Cloudflare blocked PHP2Shell before PHP shipped a patch.

PHP2Shell dropped this week. It’s two critical bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, rated 9.2 and present in nearly every version of PHP in use. If you have a website, you probably got an email about it. A lot of you emailed me.

I posted a quick note on X the morning it broke. Not everyone is on X, so here’s the longer version.

Every Anchor Hosting site was protected by Cloudflare the entire time, and every site is now running patched PHP. There’s nothing you need to do.

100%Anchor sites behind Cloudflare's WAF ~9 hrsRules live before public disclosure 3,020Sites confirmed on patched PHP (all of them) 0Things you need to do

This one wasn’t a plugin problem.

Most WordPress security news is about a plugin or a theme. You update the plugin and move on. PHP2Shell lives one layer down, in the PHP runtime WordPress runs on. A crafted request can push PHP into using memory it has already thrown away. From there an attacker can crash the process, read data they shouldn’t see, or run their own code.

No WordPress update fixes that. The patch has to happen on the server.

Cloudflare shut the door before the patch existed.

Every Anchor site is served through Cloudflare. Most of you are on Kinsta, which puts Cloudflare in front of every site it hosts, and the handful on Rocket.net get the same treatment.

Cloudflare’s PHP2Shell rules went live at 03:02 UTC on October 21. PHP’s fixed releases came out at 13:30 UTC. By the time most people first heard the word PHP2Shell, every Anchor site was already sitting behind a rule built for it.

How Cloudflare catches it is the clever part. They call it full transaction detection. The WAF looks at the request and the server’s reply together, as one transaction. On its own, an exploit request can look like a big, ordinary upload. The reply is what gives it away. When a rule matches, Cloudflare stops the reply before it ever gets back to the attacker. PHP2Shell is the first managed rule they’ve shipped with it.

A WAF buys time. Patches close the hole.

Cloudflare was upfront that the WAF is not a substitute for patching. Attackers were already mutating their payloads to slip past the rules. The real finish line was patched PHP on every server.

Kinsta rolled patched builds across its network starting on the 21st and gave the all-clear on the 22nd. I didn’t want to take that on faith, so I asked PHP itself. I checked the running PHP version on every production site in the fleet.

PHP version on every production site, October 23 PHP 8.3.361,668 sites PHP 8.2.35803 sites PHP 8.4.27365 sites PHP 8.5.12172 sites PHP 7.4 or 8.0, rebuilt Oct 2112 sites

That’s all 3,020 sites, every one on a fixed build.

The twelve in orange run PHP 7.4 or 8.0. PHP stopped supporting those versions years ago, so there was no official fix. Their hosts rebuilt them with the patch on October 21. They’re covered.

Do I need to do anything?No. Your site was behind Cloudflare’s PHP2Shell rules before the bugs went public, and it’s running patched PHP now. If you have questions, reply to any email from me.