Cloudflare has deployed new security protections against two critical PHP vulnerabilities known as php2shell.

Its enhanced Web Application Firewall (WAF) analyzes both HTTP requests and server responses to detect exploitation attempts involving remote code execution and data exposure. The protections are automatically available across free and paid plans, but Cloudflare emphasizes that updating PHP remains essential for fully addressing the vulnerabilities.