Skip to content

Introducing the Cloudflare PHP Capture the Flag challenge

Source: https://blog.cloudflare.com/php-ctf/

Skip to content

[](https://blog.cloudflare.com/)

[](https://blog.cloudflare.com/)

All Categories

- AI

- Policy & Legal

- Speed & Reliability

- Life at Cloudflare

- Switch Site Language

- Español (Latinoamérica)

- Русский

- Bahasa Indonesia

- ภาษาไทย

- Tiếng Việt

- العربية

Login Dashboard Contact Sales

Bug Bounty php Security+2 Show 2 more tags

5 Tags Show 5 tags

- Post Tags

- Bug Bounty php Security Vulnerabilities WAF

- All tags

- Matching tags

- No tags found

- Access Control Lists (ACLs)

- Accessibility

- Account Takeover

- Advanced Certificate Manager

- Advanced DDoS

- Agent Development Lifecycle

- Agent Readiness

- Agents Week 2026

- AI

- Always Online

- Application Security

- Application Services

- Area 1 Security

- Argo Smart Routing

- Athenian Project

- Authentication

- Automatic HTTPS

- Automatic Platform Optimization

- Bandwidth Alliance

- Bandwidth Costs

- Best Practices

- Better Internet

- Birthday Week

- Bot Fight Mode

- Bot Management

- Brand Protection

- Browser Insights

- Browser Rendering

- Cache Reserve

- Certificate Authority

- Certificate Pinning

- Certificate Transparency

- Certification

- Challenge Page

- China Network

- Clientless Web Isolation

- Cloud Connector

- Cloud Email Security

- Cloudflare Access

- Cloudflare Apps

- Cloudflare Area 1

- Cloudflare Calls

- Cloudflare Email Service

- Cloudflare for Campaigns

- Cloudflare for SaaS

- Cloudflare for Startups

- Cloudflare Gateway

- Cloudflare History

- Cloudflare Images

- Cloudflare Media Platform

- Cloudflare Meetups

- Cloudflare Network

- Cloudflare One

- Cloudflare One Client

- Cloudflare One User Risk Score

- Cloudflare One Week

- Cloudflare OS

- Cloudflare Pages

- Cloudflare Polish

- Cloudflare Queues

- Cloudflare Realtime

- Cloudflare Stream

- Cloudflare Tunnel

- Cloudflare TV

- Cloudflare Workers

- Cloudflare Workers (PT)

- Cloudflare Workers KV

- Cloudflare Workers KV (ES)

- Cloudflare Zero Trust

- Cloudforce One

- Configuration Management

- Congestion Control

- Connectivity Cloud

- Consumer Services

- Content Independence Day

- Content Scanning

- Crawler Hints

- CSAM Reporting

- Customer Success

- Customer Zero

- CVE-2023-50387

- Cyber Readiness

- Cybersecurity

- D1

- Data Localization

- Data Localization Suite

- Data Loss Prevention

- Data Platform

- Data Privacy Day

- Data Protection

- Data Sovereignty

- Data Transfer Bucket

- Developer Documentation

- Developer Platform

- Developer Spotlight

- Developer Week

- Developers Storage

- Device Security

- Digital Experience Monitoring

- Digital Forensics

- Distributed Systems

- Distributed Web

- DNS Filtering

- Domain Rankings

- Domain Scoped Roles

- Durable Execution

- Durable Objects

- Edge Computing

- Edge Database

- Election Security

- Elliptic Curves

- Email Routing

- Email Security

- Email Workers

- Employee Resource Groups

- Encrypted SNI

- European Union

- Feature Flags

- FedRAMP Moderate

- Formal Methods

- Foundation DNS

- Founders' Letter

- Freedom of Speech

- Full Stack Week

- General Availability

- Generative AI

- Geo Key Manager

- Go

- Google Analytics

- Google Workspace

- Government Innovation

- I'm Under Attack Mode

- iCloud Private Relay

- IETF Standards

- Image Optimization

- Image Recognition

- Image Resizing

- Image Storage

- Incident Report

- Incident Response

- Indicators of Compromise

- Infrastructure

- Infrastructure as Code

- Interconnection

- Internet Performance

- Internet Quality

- Internet Regulation

- Internet Shutdown

- Internet Summit

- Internet Traffic

- Internet Trends

- Internship Experience

- Intrusion Detection

- Latin America

- Lazarus group

- Leaked Credential Checks

- Legal Patents Sable

- Life at Cloudflare

- Live Streaming

- Load Balancing

- Machine Learning

- Magic Firewall

- Magic Network Monitoring

- Magic Transit

- Magic WAN Connector

- Malicious JavaScript

- Managed Components

- Managed Rules

- March of Cloudflare

- Message Protocol

- Micro-frontends

- Microsoft 365

- Microsoft Azure

- Migration Hub

- Mixed Content Errors

- Model Context Protocol

- Net Neutrality

- Network Interconnect

- Network Performance Update

- Network Protection

- Network Services

- North America

- Notifications

- Observability

- OpenTelemetry

- Pacific Northwest

- Password-reuse

- Passwords (PT)

- Pay Per Crawl

- PCI Certified

- Performance Optimization

- Platform Engineering

- Platform Week

- Policy & Legal

- Prepared Statements

- Private Network

- Product Design

- Programming (PT)

- Project Fair Shot

- Project Galileo

- Project Honey Pot

- Project Pangea

- Project Safekeeping

- Project Turpentine

- Public Sector

- Python Workers

- R2

- R2 Super Slurper

- Ransom Attacks

- Rate Limiting

- Regional Services

- Remote Browser Isolation

- Remote Desktop Protocol

- Reverse Engineering

- Risk Management

- Road to Zero Trust

- Rocket Loader

- Routing Security

- SAAS Security

- Search Engine

- Secrets Store

- Secure Web Gateway

- Security Analytics

- Security Center

- Security Posture

- Security Posture Management

- Security Service Edge

- Security Week

- Serverless (PT)

- Serverless AI

- Serverless Week

- Signed Exchanges (SXG)

- Single Sign On (SSO)

- Smart Placement

- SOC as a Service

- South America

- Speed & Reliability

- Startup Enterprise Plan

- StopTheHacker

- Supply Chain Attacks

- Sustainability

- Teams Dashboard

- Technical Writing

- The Serverlist Newsletter

- Threat Intelligence

- Threat Operations

- Threat Report

- Transform Rules

- Trust & Safety

- United Kingdom

- Universal SSL

- User Research

- Vulnerabilities

- WAF Attack Score

- WARP Connector

- Web Application Firewall

- Web Asset Discovery

- Workers Launchpad

- Workers Observability

- Workers Sites

- Workers Unbound

- World IPv6 Day

- Year in Review

- Z3

- Zero Day Threats

- Zero Trust Week

- Zone Versioning

- Artificial Intelligence

- Client-Side Security

- Multi-tenant Secuity

- Multi-tenant Security

- cf

Vulnerabilities WAF

Bug Bounty php Security Vulnerabilities WAF

October 27, 2026

Introducing the Cloudflare PHP Capture the Flag challenge

!Image 2: Celso Martinho!Image 3: Sven Sauleau!Image 4: Dan Jones

Celso Martinho,Sven Sauleau,andDan Jones

5 minute read

COPY URL

!Image 5!Image 6

Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged certificates that could be used to impersonate servers. Then came php2shell: serious vulnerabilities in PHP, the runtime behind a large portion of the Web.

Cloudflare worked around the clock as these events unfolded to protect our customers and help protect the Internet. We shipped client updates and multiple mitigations, updated our web application firewall (WAF) with new rules to block attackers from exploiting the PHP vulnerabilities, and introduced a new feature called full transaction detection.

As always in situations like this, these new capabilities were made available on all plans, including Free.

Put our WAF to the test

Protecting systems from vulnerabilities like these is always an ongoing process, not a one-time event. The widespread adoption of AI allows attackers to discover new vectors with unprecedented speed and efficiency, so col