Cloudflare has launched a PHP Capture the Flag challenge through its Bug Bounty program, inviting security researchers to test whether they can bypass its web application firewall (WAF) protections. The company says the exercise is intended to gather real-world findings and strengthen its defenses against PHP vulnerabilities associated with php2shell.
The challenge focuses on CVE-2026-109618 and CVE-2026-109619. Participants will face a deliberately vulnerable environment running stock PHP 8.5.11 with standard extensions and Apache 2 via mod_php. Cloudflare’s default WAF rules for the vulnerabilities sit in front of the sandbox, which contains an empty index.php and a /flag file. The environment resets every few minutes.
To qualify, researchers must use an authorized POST request to achieve attacker-controlled PHP code or command execution, retrieve the current contents of /flag, and verify the flag through the challenge interface. They must also submit a private report through HackerOne with reproducible technical evidence, including the request sequence, relevant headers and payload, the bypass method, and the successful verification details.
Cloudflare says rewards require a materially distinct WAF bypass. Reports using the same bypass mechanism count as duplicates even if they use different PHP exploits, payloads, execution techniques, or flag-recovery methods. File disclosure without remote code execution, execution without successful flag recovery and verification, and partial chains are not eligible.
Testing is limited to POST requests against the challenge hostname’s WAF-protected /php/* endpoints. Direct access to underlying infrastructure, other Cloudflare services, and third-party systems is out of scope. The rules also prohibit denial-of-service activity, high-volume scanning, persistence, and social engineering. Cloudflare asks participants to use test data only and to stop or reduce activity if they receive a 429 or 503 response.
The company emphasizes that WAF protection does not replace patching vulnerable software. It advises PHP users to follow security advisories and apply relevant updates. The challenge is available at php-rce.cloudflare.app, subject to the terms of Cloudflare’s HackerOne program.
Sources: Cloudflare Blog.