Cloudflare · PHP2Shell

Cloudflare and PHP2Shell

Cloudflare shipped PHP2Shell WAF rules to every plan — including Free — about 11 hours before the patch. Here are the rule IDs, how to check they are working, and why your origin still needs the PHP update.

Last reviewed 2026-10-22

A WAF is time bought, not the fix

Cloudflare itself reports attackers mutating payloads to slip past the rules, and says rules are being updated as new variants appear. Any request that reaches your server without going through Cloudflare is unfiltered. Patch PHP.

Rule IDs

Cloudflare Managed Free Ruleset

ruleset 77454fe2d30c4220b5701f6fdfb893ba

  1. 4e315666e8e344cdb64119a3b5ccf32f · Anomalous Execution 1
  2. 00c10e6cc4da4bd08722adeebcd95984 · Anomalous Execution 2
  3. 48ddf592361e4fdb97a8a85982dab691 · Anomalous Execution 3
  4. 3556683d512a47f2937899c524b1a4c6 · Anomalous Execution 4
  5. da07c85852e34625bb478496302ede46 · Anomalous Execution 5
  6. 19373a83abb840e18ab3ce5a7975ce1b · Anomalous Execution 6
  7. 07f0b6ddaabf40b1b2042dade8d613fa · Anomalous Execution 7

Cloudflare Managed Ruleset (Pro / Business / Enterprise)

ruleset efb7b8c949ac4650a09736fc376e9aee

  1. c1d409ad838f47f59446f21cc438d5dd · Anomalous Execution 1
  2. f9a45927414245e3a64bb12d0a0c2f64 · Anomalous Execution 2
  3. 771c654ae1154d4daa72f4e1545d163c · Anomalous Execution 3
  4. 217005865f0145f392300bac212afcc9 · Anomalous Execution 4
  5. 38efdb17ea594501bb55a1d71867b12e · Anomalous Execution 5
  6. 4148ae686fdb4d01be673fab9d9c073d · Anomalous Execution 6
  7. 1389aa259617437392ce149c48143645 · Anomalous Execution 7

Plus, on all plans: Cloudflare Managed Response Firewall Default — afffe22785674c80a31875c848d2242a (“Default block for High confidence Signatures”). It inspects your origin’s response too, so it can stop a leaked-memory response before it reaches the attacker.

Check it is working

  1. DNS → Records: every hostname that serves PHP is proxied (orange cloud). Grey-cloud records bypass the WAF.
  2. Security → WAF → Managed rules (paid plans): the Cloudflare Managed Ruleset is deployed, and the action is Block, not Log.
  3. Security → Analytics → Events: filter by the rule IDs above to see what was blocked and from where.
  4. Origin lockdown: make sure the server only accepts HTTP from Cloudflare IPs (or uses Cloudflare Tunnel).
shell
# Is your origin reachable without Cloudflare? Run from outside your network.
# A normal response here means attackers can skip the WAF.
curl -sk -o /dev/null -w '%{http_code}\n' --resolve www.example.com:443:<ORIGIN_IP> https://www.example.com/

# Lock the origin to Cloudflare (nginx example; keep the list current from
# https://www.cloudflare.com/ips/)
# allow 173.245.48.0/20;  ...  deny all;

Questions

Does Cloudflare protect me from PHP2Shell?+

It reduces risk. Cloudflare deployed managed WAF rules for all plans, including Free, at 03:02 UTC on 21 October 2026, and reports blocking early attacks. But attackers are mutating payloads, and requests that reach your origin directly bypass Cloudflare entirely. You still need to patch PHP.

Do I need to do anything on the Free plan?+

Free plans are protected automatically by the Cloudflare Managed Free Ruleset as long as traffic is proxied (orange cloud). Check that your DNS records are proxied and that the origin cannot be reached around Cloudflare.

What should paid-plan customers check?+

That the Cloudflare Managed Ruleset is deployed and that the PHP2Shell rules are in Block mode, not Log. Then filter Security Events by the rule IDs to see hits.

Related