Is your Cloudflare WAF
covering you against php2shell.

Two critical flaws in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) are being exploited since 21 October 2026. Cloudflare deployed blocking rules on every plan nine hours before the disclosure. Whether they reach your traffic depends on your configuration: a managed ruleset that is not deployed, an override that logs instead of blocks, an exception, a hostname that bypasses Cloudflare. This check reads that configuration and tells you, zone by zone.

What the check reads

• Zone Read: the list of zones in the account you choose, with their plan and status.
• Zone WAF Read: the WAF configuration of each zone: which managed ruleset is deployed, its scope, overrides and exceptions, and the state of Cloudflare's seven php2shell rules.
• User Details Read: your name and email, to address the report to you.
• DNS Read optional: which hostnames are proxied: a DNS-only record is not behind the WAF at all.
• Account WAF Read optional: managed rules deployed at the account level (Enterprise).
• Analytics Read optional: how many requests the php2shell rules blocked on each zone in the last days.

You can switch the optional permissions off on Cloudflare's consent screen; the report then says what was not checked.

What you get

One verdict per zone, Protected, Protected with conditions or Not protected, with the evidence behind it (ruleset, version, the rules' actions, exceptions, hostnames) and a link to the exact page of your Cloudflare dashboard for each finding. The report comes by email only, to the address on your Cloudflare account: nothing of it is published on the web.

Free for 2 zones. The free report shows the verdict for every zone in the account and gives 2 zones in full, the ones most in need of attention. An account with more zones can have the full report, every zone in full, for £10 per extra zone, paid once by card from a link in the email, or talk to the InCloud team about a review of the whole estate.

What it does not do

• It makes no change to your account: every permission is read-only.
• It keeps no token and publishes nothing: the report goes only to the email address on your Cloudflare account. InCloud keeps a copy for seven days, longer when you ask for a follow-up or buy the full report, so that the full report can be sent after a payment and the team can help with the findings. InCloud contacts you about them only if you choose the second option above.
• It is not a fix. The rules are a mitigation while you patch: the fix is in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 (older branches only through your distribution), and every PHP worker must be restarted afterwards. Read Cloudflare's post for the background.

Built by InCloud ITES, a Cloudflare Authorised Service Delivery Partner. If your organisation blocks third-party OAuth apps, talk to us and we will run the check with you.