Cloudflare just launched a PHP Capture the Flag challenge. It puts a deliberately vulnerable PHP install behind Cloudflare's web application firewall (WAF). To win, you need to get past the WAF, run code in the sandbox, and read a file called /flag. You can then claim a bounty through Cloudflare's bug bounty program on HackerOne.

The challenge covers CVE-2026-109618 and CVE-2026-109619, the two PHP runtime bugs known as php2shell. Calif.io, Wiz, OpenAI and Quarkslab disclosed them on October 21, and the PHP Foundation explained the bugs and the disclosure leak the same day. According to Cloudflare's earlier post, it deployed WAF rules for php2shell about 9 hours before public disclosure, on all plans including Free. The CTF asks researchers to find the holes in those rules.

How the Challenge Works

The target runs:

  • Stock PHP 8.5.11 with the standard extensions
  • Apache 2 with mod_php
  • An empty index.php

It all sits inside a Cloudflare Container, with Cloudflare's default php2shell WAF rules turned on in front of it. The sandbox resets every few minutes, and the flag changes with it.

The challenge page has the environment details, an example request, and the flag verification form. Each request returns an X-Attempt-ID header, and you submit that ID with the flag so the verification record links back to your payload.

What Counts as a Win

To claim a bounty, you need to:

  • Sign up for HackerOne and agree to the program terms before you start
  • Show attacker-controlled PHP code or command execution in the sandbox through an authorized POST request
  • Use that to read /flag and verify it on the challenge page before the sandbox resets
  • File a private HackerOne report with "PHP CTF" in the title. Include the full payload and request sequence, raw captures or a proof of concept, an explanation of the bypass, the attempt ID, and UTC timestamps

Cloudflare won't pay for:

  • File disclosure without code execution
  • Code execution without a verified flag
  • Local-only exploits
  • Rediscovering the known PHP bugs
  • Partial chains

Awards also need a "materially distinct" bypass method or payload. Equivalent encodings and other cosmetic changes count as duplicates, and only the first complete, reproducible report counts. The announcement doesn't list reward amounts.

Testing is only allowed against the WAF-protected /php/* endpoints on the challenge hostname, and only with POST. Denial of service, high-volume scanning, and attacks on other participants are all out of scope. Cloudflare records every payload, so send test data only. The challenge runs for a limited time, and the HackerOne page shows whether it's still open.

WAF Rules and Patching

Cloudflare's php2shell protection includes full transaction detection, a new WAF feature that checks the request and the origin's response together. When a response rule matches, Cloudflare blocks the response before it reaches the attacker. The CTF post spells out what that can't do:

Our WAF protects you, but it is not a replacement for fixing vulnerable software. Response blocking can prevent exposed data from reaching an attacker, but it cannot undo actions already performed at the origin.

If an exploit has already run code on your server, blocking the response doesn't undo it. The php2shell bugs are in the PHP runtime itself, so updating your application code or plugins won't fix them either. You need to update PHP, or ask your host to.

Cloudflare's earlier post also covers a related bug, CVE-2026-115560, in PHP's session upload progress feature. The PHP project published an informational advisory for it on October 23. It affects fully patched releases, including 8.5.12, and the next regular PHP release will fix it. Cloudflare's WAF rule only covers sites that use the default upload progress field name. If you changed session.upload_progress.name, the rule doesn't protect you.