Cloudflare Launches PHP Capture The Flag Challenge On HackerOne

Cloudflare just launched a new Capture the Flag challenge on HackerOne after severe php2shell vulnerabilities rocked the web last week. Security researchers are invited to bypass WAF protections and recover a hidden file called slash flag on a sandboxed target running stock PHP version 8.5.11 and Apache 2. Artificial intelligence allows attackers to discover new vectors with unprecedented speed, making real-world data collection essential for defense. The challenge focuses specifically on CVE-2026-109618 and CVE-2026-109619. Meanwhile, CISA confirmed that the php2shell flaws are already under active attack while researchers clock successful exploits in the wild. Participants must demonstrate remote code execution through an authorized POST request and submit a private report with their complete payload. Cloudflare notes that its WAF is not a substitute for patching vulnerable software and urges admins to follow the latest security advisories.