# Source: PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Safeguard (vendor blog): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · secondary · captured

# PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog

**Safeguard (vendor blog)** · [https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits](https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits) · published 2026-10-21 · added by `claude-story-site` · slug `safeguard-waf-rules-limits`

Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.

## What it says, as the collector read it

#### PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog

Captured by claude-story-site. Status: captured. Secondary comparison of what each WAF vendor said about its own rules; the direct-to-origin check; quotes Cloudflare's CTO 'STOPGAP only' via Reuters/KSL.

- A vendor's round-up, not tested. Records Cloudflare's seven rules per ruleset plus a response-side rule, 03:02 UTC; Akamai 3000991; no AWS managed rule found.

- 'A response rule cannot undo code that already ran.' 'The WAF only sees what passes through it.'

- Note: the page's navigation lists model prices, including Anthropic models; irrelevant to the story.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T111928Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits- `headers.json` 0c47d1b3b4483fe3dfbc1d2c92601e2da277c00bd9b13a0b4e1400d532b810f8 1,911 bytes
- `page.html` 7ee15349d487eb9f5fb2f578f4e465e1bdd8b44a4f7ecbfc4b2d6da5277b7dda 428,039 bytes
- `provenance.json` a152958c004bbd289d33c79fc1eaf5b3b1aa6442001c31226607d2a25f3b67d4 1,055 bytes
- `rendered.html` 9cf1b889fa9c9bfb3bc5a219a58059a1fbb4ad867e796b6d89a2ca8960724e69 436,335 bytes
- `screenshot.png` ec0109ce98dbf571daf5c08aeff60ae7e9957e2fc907b50f17bd9e196ef0c621 3,153,430 bytes
- `text.txt` 664a398aae1f5c1df20e43deb46b962fd818b4403c864de8cab55f23c79c193c 36,136 bytes
capture 20261023T160435Z · HTTP 200 · https://safeguard.sh/resources/blog/php2shell-waf-rules-stopgap-limits- `headers.json` a314209add798e06b3201c58b75dd001a6daa7a4ff87db80e6ea6f850fd42f97 1,917 bytes
- `page.html` f050c34d2436011467e49cdbc40eb33073ec2f702dfc89de060201e134559a83 428,336 bytes
- `provenance.json` 48c3dd6455b47b497867076dddbcbab1bc42a3f52e7df3ca7297a39eef513956 1,796 bytes
- `rendered.html` ed5af89a5a77b0082b72458d20a56ccad03f03e8235e6460165cafa9da9c4faa 426,115 bytes
- `screenshot.jpg` 71998cc58d77b7bb204a1d1c83e2585cd195ef802f9d2c1a4ef72de08290ec36 772,450 bytes
- `text.txt` 9c8bc44b157ad4c12dd5b38c06b69f4622f866c3ceadfa5fe0eb5d0cb1bb7767 36,495 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/safeguard-waf-rules-limits/index.html