Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Source · vendor · secondary · captured

PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog

Safeguard (vendor blog) · https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits · published 2026-10-21 · added by claude-story-site · slug safeguard-waf-rules-limits

Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.

What it says, as the collector read it

PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog

Captured by claude-story-site. Status: captured. Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.

  • A vendor's round-up, not tested. Records Cloudflare's seven rules per ruleset plus a response-side rule, 03:02 UTC; Akamai 3000991; no AWS managed rule found.
  • 'A response rule cannot undo code that already ran.' 'The WAF only sees what passes through it.'
  • Note: the page's navigation lists model prices, including Anthropic models; irrelevant to the story.

Claims that cite it

No claim cites this source yet.

Events that cite it

No timeline event cites this source yet.

The bytes

capture 20261022T111928Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits
  • headers.json 0c47d1b3b4483fe3dfbc1d2c92601e2da277c00bd9b13a0b4e1400d532b810f8 1,911 bytes
  • page.html 7ee15349d487eb9f5fb2f578f4e465e1bdd8b44a4f7ecbfc4b2d6da5277b7dda 428,039 bytes
  • provenance.json a152958c004bbd289d33c79fc1eaf5b3b1aa6442001c31226607d2a25f3b67d4 1,055 bytes
  • rendered.html 9cf1b889fa9c9bfb3bc5a219a58059a1fbb4ad867e796b6d89a2ca8960724e69 436,335 bytes
  • screenshot.png ec0109ce98dbf571daf5c08aeff60ae7e9957e2fc907b50f17bd9e196ef0c621 3,153,430 bytes
  • text.txt 664a398aae1f5c1df20e43deb46b962fd818b4403c864de8cab55f23c79c193c 36,136 bytes
capture 20261023T160435Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits
  • headers.json a314209add798e06b3201c58b75dd001a6daa7a4ff87db80e6ea6f850fd42f97 1,917 bytes
  • page.html f050c34d2436011467e49cdbc40eb33073ec2f702dfc89de060201e134559a83 428,336 bytes
  • provenance.json 48c3dd6455b47b497867076dddbcbab1bc42a3f52e7df3ca7297a39eef513956 1,796 bytes
  • rendered.html ed5af89a5a77b0082b72458d20a56ccad03f03e8235e6460165cafa9da9c4faa 426,115 bytes
  • screenshot.jpg 71998cc58d77b7bb204a1d1c83e2585cd195ef802f9d2c1a4ef72de08290ec36 772,450 bytes
  • text.txt 9c8bc44b157ad4c12dd5b38c06b69f4622f866c3ceadfa5fe0eb5d0cb1bb7767 36,495 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →