Introducing the Cloudflare PHP Capture the Flag challenge

Cloudflare launched the PHP Capture the Flag challenge on HackerOne.
The CTF focuses on CVE-2026-109618 and CVE-2026-109619, the vulnerabilities behind php2shell.
The target environment runs stock PHP 8.5.11, Apache 2 via modphp, and an empty index.php in a Cloudflare Container.
Default WAF protection rules for these vulnerabilities are enabled on the target sandbox.
Participants must demonstrate attacker-controlled PHP code execution inside the sandbox via authorized POST requests.
Success requires RCE leading to recovery of /flag contents and verification through the CTF user interface (UI).
The challenge is limited-time and subject to HackerOne Bounty Terms.
Testing scope is restricted to WAF-protected /php/* endpoints using the POST method only.
WAF rule changes are detailed in the Cloudflare WAF changelog.
Previous events included eight eMudhra intermediate certificates being compromised and php2shell outbreaks.

The narrative positions an active security challenge as a proactive defense mechanism, framing bug bounty participation not merely as exploitation, but as collaborative fortification of the broader internet infrastructure. The initial setup—a deliberately vulnerable target behind state-of-the-art protections—creates a controlled laboratory environment. This structure inherently invites high expertise in offensive security, yet it simultaneously functions as advanced product testing for Cloudflare's WAF capabilities against known vectors (php2shell).
The underlying assumption being sold is that sophisticated protection requires constant adversarial pressure; defense is not static. However, the reliance on capturing a 'materially distinct Firewall (WAF) bypass method' subtly funnels effort toward lateral evasion rather than deep architectural flaw discovery in PHP itself. Furthermore, framing the activity within the context of AI acceleration creates a sense of urgency and crisis—a "fear appeal"—lending existential weight to what is functionally a penetration test contest. The distinction between earning a reward for a novel bypass versus simply demonstrating a successful exploit on old CVEs highlights an organizational prioritization: novel defense methodology outweighs mere vulnerability proofing, which guides research focus toward obscurity rather than root cause remediation across the ecosystem.
Patterns detected: ARC-0054 Authority Game (Vendor selling its mitigation efficacy via controlled competition), ARC-0028 Fear Appeal (Leveraging high-profile threats like AI acceleration to mandate engagement).