What Cloudflare WAF says
Cloudflare published managed WAF rules for php2shell (CVE-2026-109618/109619) on 2026-10-21: 'Generic Rules - Anomalous Execution - 1' to '- 7' in the Managed Free Ruleset (Free plan, default) and the Managed Ruleset (Pro/Business/Enterprise), action Block, plus a response-side default-block rule in the Managed Response Firewall Default ruleset. This is a WAF mitigation at the edge only; it does not patch PHP on the origin.
protected by default against php2shellGeneric Rules - Anomalous Execution - 1