Research

Introducing the Cloudflare PHP Capture the Flag challenge

We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer.

Read at Cloudflare blog (security)

Vendor

Cloudflare

Product

Cloudflare WARP / Workers / Zero Trust

EPSS

1.00 (p100)

Exposure class

Cloud platform

• Cloudflare blog (security) (blog.cloudflare.com)
• CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 79
   Tenable research Tenable 2d ago

   php2shell one week later: Why one exploit doesn’t work everywhere

   Exploited CVSS 9.2 EPSS 0.16 Fix available CVE-2026-109618CVE-2026-109619CVE-2021-44228+1 more PHP
2. 31
   News The Register 2d ago

   Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

   EPSS 0.16 CVE-2026-109618CVE-2026-109619CVE-2026-46300 PHP
3. 58
   Research Censys 2d ago

   Censys takes census of the Internet like no one else

   CVSS 9.2 EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
4. 61
   News The Register 4d ago

   CISA confirms PHP2Shell under attack as researchers clock successful exploits

   Exploited EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
5. 41
   Tenable research Tenable 5d ago

   Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

   EPSS 1.00 Fix available CVE-2026-111497CVE-2026-109618CVE-2026-109619 Google Node.js
6. 36
   Tenable research Tenable 5d ago

   Discover and remediate PHP2Shell exposure with Tenable

   EPSS 1.00 No fix yet CVE-2026-109618CVE-2026-109619 Tenable PHP
7. 33
   Research Check Point Research 5d ago

   26th October – Threat Intelligence Report

   EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-115560+2 more
8. 38
   ESET research ESET 5d ago

   PHP2Shell: What to know about two critical PHP flaws

   EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
9. 64
   CISA alert CISA 5d ago

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   Exploited EPSS 1.00 CVE-2026-109618CVE-2026-109619
10. 36
    News The Register 6d ago

    PHP2Shell: No login, no app code, no warning. What next?

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
11. 41
    Qualys TRU Qualys 6d ago

    Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own

    EPSS 1.00 Fix available CVE-2026-109618CVE-2026-109619 Qualys PHP
12. 35
    Palo Alto advisory Palo Alto PSIRT 7d ago

    Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Palo Alto Networks
13. 51
    Google Cloud bulletin Google Cloud 8d ago

    GCP-2026-074

    EPSS 1.00 Fix available CVE-2026-93327CVE-2026-85299CVE-2026-109618+1 more Google
14. 46
    Cisco advisory Cisco PSIRT 8d ago

    Vulnerabilities in PHP Affecting Cisco Products: October 2026

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Cisco PHP
15. 34
    News The Register 8d ago

    There's a third PHP2Shell bug, but it won't get an emergency fix

    EPSS 1.00 CVE-2026-115560CVE-2026-109618CVE-2026-109619 PHP
16. 31
    Research Unit 42 8d ago

    Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

    EPSS 1.00 CVE-2026-109618CVE-2026-109619
17. 34
    Research Horizon3 8d ago

    CVE-2026-109618 / CVE-2026-109619

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 PHP
18. 37
    CCCS advisory CCCS 8d ago

    AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619

    EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-115560
19. 50
    Docker security Docker 8d ago

    PHP2Shell and eMudhra Patched

    EPSS 1.00 CVE-2026-109618CVE-2026-109619 Docker PHP
20. 41
    Threat signal FortiGuard 9d ago

    PHP2Shell Remote Code Execution Vulnerabilities

    EPSS 1.00 Fix available CVE-2026-109618CVE-2026-109619CVE-2026-115560 PHP