OPEN SECURITY RESEARCH

PHP vulnerability research

CVE-2026-109618 & CVE-2026-109619

This open research project follows our blog post, Cloudflare deploys protections against php2shell vulnerability, which explains the vulnerabilities and the WAF protections deployed to mitigate them.

We’re providing a real, deliberately vulnerable PHP instance on Cloudflare Containers. We invite security researchers to test CVE-2026-109618 and CVE-2026-109619 against it and investigate how they can be exploited.

This is a shared research target, not a competition. Review the runtime details and scope before testing.

Open PHP target

Checking runtimePHP · Cloudflare Containers

Research activity

Unique attempts: —
Successful exploits: —

Loading research statistics…

Repeated requests with the same endpoint, query, and payload count once. Successful exploits require backend verification. Page views and runtime checks are not counted.

About this environment

The target is a native PHP installation running inside a Cloudflare Container, provided specifically for vulnerability research. Review the environment details and scope before testing.

The goal is to produce reproducible evidence for either CVE. We’ll collect attempt metadata and request payloads to understand how researchers exploit the vulnerabilities.

When your exploit succeeds, you’ll receive a unique permalink to a page showing the payload used. Share the link so other researchers can inspect your approach and reproduce the result.

Use test data only. Payloads shown on shared exploit pages will be visible to anyone with the link, so keep secrets and personal information out of your requests.

View an example exploit record →

Test the PHP environment

Send a request here, or use your own HTTP tools against this host’s /php/* endpoints.

Request

Response

Ready

Send a request to see the PHP response.

Response body— ms

Scope & privacy

Testing is authorized only on this hostname’s /php/* endpoints. Other Cloudflare services, the upstream PHP project, and third-party systems are out of scope.
No denial of service, high-volume scanning, persistence, social engineering, or attacks on other participants. Back off on 429 or 503 responses.
Application evidence capture is currently off. Platform security and operational telemetry may still record activity. Successful exploit payloads will be viewable through shareable permalinks. Do not send secrets or personal information.

This is an open research environment, not a bug-bounty program. No prizes or rewards are promised.