Cloudflare adds full-transaction PHP2Shell protection

Cloudflare is turning the WAF from a request filter into an exploit-outcome detector—a meaningful upgrade as attackers increasingly adapt payloads in real time.

• –Coverage across free plans makes emergency virtual patching broadly accessible.
• –Response inspection can distinguish suspicious requests from confirmed exploitation more accurately.
• –Blocking the response prevents data exposure, but cannot undo actions already executed at the origin.
• –Developers must still patch PHP and prevent direct origin access; WAF protection is defense in depth.
• –The approach could extend beyond PHP2Shell to data exfiltration and other exploit-confirmation scenarios. [Full transaction detection](https://blog.cloudflare.com/full-transaction-waf)