Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.
Source: [Cloudflare Blog](https://blog.cloudflare.com/php-vulnerabilities-waf-protection/)