Yesterday, PHP announced that two critical vulnerabilities had been discovered, and would be fully disclosed and patched today at 14:00 UTC: CVE-2026-109618 and CVE-2026-109619—collectively referred to as php2shell.
The announcement has caused a stir in the web community, with several websites being taken completely offline while waiting for the release to become available.
While there is evidence that the vulnerabilities were being exploited even before the PHP updates were released, sites protected by Cloudflare’s firewalls were protected. OpenAI, who discovered the vulnerabilities, coordinated with Cloudflare in preparation, and Cloudflare deployed emergency firewall rules across their entire network prior to the disclosure, mitigating potential attacks. We’ve confirmed that those rules have effectively protected Craft Cloud-hosted sites, with no known successful attacks.
Immediately after the PHP updates were released, Matthieu Napoli began building new images for Bref, the PHP runtime that powers Craft Cloud. Those images became available just over an hour later, at which point we pulled them into the Craft Cloud infrastructure and began rolling them out to all Cloud projects.
Save for a small handful of sites with preexisting build issues, at this point all Cloud environments have now been updated to the new images, and are fully protected.
We’d like to thank the PHP Foundation, Cloudflare, and Matthieu for their proactive work to keep the PHP community secure, and Craft Cloud customers for trusting us with their projects.