You might have noticed that yesterday (October 21st, 2026), two PHP 0-Day Vulnerabilities were released. Basically, anyone who is running VMs (or physical servers) that are running PHP needs to apply a patch to their PHP installation.
Anyone who was running in something like Azure App Services (or the AWS, GCP versions, etc.) or behind the Cloudflare WAF was automatically protected as soon as those vendors pushed updates to their platforms. This made updating these systems super easy; just wait for the vendor to implement their change. Once the vendors implemented their patch, the systems became safer. On the cloud vendor side (Azure, AWS, GCP) the fix was a patch to PHP itself since these vendors contol the actual version of PHP which is installed. With Cloudflare, they don’t control the actual PHP, but they were able to detect the specific calls that caused the problem, and they neutralized the call so that the corrupted call wouldn’t hit the actual server.
In either case, this shows the major benefits of using a Platform as a Service (PaaS) platform and/or a front-end WAF to protect the site.
Denny