Does Cloudflare or a WAF Protect You from PHP2Shell? Only If Attackers Can't Reach Your Origin

What does a Cloudflare or WAF rule actually do against PHP2Shell?

• It matches what is already known. Attackers rewrite payloads until they stop matching. Many public proof-of-concept scripts also turned out not to work, so early traffic is a poor guide to what a working exploit looks like.
• The bug is not in your application. PHP2Shell triggers inside the PHP runtime while it is still parsing the request, before WordPress, Laravel or your login code runs. The PHP2Shell explainer covers the mechanics.
• It only sees traffic routed through it. This is the limit that catches most teams, and the rest of this article deals with it.

What is confirmed about PHP2Shell attacks as of 23 October?

Why is the origin server the real weak point?

How do attackers find an origin IP behind Cloudflare?

• DNS history. Passive DNS databases keep what your domain resolved to before it moved behind the CDN. If the server kept its IP, the old A record still points at it.
• Unproxied subdomains. mail., ftp., cpanel., staging., dev. or direct. records often resolve to the same machine as the website, with no CDN in between.
• Mail sent from the web server. Contact forms and order confirmations sent by the server carry its IP in the message headers.
• Certificate data. Certificate transparency logs list every hostname you issued certificates for. Scanners also record the certificate each IP presents, so an origin serving www.example.com on its bare IP is easy to find.
• Direct scanning. Internet-wide scanners index page titles, content and favicons. A page that matches your public site pairs the IP with your domain.
• The application itself. Webhooks, WordPress pingbacks, image fetches and verbose error pages can all disclose the real address.

How do I test whether my origin is reachable around the WAF?

# Read-only checks. Replace example.com and the IP with your own.

# 1. Which hostnames resolve to something that is NOT your CDN?
for h in "" www. mail. ftp. cpanel. webmail. staging. dev. api. direct.; do
  printf '%-22s ' "$h"example.com; dig +short A "$h"example.com | tr '\n' ' '; echo
done

# 2. Does the origin answer when the CDN is bypassed?
ORIGIN=203.0.113.10   # your server's real public IP
# 2a. Force the hostname to resolve to the origin (correct TLS name + Host header)
curl -sk -o /dev/null -w 'resolve:  %{http_code}\n' \
  --resolve www.example.com:443:$ORIGIN https://www.example.com/
# 2b. Bare IP with a Host header
curl -sk -o /dev/null -w 'host hdr: %{http_code}\n' \
  -H 'Host: www.example.com' https://$ORIGIN/
# 2c. Plain HTTP on the IP
curl -s  -o /dev/null -w 'http:     %{http_code}\n' --max-time 5 http://$ORIGIN/

# 3. Which certificate does the bare IP present? (scanners index this)
echo | openssl s_client -connect $ORIGIN:443 2>/dev/null \
  | openssl x509 -noout -subject -ext subjectAltName

# 4. What else listens on the origin? (your own IPs only)
nmap -Pn -p 21,22,25,80,443,3306,3389,8080,8443 $ORIGIN

How do I lock the origin so only the CDN can reach it?

• Firewall web ports to the CDN's edge ranges. Every major CDN publishes the ranges its edge connects from. Allow 80/443 only from those and drop the rest. Automate list updates, because ranges change.
• Make the CDN authenticate. An IP allowlist also admits traffic from someone else's account on the same CDN pointed at your IP. Authenticated origin pulls (the edge presents a client certificate; mutual TLS) or a secret header checked by the web server close that gap.
• Remove the inbound path. With an outbound-only tunnel, an agent on the origin connects out to the CDN and the server has no open web ports. Cloudflare Tunnel is one example of this pattern.
• Separate what shares the IP. Send mail through a dedicated relay or provider, and move control panels, FTP and webmail off the web origin's address.
• Restrict admin ports. SSH from a virtual private network (VPN) or bastion host only, MySQL on localhost or a private network, RDP never on the public internet. Our Linux server security guide covers the SSH side.
• Consider a new origin IP once locked. The firewall makes the old IP irrelevant for web traffic, but a fresh address also drops years of DNS-history breadcrumbs.

Do AWS, Azure and Google Cloud WAFs have the same gap?

• AWS: place origins in private subnets and restrict the load balancer or instance security group to CloudFront's managed prefix list, not 0.0.0.0/0.
• Azure: limit the backend network security group to the Front Door service tag, and check the Front Door ID header so other Front Door tenants cannot reach you.
• Google Cloud: keep backends without external IPs and allow only load-balancer and health-check ranges in VPC firewall rules.
• Everywhere: look for the forgotten path. Typical examples are a public IP left on a debugging VM, a test load balancer, or a staging copy with no WAF.

Is a WAF plus interim mitigations enough if we can't patch PHP2Shell yet?

What should we do in the next 48 hours?

• Map your hostnames. List every domain and subdomain, and note which resolve to CDN addresses and which do not.
• Test every origin from outside. Run the checks above for each web origin, including staging and old servers.
• Lock the web ports. Restrict 80/443 to CDN ranges, add authenticated origin pulls or a secret header, and plan a tunnel for critical sites.
• Close side doors. Restrict SSH, MySQL, RDP and control-panel ports on the same hosts.
• Patch and restart. Install a fixed PHP build and restart every worker; the explainer has the version checks.
• Check vendor boxes. Firewall management interfaces and network-attached storage (NAS) devices also run PHP. Palo Alto, Fortinet and Cisco published advisories on 22 October; QNAP had no patch for several product lines on 23 October.
• Record any shutdown decision. If you cannot lock or patch a site quickly, Britain's NCSC (National Cyber Security Centre) and CERT-EU both named taking systems offline as a valid option. Write down who decided and why; our guide to cyber insurance and PHP2Shell shutdown evidence explains what insurers will ask.
• Re-test after every change. Migrations and new load balancers quietly undo origin locks.

Sources

• The Hacker News - PHP2Shell exploit attempts hit millions
• CISA - Critical Vulnerabilities in PHP Require Immediate Patching
• Insurance Business - UK councils and Met Police among sites pulled offline after NCSC alert
• The Register - PHP2Shell exploit bypasses protections designed to stop remote code execution
• Recorded Future - PHP2Shell Exploitation: Two Critical PHP Flaws Explained
• Help Net Security - What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
• TechRadar - PHP security issues could also threaten your NAS device
• BleepingComputer - PHP shares mitigation for new RCE vulnerability with no patch