Cloudflare says a newly disclosed, serious PHP vulnerability called PHP2Shell is now blocked by its web application firewall, and the protection is free even on non-paid plans. It released the rule 9 hours before the public announcement. Cloudflare says WAF rules are only a supplementary measure, so if your website or shop runs PHP, check with your web developer or host and apply the PHP patch as soon as possible. Only Cloudflare-protected sites get this WAF cover.