Cloudflare launches PHP capture-the-flag challenge to test WAF defenses

Cloudflare on October 27, 2026, launched a PHP capture-the-flag challenge through its bug bounty program, inviting security researchers to test the company’s web application firewall by trying to break into a sandboxed PHP environment and recover a file named /flag.

What Cloudflare is asking researchers to do

The challenge is meant to measure how well Cloudflare’s defenses stand up against the PHP vulnerabilities tied to CVE-2026-109618 and CVE-2026-109619, which the company says are behind php2shell. Researchers taking part through HackerOne are asked to bypass the WAF, obtain code execution in the sandbox, and then retrieve the current contents of /flag.

Cloudflare says the sandbox is reset every few minutes, including the flag file, so anyone trying the challenge has to move quickly from exploitation to verification.

• Challenge name: Cloudflare PHP Capture the Flag
• Program: Cloudflare Bug Bounty on HackerOne
• Target: A deliberately vulnerable PHP setup behind Cloudflare’s default WAF rules
• Goal: Recover the contents of /flag and verify it in the CTF interface

How the test environment is built

According to Cloudflare, the target runs stock PHP 8.5.11 with standard PHP extensions, Apache 2 through mod_php, and an empty index.php inside a Cloudflare Container. The company placed its default WAF protections for the relevant vulnerabilities in front of that setup.

The blog post says the challenge page provides the environment details, scope, and a flag verification form. Participants may use their own research tools, but the challenge is limited to the WAF-protected /php/* endpoints and POST requests.

Cloudflare also says the company is recording attempted metadata and request payloads to help analyze reports, and asks participants to use test data only.

Why Cloudflare says it is doing this

Cloudflare frames the challenge as part of ongoing defense testing rather than a one-time exercise. The post says that protections need to be updated continuously because attack techniques change, and it points to the growing use of AI as one reason attackers can find new paths faster than before.

The company also says the release followed two major security events: the compromise of eight eMudhra intermediate certificates and the disclosure of php2shell, which it describes as serious PHP vulnerabilities. In response, Cloudflare says it shipped client updates, added mitigations, updated its WAF rules, and introduced a feature called full transaction detection.

Cloudflare says those protections were made available on all plans, including Free.

Rules, limits and why the details matter

The company says a valid submission must show attacker-controlled PHP code or command execution, then use that execution to recover /flag and verify the result through the CTF user interface. After that, researchers must file a private report on HackerOne with technical details, proof that the bypass is materially distinct, and the relevant timestamps and attempt ID.

Cloudflare says some findings do not count as eligible, including file disclosure without code execution, code execution without successful flag recovery, local-only exploits, rediscovery of the known PHP vulnerabilities, and partial chains that do not meet the full objective. It also says equivalent payloads or cosmetic changes do not make a submission unique.

For ordinary readers, the challenge is a reminder that web defenses are only one part of security. Cloudflare says a WAF can block attacks and stop exposed data from reaching an attacker, but it cannot undo harmful actions already carried out on the origin. The company says fixing the underlying software remains necessary and points PHP users to apply the latest security advisories and updates.

Cloudflare says the challenge may be terminated at any time and that participants should check the HackerOne page for the most current status.

Source: Cloudflare Blog