made them public. The protection covers free and paid plans alike. It helps, but it is not the same as fixing the problem on your own site.
Researchers from Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is a widely used programming language that runs many websites and web portals. Cloudflare, a company that sits in front of websites to filter traffic, says it added default rules to its web application firewall, or WAF. A WAF is a filter that blocks suspicious requests before they reach a site.
Anyone who runs a website or portal built on PHP, which includes WordPress sites. Sites that use Cloudflare get some cover without changing any settings. Sites that do not use Cloudflare get none of this.
The material available does not say how the flaws work, how serious they are, or whether anyone has used them in attacks. It also does not say when official PHP fixes arrive or which versions are affected. Those details are worth watching for in the coming days.
The alert box above lists the steps. The main point is simple: Cloudflare's filter is a stopgap. The lasting fix is the official PHP update, so ask your host or developer to install it when it is available.
Cloudflare's filter buys time for PHP sites, but the official PHP update is still the real fix, so ask your host or developer about it.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA writer gave Claude control of his rooted LG TV and fixed slow startup, uneven app volume and a dull screensaver. The privacy gains are less certain.
Read more: A writer used Claude to fix his LG TV's slow startup and loud appsTuring Award winner Richard Sutton says more computing power alone will not make AI truly smart. Big AI companies disagree, which matters for anyone betting on AI.
Read more: AI pioneer says piling on computing power won't make machines smart
