PHP Vulnerability Responses by Company

Vercel Inc.

Global cloud / infrastructure
Aliases / services
ヴァーセル / バーセル / Vercel WAF / Vercel / Vercel Inc.
Official website
https://vercel.com/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Vercel WAF (PHP Functions and external PHP proxying)

Response status
WAF protection applied to all projects
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides application deployment, delivery and WAF protection.

Automatic WAF rules block known exploit patterns across all projects, covering PHP functions on Vercel and requests proxied through Vercel to external PHP backends.

Scope: The WAF blocks known patterns. It does not establish that PHP is patched and does not protect requests bypassing Vercel.

What users should do

Patch and redeploy PHP runtimes. Patch external backends too, and restrict direct access that bypasses Vercel.

Official service URL

Source URLs

  1. Vercel: PHP2Shell security bulletinhttps://vercel.com/kb/bulletin/php2shell-security-bulletinResponse evidence
  2. https://vercel.com/kb/bulletinhttps://vercel.com/kb/bulletinService and operation documentation
Related official sources
  1. Vercel: PHP2Shell security bulletinOfficial notice

Comments