In short
A WAF (Web Application Firewall) is a layer in front of a site or shop that checks every incoming request and blocks the ones that look like an attack - for instance, an attempt to slip a foreign command into the database or run outside code. It works by rules: known attack patterns get stopped automatically.
The distinction that confuses people: a WAF doesn't fix the bug in the code. The hole stays exactly where it was. The WAF just stands in front of it and won't let the attack through - like a guard in front of a broken lock. That's why providers like Cloudflare push out "managed rules" the moment a new vulnerability appears. They buy everyone time to update.
A fresh example is PHP. According to Cloudflare, its rules against the two critical holes in the language went out about nine hours before the public announcement, and since October 21, 2026 they are on by default on all plans, the free one included. What is new is that it now looks at the server's response too, not only the request: that is how an attack that succeeded is told apart from ordinary traffic. Cloudflare itself says what this node says: the fix remains updating PHP, and the protection is an extra layer while you do it.
So it should never replace the patch. The shield only guards against the known form of the attack, and only while you stand behind it. Pull the site out from behind the WAF-based shield, or let attackers come up with a new variant, and only one thing is left that actually closes the hole. Updating.
Primary sources
Cloudflare: protections against php2shell (CVE-2026-109618, CVE-2026-109619), 21.10.2026OWASP: Web Application Firewall (definition)The visual is generated code-art, no third-party images.