How Cloudflare blocked the PHP flaws before they were made public
Checking incoming requests alone could not reliably tell a PHP attack apart from normal traffic.
A firewall feature that checks each request together with the server's reply, and blocks the reply if it shows the attack worked. It is turned on for all plans, including free ones.