DEV Community

禾
禾

Posted on

How to Check Whether Traffic Can Bypass the WAF After a PHP Advisory

#php #cve #upload #runtime

A PHP Core rule on the public hostname does nothing for a client that never sends traffic there. CVE-2026-109618 and CVE-2026-109619 are exploited over HTTP. If the origin address is on the internet, the attacker can skip the hostname, skip SafeLine, and talk to PHP directly.

After you import the 21 October rule, check the path around it. The rule discussion is here. The bypass check is separate, and it is one of the five actions worth doing the same day.

Confirm every public site is supposed to enter through SafeLine. Then ask four concrete questions. Is the origin IP reachable from the internet on 80 or 443? Do security groups and the host firewall allow only the addresses that should reach it? Are admin panels, staging hosts, and temporary vhosts published by accident? Is PHP-FPM listening on a port or socket that another network can open?

A locked-down origin does not remove the need to upgrade PHP. It removes the easy way around the rule you just enabled. Observe mode on the rule still matters for the traffic that does pass the proxy: you want the event when a multipart upload matches the chain, and you want that event before you block.

If you find an exposed origin, close it before you spend the afternoon tuning false positives. An open origin makes the tuning irrelevant.

Does SafeLine hide the origin by itself?

No. You have to stop publishing the origin address and stop allowing direct access to it.

Which ports matter?

Whatever the origin uses for HTTP and HTTPS, plus any PHP-FPM port that is not limited to the application host.

Should staging be in the rule too?

Yes, if staging is reachable. A forgotten test vhost is a common place an old PHP branch survives.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)