CISA confirms active exploitation of critical PHP flaws; Cloudflare opens php2shell CTF

CISA confirms in-the-wild attacks

The US Cybersecurity and Infrastructure Security Agency has confirmed that attackers are actively exploiting two critical vulnerabilities in PHP and has ordered civilian federal agencies to patch their systems within three days, TechCrunch reported on October 27. The directive arrived less than a week after the PHP project released fixes for the flaws, which are tracked as CVE-2026-109618 and CVE-2026-109619 and are collectively known as php2shell. CISA did not identify who is behind the exploitation, according to TechCrunch, though the warning followed independent researcher reports of attacks in the wild.

The vulnerabilities allow an attacker to break into a vulnerable system remotely over the internet without needing passwords. PHP reportedly runs on roughly 70 percent of web-facing servers, and TechCrunch notes that the severity of the bugs led some governments and large companies to take their sites offline in order to patch them. Security researchers had said that building a working exploit was initially difficult, though not impossible, which makes the confirmed exploitation a significant escalation.

Dormant flaws revived with AI

The php2shell bugs are not new discoveries. According to TechCrunch, they were first reported about two years ago, but the nonprofit foundation that maintains PHP concluded there was no practical way to abuse them, so they were left unpatched. Earlier this year, researchers at the security firm Calif reportedly found a way to weaponize the two dormant vulnerabilities with the help of an AI model.

That detail is what makes this incident unusual. TechCrunch frames the bugs as an example of a larger problem: countless vulnerabilities that were never fixed or were deprioritized now carry real risk because AI models are getting better at finding exploitable paths, including by chaining multiple weaknesses together. Cloudflare makes a similar point in its own write-up, noting that the spread of AI lets attackers uncover new attack vectors far faster than was previously possible.

Cloudflare's mitigations and a public challenge

Cloudflare says it responded to php2shell by shipping client updates and multiple mitigations, adding web application firewall rules to block exploitation attempts, and introducing a feature called full transaction detection, with all of it available on every plan including the free tier. The company situates the event in an unusually rough week for internet security that also included the compromise of eight eMudhra intermediate certificates.

To pressure-test its defenses, Cloudflare has now launched a capture-the-flag challenge through its HackerOne bug bounty program. The target is a deliberately vulnerable stack: stock PHP 8.5.11 with standard extensions, Apache 2 via mod_php, and an empty index.php running inside a Cloudflare Container, all placed behind the default WAF rules for these vulnerabilities. A flag file sits inside the sandbox, which resets every few minutes.

To claim a bounty, a participant must demonstrate attacker-controlled code or command execution via an authorized POST request, use that remote code execution to recover the current flag, verify it through the challenge interface, and file a private report with a full reproduction chain. Cloudflare says awards require a materially distinct bypass method or exploit payload, and that cosmetic variations or partial chains do not qualify. The company also cautions that WAF blocking is not a replacement for patching, since it cannot undo actions an attacker has already performed on the origin server.

Why it matters

php2shell is a case study in how the economics of exploitation are changing. A flaw dismissed as unexploitable two years ago became a critical, actively exploited vulnerability once AI assistance entered the picture, which means old triage decisions across the software ecosystem can no longer be treated as settled. It also spotlights the fragile funding model behind infrastructure like PHP, which TechCrunch notes has long been under-resourced despite powering most of the web. For operators, the practical takeaway is blunt: apply the PHP updates now, and treat WAF rules and other virtual patches as temporary cover rather than a fix.