Cloudflare on Oct. 21, 2026, added two capabilities to its web application firewall that look at what an origin server sends back, not only at what comes in. Full transaction detections evaluate each HTTP request together with its response for evidence that an exploit worked, and response rules can block the origin’s reply before it reaches the requester. In its announcement , Cloudflare said both are generally available to all customers, including Free plans, and that its first managed protections built on them address the php2shell flaws in PHP.

PHP shipped emergency releases on Oct. 21 for CVE-2026-109618 and CVE-2026-109619, two runtime bugs that can allow unauthenticated remote code execution, after Cloudflare had already seen attack traffic, as WebProNews reported earlier . The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP advisory .

What the response check adds

A request-only WAF has to guess whether a suspicious input did any harm.…