Cloudflare launches PHP Capture the Flag challenge

Cloudflare has launched a PHP Capture the Flag challenge through its Bug Bounty program on HackerOne. The challenge puts a deliberately vulnerable PHP installation behind the company's WAF and invites security researchers to bypass protections, exploit the sandbox, and recover a flag. It focuses on CVE-2026-109618 and CVE-2026-109619, the two PHP vulnerabilities behind php2shell.

How the challenge works

The target runs stock PHP 8.5.11 with standard PHP extensions, Apache 2 via mod_php, and an empty index.php inside a Cloudflare Container. Default WAF protection rules for these vulnerabilities are enabled in front of it. Inside the sandbox is a file called /flag, and the sandbox resets every few minutes, including the flag file. Researchers must bypass the WAF, exploit the PHP sandbox, and recover the contents of /flag. The challenge page provides environment details, scope, and a flag verification form, and researchers may use their own research tools.

Eligibility and reporting

All participants must sign up for a HackerOne account and review and agree to the Bounty Terms before participating. An eligible submission must demonstrate attacker-controlled PHP code or command execution inside the sandbox through an authorized POST request, use that remote code execution to recover the current contents of /flag, and verify the flag through the CTF user interface before a reset. Researchers must then submit a private report to Cloudflare on HackerOne, with PHP CTF in the title, including endpoint, payload, request sequence, raw captures or proof of concept, explanation, attempt ID, verification result, timestamps, and related submissions. File disclosure without remote code execution, remote code execution without successful flag recovery and UI verification, local-only exploits, rediscovery of the known PHP vulnerabilities, and partial chains without the full objective are not eligible. Awards require a materially distinct WAF bypass method; reports using the same Firewall-bypass mechanism are duplicates. UI verification does not submit a HackerOne report or establish reporting priority.

Scope and safety

Testing is authorized only against the challenge hostname's WAF-protected /php/* endpoints using the POST method. Other Cloudflare services, direct access to underlying infrastructure, the upstream PHP project, and third-party systems are out of scope. Denial of service, high-volume scanning, persistence, social engineering, and attacks on other participants are not permitted; if a 429 or 503 response occurs, researchers should back off. Cloudflare reserves the right to suspend or terminate the challenge at any time. As of an October 30, 2026 update, the CTF remains open, and details of managed-rule changes are available in the Cloudflare WAF changelog. Participants are asked to use test data only and not send credentials or personal information.

Not a substitute for patching

Cloudflare's WAF protects systems, but it is not a replacement for fixing vulnerable software. Response blocking can prevent exposed data from reaching an attacker, but it cannot undo actions already performed at the origin. Anyone running PHP should follow the latest PHP security advisories and apply relevant updates. The challenge follows a week in which eight eMudhra intermediate certificates were compromised and the php2shell PHP vulnerabilities emerged; Cloudflare shipped client updates and multiple mitigations, updated its WAF with new rules, and introduced full transaction detection, with these capabilities available on all plans including Free.

Sources: Cloudflare