Cloudflare Adds PHP Response Blocking for php2shell Attacks

Last updated: October 22, 2026

Cloudflare has expanded its web application firewall with full transaction detection and managed protection for the php2shell exploit. According to MakeUseOf, the new rules inspect both incoming requests and server responses, allowing Cloudflare to block a dangerous response before it reaches an attacker.

The protection is available across Cloudflare’s paid plans and free tier. However, a blocked response cannot undo malicious code that has already executed on the origin server, so patching remains the essential next step.

Understanding the php2shell threat

MakeUseOf reports that PHP powers about 70% of websites, including systems based on WordPress, Drupal and Laravel. Vulnerable server behavior can allow attackers to run their own code through crafted requests, even without authentication.

That combination explains the urgency. A PHP-based site may be exposed through its application stack, while automated scanning can find vulnerable targets at scale. Although patches were available, many sites and applications reportedly went offline on October 21 to apply emergency updates.

Patching PHP is not routine housekeeping after the event. It addresses the vulnerable server behavior itself. Edge filtering adds another layer, but it does not replace an updated environment.

How Cloudflare’s response-aware defense works

A conventional WAF can evaluate traffic arriving at a server. Cloudflare’s expanded full transaction detection looks at both the HTTP request and the server’s response.

That gives the system a second signal. A request may look suspicious on its own, but a response suggesting that an exploit succeeded can give Cloudflare a stronger reason to intervene. The service can then block that response before it reaches the attacker.

Cloudflare says it deployed the php2shell protections roughly nine hours before announcing them publicly. The managed rules are the first protections in the expanded system to use full transaction detection.

Custom response rules are also available. For example, a site can block a response when an unauthenticated visitor requests an administrator page and the server returns it anyway. Administrators can therefore express rules based on what the origin server did, not merely on what the visitor sent.

Why this matters for site owners

The useful part here is access. Cloudflare is not placing full transaction detection or response rules behind a paid-only barrier. Managed php2shell protection is enabled by default, and free customers can create up to three custom response rules.

Paid customers receive more detailed detection data and access to a wider range of managed protections over time. Free accounts still gain a meaningful defense against the reported exploit.

There is also a sharp limit. Once attacker code has run on the server, blocking the response does not reverse the damage. The server may already have been altered, data may have been accessed or other actions may have occurred. Cloudflare’s filtering can reduce exposure, but it cannot substitute for incident checks and software updates.

Small business owners and site administrators should avoid assuming that blocked traffic means the underlying application is secure. The edge rule and the origin patch solve different parts of the problem.

A practical response for administrators

Say a WordPress site runs on an older PHP installation and sits behind Cloudflare. The first priority is to contact the hosting provider or confirm the PHP version and patch status. Updating PHP addresses the underlying vulnerability rather than waiting for Cloudflare to handle every suspicious request.

Administrators should also check Cloudflare’s security settings and confirm that the managed php2shell protection is active. If the account has free-plan access, the three available custom response rules can help block responses that expose administrator pages to unauthenticated visitors.

Finally, review server logs and look for signs of exploitation around the reported attack surge. The exact signs depend on the application, but checking access patterns and unexpected server changes is more useful than treating a blocked response as proof that nothing happened.

The sequence matters: patch the origin, enable the edge defense and check for possible compromise. Reversing it leaves an avoidable gap.

Decision checklist for site owners

• [ ] Contact the hosting provider or identify the installed PHP version.
• [ ] Update PHP and confirm that the running environment is patched.
• [ ] Check that Cloudflare’s managed php2shell protection is enabled.
• [ ] Use available custom response rules for responses that should never be exposed.
• [ ] Review server logs and check for unexpected changes or other signs of exploitation.
• [ ] Treat blocked responses as a defensive measure, not proof that the origin was unaffected.

What to watch next

Cloudflare’s response-aware php2shell protection is a significant defensive improvement because it is available to free customers as well as paying ones. It also demonstrates why inspecting server responses can catch attacks that request filtering alone may miss.

The clear stance is simple: use the managed rules, but do not wait on them to patch PHP. Watch for additional managed protections, changes to Cloudflare’s response rules and further evidence about the scale of successful exploitation. Edge filtering buys time; updated servers and a proper incident review provide the lasting fix.

Key takeaways

• Cloudflare’s managed php2shell protection checks both requests and responses for signs of a successful exploit.
• The protection and response-rule features are available on free and paid plans.
• Blocking a response cannot undo code that already ran on the origin server.
• Updating PHP remains essential even when Cloudflare is filtering malicious traffic.