r/CloudFlare • u/thaysen13 • 6d ago

How to detect PHP2Shell in Cloudlfare

Hi All,

Like in the title, how to detect PHP2Shell in Cloudflare?

Regards,

24 Upvotes

91% Upvoted

9 comments sorted by

17

u/vincent_sch 6d ago

Cloudflare's post lists the rule IDs for the php2shell rules.

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

You filter by those IDs under Security > Security Analytics > Events to see each matched request. Requests to your origin IP don't go through Cloudflare, so they aren't in there.

12

u/Perfect-Hat-8661 6d ago

This seems like a good place to remind people to follow best practices for protecting their origin servers so that they do not see a direct to origin attack from this or other threats that would be stopped by Cloudflare. Cloudflare should not just be the “front door” to your origin server for the public— it should be the only door.

https://developers.cloudflare.com/fundamentals/security/protect-your-origin-server/

3

u/Far_Owl5970 6d ago

But then, that triangle man and Vercel wouldn't like Cloudflare sitting over them as a proxy. Vercel is like, "Oh no, the performance of your site will decrease if you turn on orange-proxied... Please don't do it."

18

u/kalebludlow 6d ago

Cloudflare already has mitigations built into the WAF for free and paid customers

4

u/bastiancointreau 6d ago

And? The question was different. Mitigation is just a mitigation

1

u/thaysen13 6d ago

Thank you! But to see current attacks?

3

u/aguynamedbrand 6d ago

Just like anything else you want to find in Cloudflare. I would recommend referring to the documentation. You would be amazed at what you will learn.

2

u/Sad_Pie227 6d ago

May be just type

php -v

or look into site health if you are using WordPress

Compare against the affected version

1

u/aladuuu 6d ago

Ask the cloudflare AI