PHP patches remain necessary alongside Cloudflare WAF protections
The news at the time
The PHP project lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixes for the critical remote-code-execution vulnerabilities disclosed at the time.
Cloudflare says customers should patch PHP even when its WAF provides an additional defensive layer.
Follow-up checked during renewal
In its later update, Cloudflare limits protection against the related upload-progress issue to the default field name; changing session.upload_progress.name falls outside that WAF rule.
What to review before applying this
Review the deployed PHP build and distribution backports separately from WAF coverage. Check upload-progress configuration before treating the later mitigation as applicable. These are review suggestions; no application was tested.
Editorial review suggestions; no hands-on product experiment was performed.
Claim-by-claim source evidence
The PHP project lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixes for the critical remote-code-execution vulnerabilities disclosed at the time.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities
Evidence source ↗
Cloudflare says customers should patch PHP even when its WAF provides an additional defensive layer.
Customers should patch their PHP repos
Evidence source ↗
In its later update, Cloudflare limits protection against the related upload-progress issue to the default field name; changing session.upload_progress.name falls outside that WAF rule.
Customers who have changed session.upload_progress.name are not covered by the WAF rule.
Evidence source ↗
Korean digest for the historical date: 2026-10-22. Quotations and source context were reviewed editorially; this is not an independent experimental verification.
Discussion