Cloudflare opens PHP WAF bypass challenge for two critical RCE flaws
CTO Dane Knecht says the test uses default WAF rules against PHP 8.5.11, even though PHP's security fixes have been available since October 21st.
By Ryan Merket · Published
Primary source: x.com
Why it matters
The challenge tests Cloudflare's default protections against two real PHP remote-code-execution flaws, while the PHP project says updating to a fixed release is the only safe fix.
Dane Knecht (@dok2001), Cloudflare's chief technology officer, said on October 27th that he had asked his team to build a capture-the-flag challenge around two critical PHP vulnerabilities. The challenge puts stock PHP 8.5.11 behind Cloudflare's default web application firewall (WAF) rules and invites researchers to bypass them, execute code in the sandbox and retrieve a file called '/flag'. Cloudflare published the challenge announcement the same day.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.