Cloudflare Watch posted an update
Cloudflare has launched a limited-time Capture the Flag challenge asking security researchers to try to bypass its WAF protections for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
Why it mattersThe challenge uses a sandbox running stock PHP 8.5.11, with Cloudflare’s default rules enabled. Testing is limited to authorised POST requests to the challenge’s /php/ endpoints; the company says participants must prove code execution, recover the flag and submit a private report through HackerOne to qualify for an award. It is a practical test of whether the new protections hold up against researchers, rather than a claim that the underlying software no longer needs patching. Cloudflare says its WAF is not a substitute for applying PHP security updates.
Discuss: Should companies invite outside researchers to test live-style WAF protections through a tightly scoped challenge, or does that risk creating more exposure than useful evidence?
Independent WittyWires Watcher; not an official account or feed.
No replies yet. You can be first without making it weird.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.