Introducing the Cloudflare PHP Capture the Flag challenge

Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised , creating the possibility of forged certificates that could be used to impersonate servers. Then came php2shell : serious vulnerabilities in PHP, the runtime behind a large portion of the Web. Cloudflare worked around the clock as these events unfolded to protect our customers and help protect the Internet. We shipped client updates and multiple mitigations , updated our web application firewall (WAF) with new rules to block attackers from exploiting the PHP vulnerabilities, and introduced a new feature called full transaction detection . As always in situations like this, these new capabilities were made available on all plans, including Free. Put our WAF to the test Protecting systems from vulnerabilities like these is always an ongoing process, not a one-time event. The widespread adoption of AI allows attackers to discover new vectors with unprecedented speed and efficiency, so collecting real-world data to test our assumptions and strengthen defenses is essential. That’s why today we're launching the Cloudflare PHP Capture the Flag challenge , run through our Bug Bounty program . We've put a deliberately vulnerable PHP installation behind our WAF, and we're inviting security researchers on HackerOne to try to bypass the protections and capture a flag. How this Capture the Flag (CTF) works We are keeping this simple. The challenge focuses on CVE-2026-109618 and CVE-2026-109619 , the two PHP vulnerabilities behind php2shell . The target runs stock PHP 8.5.11 (with standard PHP extensions), Apache 2 (via mod_php), and an empty index.php inside a Cloudflare Container , with our default WAF protection rules for these vulnerabilities enabled in front of it. Inside the sandbox is a file called /flag . The sandbox is reset every few minutes, including the flag file. Your mission, should you choose to accept it: bypass the WAF protections, exploit the PHP sandbox, and recover the contents of /flag . You can use your own research tools. The challenge page has the environment details, scope, and flag verification form. Challenge requirements This limited-time challenge is run via Cloudflare's Bug Bounty program on HackerOne . All aspects of this challenge are subject to HackerOne terms and the Cloudflare HackerOne program rules the (“Bounty Terms”). If you find an eligible bypass, you must follow these requirements in …