Cloudflare

OPEN SECURITY RESEARCH / WAF BYPASS CHALLENGE

PHP Capture the Flag (CTF) challenge

CVE-2026-109618 & CVE-2026-109619

Refer to our blog announcement for more information.

The challenge focuses on CVE-2026-109618 and CVE-2026-109619, the two PHP vulnerabilities behind php2shell. The target runs stock PHP 8.5.11 (with standard PHP extensions), Apache 2 (via mod_php), and an empty index.php inside a Cloudflare Container, with our default WAF protection rules for these vulnerabilities enabled in front of it. Inside the sandbox is a file called /flag.

The sandbox is reset every few minutes, including the flag file.

Your mission, should you choose to accept it: bypass the WAF protections, exploit the PHP sandbox, and recover the contents of /flag. You can use your own research tools. Testing is authorized only against the challenge hostname's WAF-protected /php/* endpoints (POST method only).

Example upload-progress probe against the WAF-protected target. Replace payload.bin with your test file; this request alone does not demonstrate exploitation or a WAF bypass.

curl -i 'https://sven-php-research-ctf.that-test.site/php/index.php' \
  --cookie 'PHPSESSID=researchdemo00000000000000' \
  --form-string 'PHPSESSID=researchdemo00000000000000' \
  --form 'upload=@./payload.bin;filename="<?php echo 1337; ?>"'

Verify your exploit

After exploiting the PHP sandbox through the WAF-protected target, read /flag inside the sandbox and enter its value here. The server checks the sandbox’s flag; getting past the WAF or receiving an HTTP success response alone does not confirm exploitation.

If your exploit is confirmed, we’ll generate a unique confirmation permalink that you can share with anyone. The record will show the payload used and be visible to anyone with the link, so use test data only and keep secrets and personal information out of your requests.

View an example exploit record →

Use the X-Attempt-ID response header from your payload request. This associates the flag claim with the payload you want to share.

Paste only the flag value, without the terminal’s trailing newline. It is sent for verification, not included in the share link. Submit before the sandbox resets; an earlier flag may no longer match.

Competition requirements

This challenge is run via Cloudflare's Bug Bounty program on HackerOne. All aspects of this challenge are subject to HackerOne terms and the Cloudflare HackerOne program rules the (“Bounty Terms”). If you find a bypass, you must follow these requirements in order to claim the bounty:

  1. All participants must sign up for a HackerOne account and review and agree to the Bounty Terms before participating in the CTF.
  2. Demonstrate attacker-controlled PHP code or command execution inside the sandbox through an authorized POST request.
  3. Use that RCE to recover the current contents of /flag, then successfully verify the flag through the CTF UI. Verify promptly before a reset; retain the successful result for later review.
  4. Submit a private report to Cloudflare on HackerOne. Include PHP CTF in the title and provide:
    1. The endpoint, complete payload, and request sequence, preserving relevant headers, encoding, and body bytes.
    2. Raw request/response captures or a readable PoC sufficient to reproduce the full chain.
    3. An explanation of the WAF bypass, executed code or command, and how that execution recovered /flag.
    4. The attempt ID, successful UI verification result, and exploit/verification UTC timestamps. Include the flag privately if needed for verification.
    5. What makes the method or payload materially distinct, and related submissions you know about.

UI verification does not submit a HackerOne report or establish reporting priority. File disclosure without RCE, RCE without successful flag recovery and UI verification, local-only exploits, rediscovery of the known PHP vulnerabilities, and WAF detection differences or partial chains without the full objective are not eligible.

Awards require a materially distinct bypass method or exploit payload, even for the same PHP CVE. New flags, resets, attempt IDs, or cosmetic changes—including equivalent encodings—do not qualify as unique. Equivalent submissions are duplicates even if unfixed; only the first complete, reproducible HackerOne report is considered. Cloudflare makes final duplicate and reward decisions.

We record attempted metadata and request payloads to help analyze reports, so please use test data only. Do not send credentials, personal information, or anything else you would not want included in a research record. Read the site's privacy notice before testing.

Testing is authorized only against the challenge hostname's WAF-protected /php/* endpoints (POST method only). Other Cloudflare services, direct access to the underlying infrastructure, the upstream PHP project, and third-party systems are out of scope. No denial of service, high-volume scanning, persistence, social engineering, or attacks on other participants. If you get a 429 or 503, back off.

In the event of any conflict between this blog post and the Bounty Terms, the Bounty Terms shall prevail.

Cloudflare reserves the right to suspend or terminate this challenge at any time; once the competition is removed from HackerOne, it is officially terminated, so please refer to the Cloudflare HackerOne page for the most up-to-date information on whether this challenge remains open.