Cloudflare PHP2Shell WAF rule: how to turn it on and why it is not a fix

On a Free plan the Cloudflare PHP2Shell WAF rules are already on, and on Pro, Business or Enterprise you only need to confirm the Cloudflare Managed Ruleset is deployed in block mode.

Cloudflare says its protection has been live since 21 October 2026 at 03:02 UTC for every plan with the WAF deployed. It is still a filter in front of a vulnerable runtime, so pair it with the patched PHP release listed in the PHP security updates hub.

How to check the Cloudflare PHP2Shell WAF rule is on

Free customers do not have to take any action, according to Cloudflare. Paid plans should check the deployment once, using the labels from the Cloudflare WAF documentation.

1. Sign in to the Cloudflare dashboard and select the domain (zone) that serves your PHP site.
2. Open the Security Settings page (Settings).
3. Optionally filter by Web application exploits.
4. On Pro, Business or Enterprise, confirm Cloudflare managed ruleset is turned on. If it is off, turn it on and select Save.
5. Open the Security rules page, filter by Managed rules and find the rule with an Execute action that deploys the ruleset.
6. Make sure its toggle is on and that no override sets the ruleset action to something other than block.

What is the Cloudflare PHP2Shell WAF rule?

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two PHP runtime flaws that php.net says allow unauthenticated remote code execution. Cloudflare's rules inspect HTTP traffic for exploit attempts before they reach your origin, and one response rule checks what the origin sends back.

Protection	Ruleset	Plans	What you do
7 request rules (Generic Rules – Anomalous Execution 1-7)	Cloudflare Managed Free Ruleset	Free (and every plan includes this ruleset)	Nothing; deployed automatically
7 request rules (Generic Rules – Anomalous Execution 1-7)	Cloudflare Managed Ruleset	Pro, Business, Enterprise	Confirm it is deployed in block mode
1 response rule (Default block for High confidence Signatures)	Cloudflare Managed Response Firewall Default	All plans, including Free	Nothing; deployed automatically

Cloudflare says it built the rules in early October and deployed them about 9 hours ahead of public disclosure, after seeing attack traffic and payload mutations aimed at bypassing them. The PHP2Shell security release explains the flaws themselves.

Cloudflare Managed Free Ruleset PHP2Shell rule IDs

The Free rules sit in the Cloudflare Managed Free Ruleset, ruleset ID 77454fe2d30c4220b5701f6fdfb893ba. Use these IDs to filter events or to look a rule up when you browse the ruleset.

Rule description	Rule ID (Free)
Generic Rules – Anomalous Execution – 1	4e315666e8e344cdb64119a3b5ccf32f
Generic Rules – Anomalous Execution – 2	00c10e6cc4da4bd08722adeebcd95984
Generic Rules – Anomalous Execution – 3	48ddf592361e4fdb97a8a85982dab691
Generic Rules – Anomalous Execution – 4	3556683d512a47f2937899c524b1a4c6
Generic Rules – Anomalous Execution – 5	da07c85852e34625bb478496302ede46
Generic Rules – Anomalous Execution – 6	19373a83abb840e18ab3ce5a7975ce1b
Generic Rules – Anomalous Execution – 7	07f0b6ddaabf40b1b2042dade8d613fa

Cloudflare Managed Ruleset PHP2Shell rules on Pro, Business and Enterprise

Paid plans get the same seven detections inside the Cloudflare Managed Ruleset, ruleset ID efb7b8c949ac4650a09736fc376e9aee. The rule IDs differ from the Free ones, so filter by the right set.

Rule description	Rule ID (Pro, Business, Enterprise)
Generic Rules – Anomalous Execution – 1	c1d409ad838f47f59446f21cc438d5dd
Generic Rules – Anomalous Execution – 2	f9a45927414245e3a64bb12d0a0c2f64
Generic Rules – Anomalous Execution – 3	771c654ae1154d4daa72f4e1545d163c
Generic Rules – Anomalous Execution – 4	217005865f0145f392300bac212afcc9
Generic Rules – Anomalous Execution – 5	38efdb17ea594501bb55a1d71867b12e
Generic Rules – Anomalous Execution – 6	4148ae686fdb4d01be673fab9d9c073d
Generic Rules – Anomalous Execution – 7	1389aa259617437392ce149c48143645

Cloudflare notes that the rule descriptions will be updated, so match on rule IDs rather than names.

How to turn on the Cloudflare Managed Ruleset

The Cloudflare Managed Ruleset is not available on the Free plan, which relies on the Free Managed Ruleset instead. On Pro and above, deploying it creates a rule with the Execute action for the zone.

1. In the Cloudflare dashboard, go to the Security Settings page (Settings).
2. Optionally filter by Web application exploits.
3. Turn on Cloudflare managed ruleset.
4. Review the deployment settings and edit the scope only if you want it to cover a subset of requests.
5. Select Save.
6. To confirm block mode, open Security rules, filter by Managed rules, select the rule name that contains the ruleset name, and check the action set in the ruleset configuration drop-down lists.
7. Select Save after any change.

To turn a managed ruleset off temporarily without losing its configuration, Cloudflare uses the toggle next to the deploying rule. Leave it on while your PHP servers are unpatched.

How to override a Cloudflare PHP2Shell rule that blocks real traffic

If one rule blocks legitimate requests, override that single rule instead of turning off the ruleset. Cloudflare also lets you narrow the ruleset's scope to the parts of an application where it is relevant.

1. Go to the Security rules page and filter by Managed rules.
2. Find the rule with an Execute action for the ruleset, select its name, then select Browse rules.
3. Search for the rule ID from the tables above.
4. Change its action with the drop-down list, or switch it with the Status toggle.
5. Select Next, then Save.
6. To skip rules only for specific requests, add an exception instead; Cloudflare gives exceptions priority over overrides.

Cloudflare documents that ruleset and tag overrides also apply to future rules, so use a rule override if you only want to change the existing one.

Full transaction detection and the Managed Response Firewall

Full transaction detection is a new Cloudflare WAF capability that evaluates each request alongside the origin's response in the same HTTP transaction. Cloudflare says request data alone does not always separate an exploit from legitimate traffic, while the response shows whether an attempt succeeded.

The PHP2Shell protections are the first managed detections using it. The response rule sits in the Cloudflare Managed Response Firewall Default for all plans, including Free.

Item	Detail
Rule	Default block for High confidence Signatures
Rule ID	afffe22785674c80a31875c848d2242a
What it does	Blocks a matching origin response before it reaches the requester, replacing it with a WAF block page
Limit	It cannot undo actions already performed at the origin
New fields	cf.waf.signature.response.confidence, cf.waf.signature.response.categories, cf.waf.signature.response.ref

How to see blocked PHP2Shell requests in Security Analytics

Cloudflare's PHP2Shell post points to Security > Security Analytics > Events. In the current WAF docs, Security Events for a zone opens from the Analytics page on the Events tab.

1. In the Cloudflare dashboard, open the zone and go to the Analytics page.
2. Select the Events tab.
3. Select Add filter, choose the rule ID field, the equals operator, and paste a rule ID from the tables above.
4. Pick a short time frame; narrower windows reduce sampling and show more events.
5. Expand an event to inspect the matched request, action and path.
6. Check whether the action came from a managed rule or a custom rule.

No events usually means nobody targeted your zone in that window, not that the rule is off. Confirm the deployment with the first section instead.

Why the Cloudflare WAF rule is not a PHP2Shell fix

Cloudflare itself tells customers to patch PHP even with WAF protection, calling the rules an additional layer of defense-in-depth. The flaws are in the PHP runtime, so the WAF cannot remove them.

Gap	Why it matters
Traffic that skips Cloudflare	Requests sent straight to the origin IP, or from hosts not proxied through Cloudflare, are never inspected
Attackers mutate payloads	Cloudflare reports attackers already changing payloads to bypass the rules, and keeps updating them
Body inspection limits	Managed rules inspect request bodies only up to a plan-dependent maximum size
Earlier phases and exceptions	A skip rule or exception placed before the ruleset bypasses it
Response rule limits	Blocking the response cannot undo code that already ran on the origin

Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from the PHP2Shell patch download, or update PHP on Windows, Linux or XAMPP. If an update must wait, apply the php.net PHP mitigations for CVE-2026-109618 alongside the WAF, and if a host manages PHP, ask them to apply the update.

Cloudflare PHP2Shell WAF FAQ

Does Cloudflare protect against PHP2Shell on the Free plan?

Yes. Cloudflare deployed seven PHP2Shell rules in the Cloudflare Managed Free Ruleset plus a response rule in the Managed Response Firewall Default, and Free customers do not need to take any action to enable them.

When did the Cloudflare PHP2Shell rules go live?

Cloudflare says customers using its free or paid WAF were protected by default from 21 October 2026 at 03:02 UTC, about 9 hours before the vulnerabilities were publicly disclosed.

Do I need to do anything on a Pro or Business plan?

Yes, check one thing. Cloudflare asks Pro, Business and Enterprise customers to review the Cloudflare Managed Ruleset deployment and confirm it is deployed in block mode.

What is the Cloudflare Managed Ruleset ID?

The Cloudflare Managed Ruleset ID is efb7b8c949ac4650a09736fc376e9aee. The Free plan uses the Cloudflare Managed Free Ruleset, ID 77454fe2d30c4220b5701f6fdfb893ba.

Is the Cloudflare WAF rule enough to stop PHP2Shell?

No. Cloudflare recommends updating PHP as soon as possible while keeping the WAF on. Traffic that bypasses Cloudflare reaches the vulnerable runtime directly, and only a patched PHP release removes the flaws.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, according to php.net. Linux users can install their distribution's patched packages instead.

Where do I see PHP2Shell attacks Cloudflare blocked?

Open the zone's Analytics page and select the Events tab, then add a filter for the PHP2Shell rule IDs. Each event shows the matched request, the action and the path.