On November 3, 2026, Cloudflare launched Zero Wire, a hub in the security section of Cloudflare Radar that collects explainers on critical vulnerabilities. It brings together affected products and environments, recommended actions, the reasoning behind each assessment, and update histories, and it also provides prompts that support AI-assisted vulnerability assessments. It is free to use, including for people who are not Cloudflare customers, and offers a new source for turning public vulnerability information into investigations of your own environment.
However, Zero Wire's listing categories show how information has been organized. They are not the same as whether a vulnerability is actually being exploited, or whether it has been fixed in your own environment. Confusing them can lead to mistakes in setting response priorities or judging whether a fix is complete. To make practical use of Zero Wire, it is important to check public information against the software that is actually running.
Consolidating critical vulnerability information and connecting it to concrete action
According to Cloudflare's announcement, Zero Wire covers important vulnerabilities affecting internet-facing web applications and runtime environments, as well as libraries and various services. Coverage is not limited to vulnerabilities that Cloudflare's WAF (web application firewall) can defend against. A WAF inspects traffic to web applications to block attacks, but Zero Wire addresses vulnerabilities it considers important regardless of the scope of such protections.
On the Zero Wire page, you can open a detailed explainer from each vulnerability's card. Search is available by CVE (Common Vulnerabilities and Exposures) ID, name, or technical-area tag, and you can look up an overview of the issue, its scope of impact, and recommended actions. Each explainer also includes the reasoning behind the assessment and an update history, so the people responsible can trace where the information came from and what has changed.
Zero Wire is not, however, a database covering every CVE. For vulnerabilities that are not listed, you cannot conclude that your systems are safe, and you still need to check vendor security advisories against your own assets. Zero Wire's role is to organize information on important vulnerabilities and gather clues for investigation and response in one place.
"Needs attention," "exploitation confirmed" and "fixed" are separate pieces of information
Zero Wire sorts vulnerabilities into "Needs attention" and "Reference." The former covers items that call for active investigation or response; the latter covers items whose response guidance has stabilized. Cloudflare explains that moving to Reference does not mean the fix has been completed on every affected system. In other words, the information provider's classification must be distinguished from the user's own state of response.
The same applies to attack observation data. For example, the number of HTTP requests matching a WAF rule does not indicate how many attacks succeeded or how many systems were compromised. And even if no exploitation was confirmed within Cloudflare's visibility, that does not mean attacks are not occurring elsewhere.
Zero Wire's listing category, evidence that supports actual exploitation, and the patch status of the software each need to be checked independently. The table below organizes public materials retrieved on November 5, 2026: Cloudflare's classification, exploitation information from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), and fix information from the official PHP project. Using the vulnerabilities covered by the php2shell assessment prompt as an example, it compares what each source can and cannot tell you.
| Indicator / evidence | What it tells you | What it does not tell you on its own |
|---|---|---|
| Needs attention / Reference | Cloudflare's judgment on the need for investigation or response, and how stable the guidance is | Impact on your organization or whether a fix is complete |
| Requests matching WAF rules | Traffic matching the relevant rule that Cloudflare observed | Number of compromised systems, number of successful attacks, or exploitation outside its visibility |
| Listing in CISA's KEV | That CVE-2026-109618 and CVE-2026-109619 were added on October 26 to the catalog of vulnerabilities with confirmed exploitation | Whether your organization was compromised, or whether the later CVE-2026-115560 has similar evidence of exploitation |
| PHP fixed versions and conditions | The fixed versions for the first two issues and the conditions under which the later one occurs, as described in the official PHP announcements | Whether the fix has been applied to the PHP you run, and whether processes have been updated |
Even if a fixed version has been released and Zero Wire classifies the item as Reference, outdated software may still be running in your environment. Conversely, a small number of observed attacks is no reason to put off a fix. Public information alone cannot determine whether an individual organization has been compromised or patched; you need to check the actual running environment.
The PHP assessment prompt checks the actual running environment
The AI assessment prompt in Zero Wire's php2shell entry instructs the AI to investigate three related CVEs individually for impact, patch status, and evidence of exploitation. The investigation is limited to read-only operations within the scope of authorized access. Sending attack payloads, operations that exhaust memory, and configuration changes are prohibited, and simply copying the prompt does not automatically start scanning or remediation. The accuracy and scope of the assessment depend on the access the AI is given and the evidence it can obtain.
PHP is a runtime environment that powers web applications such as WordPress, and updating an application does not necessarily fix vulnerabilities in PHP itself. On October 21, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix CVE-2026-109618 and CVE-2026-109619. CISA added these two to its KEV (Known Exploited Vulnerabilities) catalog on October 26, treating them as vulnerabilities with confirmed exploitation.
The later CVE-2026-115560, by contrast, arises under different conditions. According to the PHP project's October 23 advisory, the issue occurs under a special set of circumstances: the upload progress feature is enabled and the application switches the session serializer at runtime. Addressing the first two vulnerabilities therefore does not mean all related problems are resolved. Configuration and application behavior must be checked separately.
Nor can you conclude that CVE-2026-115560 is being exploited just because the first two are listed in KEV. The materials retrieved as of November 5 do not confirm exploitation of the later vulnerability, but that does not prove exploitation does not exist. The existence of a vulnerability, evidence of exploitation, and the status of fix deployment must each be assessed on separate grounds.
What the php2shell assessment prompt emphasizes most is checking the state of the PHP that is actually handling web requests. The version shown by the command-line (CLI) build, settings recorded in a source code repository, or unused container images are not enough to judge the safety of the running environment. After an update, the prompt instructs the AI to check the live processes as well as any replicated runtime environments. The aim is to distinguish records of file or image updates from evidence that the processes handling requests have switched to the fixed version.
Finding an old version number does not, however, mean immediately concluding that the system is vulnerable. Vendors such as Linux distributions may "backport" security fixes into existing versions. A simple version comparison is therefore not enough; you need to check the vendor's fix information against the actual running environment.
Beyond WAF protection: tracking fixes and update status
When checking WAF protection, the existence of a corresponding rule is not sufficient either. The php2shell assessment prompt instructs the AI to separately confirm whether the target traffic passes through Cloudflare's proxy, whether the WAF rule is set to "Block," and whether any exceptions or bypass routes exist. Even where links to settings screens are provided, they do not by themselves complete the work of enabling a rule or confirming protection.
A WAF is a complementary measure that blocks attacks on the traffic it covers; it does not fix the vulnerable software itself. If a system may already have been compromised, that needs to be investigated separately. Alongside checking WAF settings, it is important to apply the PHP fixes and to confirm that updated processes have actually switched to the fixed version.
Zero Wire also provides ways to track updates to vulnerability information. RSS feeds are available for the whole site or by tag, and according to the official Cloudflare Radar changelog, updates can also be found under "Caught on Radar" on the home screen. Combined with each vulnerability's update history, this lets you see whether recommended actions or impact conditions have changed from the original guidance.
Zero Wire's value lies in more than simply listing critical vulnerabilities. It connects new advisories and exploitation information to the software and settings you actually run, leading to the necessary investigation and remediation. What ultimately matters is building an operating process that goes beyond following updates to public information and confirms that countermeasures are complete in the actual running environment.