Introducing the Cloudflare PHP Capture the Flag challenge

Cloudflare has launched a PHP Capture the Flag challenge through its HackerOne bug bounty program, placing a deliberately vulnerable PHP 8.5.11 installation behind its WAF and inviting researchers to bypass protections for CVE-2026-109618 and CVE-2026-109619, exploit the sandbox, and recover the contents of /flag. Eligible submissions require a materially distinct WAF bypass method, a private HackerOne report with full reproduction details, and successful flag verification through the CTF UI. Testing is limited to POST requests against the challenge hostname's /php/* endpoints, and the challenge remains open per the Cloudflare HackerOne page.