Does a firewall like Cloudflare protect your WordPress website?
Cloudflare and Sucuri have firewall rules for the October 21, 2026 PHP bugs, and neither calls them the fix. What a firewall does, and what to ask.
A firewall, which is a filter in front of your site that blocks bad traffic, can stop known attacks on the two bugs fixed on October 21, 2026 in PHP, the software WordPress runs on behind the scenes. Cloudflare and Sucuri both have rules out for them, and neither calls that the fix: Sucuri says "WAF protection does not replace patching," and PHP says updating is the only safe choice. A firewall also only helps when your website's traffic actually goes through it.
The fix is an update to PHP on your server (the computer your website lives on), and your host installs it. Your host is the company you pay to keep your website online: GoDaddy, Bluehost, SiteGround and so on.
What is a firewall, in plain terms?
The kind of firewall that matters here is a web application firewall, or WAF. Visitors' requests pass through it on their way to your server, and it stops the ones that match attacks it knows about.
Sucuri, a website security company, puts the difference in one line: "The firewall blocks malicious requests it recognizes; a patched PHP build removes the vulnerable behavior" (Sucuri).
What have Cloudflare and Sucuri said?
| Cloudflare | Sucuri | |
|---|---|---|
| Rules for these bugs | On by default since 3:02 am UTC on October 21, on every plan with its firewall deployed, the entry plan included | New "virtual patching" rules, added to existing rules that were already blocking some of the attack patterns |
| Does it replace the PHP update? | No: "Customers should patch their PHP repos even with WAF protections" | No: "WAF protection does not replace patching" |
| Only works when | Your server accepts traffic only from Cloudflare (Cloudflare's CTO, as reported by Patchstack) | "requests pass through the firewall" |
Sources: Cloudflare, Sucuri and Patchstack. Cloudflare also asks customers on its Pro, Business and Enterprise plans to confirm its managed rules are deployed in block mode.
As of October 21, Cloudflare says it has seen attack traffic aimed at these bugs, and attackers changing their payloads to try to get past its rules (Cloudflare). CISA, the US government's cybersecurity agency, said in its October 21 alert that it "has not observed exploitation of these vulnerabilities as of the time of publication" (CISA). They don't contradict each other: one describes Cloudflare's own network, the other CISA's view on the day it published.
Why is a firewall a layer and not the fix?
A firewall blocks what it recognizes. Cloudflare's own post describes attackers reshaping their requests to slip past its rules, and its analysts updating the rules as new variations appear. An update to PHP removes the flaw itself, which is why Sucuri says website owners "should use both."
PHP, CISA and Cloudflare say the same thing in their own words:
-
PHP: "There are no complete mitigations, updating is the only safe choice" (php.net).
-
CISA: "A web application firewall may provide some protection until systems are updated or patched" (CISA).
-
Cloudflare recommends "applying the vendor update to your PHP repos as soon as possible while keeping the WAF protection enabled as an additional protection" (Cloudflare).
A security plugin inside WordPress is a different thing again. PHP's advisory says that on the server setup it considers riskiest, the attack can be triggered "before any application code runs" (php.net). On a WordPress website, WordPress and its plugins are that application code. Patchstack also advises against unofficial "fix" plugins and copy-pasted snippets (Patchstack).
What does "only if traffic goes through Cloudflare" mean for you?
Your website can be reached two ways: through your domain name, the one customers type, and through the server's own numeric address. A firewall service like Cloudflare only sits in front when your domain is pointed through it. If someone reaches the server directly, by its address or through an old web address that still points there, their requests skip the firewall.
Sucuri spells it out: "WAF protection only works when requests pass through the firewall. If attackers can connect directly to your origin server, they may bypass the virtual patching rules and send exploit traffic directly to PHP." Its checklist includes making sure old addresses and test copies of the site don't expose the server (Sucuri). Patchstack reports Cloudflare's CTO describing Cloudflare's rules as a stopgap that only helps "if your server accepts traffic exclusively from Cloudflare" (Patchstack).
You don't need to set any of this up yourself. Ask whoever manages your website:
Is our website behind a firewall service like Cloudflare or Sucuri today?
Does our server accept web traffic only through that firewall, or can it be reached directly?
Are the firewall's rules for CVE-2026-109618 and CVE-2026-109619 turned on and set to block?
When will PHP on our server be updated to a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or get a backported fix, and can you confirm it in writing?
The CVE numbers are the official IDs for these two bugs, so nobody has to guess which ones you mean. The fourth question is the one that settles it.
Should you add a firewall now?
It can be a sensible layer, and your web person can tell you whether it fits your website. CISA calls it "some protection until systems are updated or patched." Keep the order straight, though: the firewall buys time, and the PHP update on your server is the fix. Whatever you decide about a firewall, the question for your host stays the same, and the message to send them is on our WordPress advisory page.
Where does The Graphite Lab fit in?
The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. We build websites for trades businesses, and the first draft of a new site is ready for your review within 10 business days of payment. If you'd like to talk it over, book a call.