Update your PHP ASAP 🚨

Yes -- all levels of accounts (Free, Pro, Enterprise)

Cloudflare is helping protect yourdomain.com against php2shell

Cloudflare has deployed rules that help block known php2shell attacks. This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.

CWP updated PHP in 1.21, which is good.

Others still haven't released fixes. :/

FYI: If anyone doesn't know, Cloudflare's WAF is built using the OWASP CRS Ruleset as the base.
Just as many other's are as well, then tweaked.

Until a CWP update silently update the internal PHP to a 8.2+ version, is RECOMMENDED to close all the ports used by the panel.

Well, unless you live behind Cloudflare as I do. They already have mitigations in place to block malicious PHP2shell traffic. But yes, hopefully the devs get on to 8.3 or 8.5 for CWP's internal version. 7.2 is long past old in the tooth and more of the fossilized relic class.

Cloudflare indeed have protections agains this, but do nothing to protect CWP panel itself.
The mitigations from Cloudflare are only to the proxy domains - that you probably don't have in the URL of the server with CWP (and you shouldn't, since is not intended to that use and cause issues). Or even with the server IP access itself...
In fact, Cloudflare itself completly ignores the traffic in certain ports - like the 2087 and similar.

So:
Cloudflare CAN protect your websites.
Cloudflare DOESN'T protect your CWP panel or server, along with services in it, like RoundCube.


The lockdown at firewall level of all the ports continues to be RECOMMENDED