Cloudflare reports early exploitation attempts against two critical unpatched PHP flaws; emergency WAF rules deployed
Cloudflare warned that attackers are already attempting to exploit two critical PHP vulnerabilities ahead of an official fix. The PHP Foundation rated both flaws CVSS v4 9.2 and scheduled a security release for 21 October 2026 at 14:00 UTC. Cloudflare CTO Dane Knecht said emergency WAF rules covering known exploit vectors are live for all…