Summary: On October 27, 2026, Cloudflare launched a PHP Capture the Flag challenge through its Bug Bounty program on HackerOne. The target is a deliberately vulnerable PHP 8.5.11 installation behind Cloudflare’s WAF, and researchers who bypass the protections and recover a hidden flag file can claim a bounty. For builders, it’s a rare chance to see how a real WAF holds up against the php2shell vulnerabilities that made the news.
What the challenge actually is
Cloudflare set up a sandbox running stock PHP 8.5.11 with standard extensions, Apache 2 via mod_php, and an empty index.php inside a Cloudflare Container. Default WAF protection rules for the two PHP vulnerabilities behind php2shell — CVE-2026-109618 and CVE-2026-109619 — sit in front of it. Somewhere in the sandbox is a file called /flag. Your job: bypass the WAF, get remote code execution, read the flag, and verify it through the challenge UI before the sandbox resets every few minutes.
If that setup sounds familiar, it’s because Cloudflare shipped those WAF rules and mitigations the week the php2shell vulnerabilities and the eMudhra certificate compromise hit, and made them available on all plans, including Free. The CTF is essentially an open invitation to stress-test that work. It’s also a natural follow-up to Cloudflare’s full transaction detection, which judges requests by how the origin responds — another capability born from that same incident week.
The rules that matter
Cloudflare kept the scope tight. Testing is authorized only against POST requests on the WAF-protected /php/* endpoints of the challenge hostname; direct infrastructure access, the upstream PHP project, and third-party systems are out of scope. No denial of service, high-volume scanning, or persistence. If you hit a 429 or 503, back off.
To claim a bounty you need the full chain: attacker-controlled code execution via an authorized POST, recovery of the current /flag contents, UI verification, and a private HackerOne report with the endpoint, payload, raw captures, and timestamps. A few details worth reading twice:
- File disclosure without RCE doesn’t count, and neither does RCE without flag recovery.
- Rediscovering the known PHP CVEs alone isn’t eligible — the reward is for a materially distinct WAF bypass method or payload.
- Equivalent encodings of the same bypass are duplicates, even if the first submission hasn’t been fixed yet.
Why this is useful even if you never play
The interesting signal here isn’t the flag; it’s the feedback loop. As the supplied RSS summary notes, AI is letting attackers find new vectors faster, so Cloudflare is collecting real-world attack data against its own rules instead of waiting for adversaries to do it. That’s a pattern worth copying in your own security work: put a deliberately breakable target behind your defenses and watch what actually gets through.
Two caveats from Cloudflare itself. First, participation requires agreeing to the HackerOne Bounty Terms, and Cloudflare can terminate the challenge at any time — check the HackerOne page before you start. Second, and more bluntly: a WAF is not a patch. Response blocking can stop data from leaving, but it can’t undo actions already executed at the origin. If you run PHP, tracking the PHP security advisories and applying updates is still the non-negotiable part; the CTF just tells you how much breathing room the WAF buys while you do.