May 4, 2026 · Cloudflare
WAF - WAF Release - 2026-05-04
This week's release focuses on new detections to expand coverage across command injection, SQL injection, PHP object injection, remote code execution, and XSS attack vectors.
Key Findings
- Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.
Continuous Rule Improvements
We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.
RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...f0884a68N/AXSS, HTML Injection - Object Tag - Body (beta)LogBlockThis is a new detection. This rule is merged into the original rule "XSS, HTML Injection - Object Tag" (ID: ...0c14e284).
Cloudflare Managed Ruleset...ff012303N/AXSS, HTML Injection - Object Tag - HeadersLogBlockThis is a new detection. The rule previously known as "XSS, HTML Injection - Object Tag - Headers (beta)" is now renamed to "XSS, HTML Injection - Object Tag - Headers".
Cloudflare Managed Ruleset...16f921d9N/AXSS, HTML Injection - Object Tag - URILogBlockThis is a new detection. The rule previously known as "XSS, HTML Injection - Object Tag - URI (beta)" is now renamed to "XSS, HTML Injection - Object Tag - URI".
Cloudflare Managed Ruleset...dc90d21aN/ACommand Injection - Generic 9 - Body Vector - BetaN/ADisabledThis is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - Body Vector" (ID: ...0677175f)
Cloudflare Managed Ruleset...f8960375N/ACommand Injection - Generic 9 - Header Vector - BetaN/ADisabledThis is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - Header Vector" (ID: ...1eb7a999)
Cloudflare Managed Ruleset...ef47a800N/ACommand Injection - Generic 9 - URI Vector - BetaN/ADisabledThis is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - URI Vector" (ID: ...97321c6c)
Cloudflare Managed Ruleset...beebf804N/ACommand Injection - Sleep - BodyN/ADisabledThis is a new detection. The rule previously known as "Command Injection
- Sleep" is now renamed to "Command Injection - Sleep - Body".
This is a new detection. This rule is merged into the original rule "Remote Code Execution - Common Bash Bypass Body" (ID: ...efb7e5b9). The rule previously known as "Remote Code Execution - Common Bash Bypass Beta" is now renamed to "Remote Code Execution - Common Bash Bypass Body".
Cloudflare Managed Ruleset...33bfe8b9N/APHP Object Injection - 2 - Body - BetaN/ADisabledThis is a new detection. This rule is merged into the original rule "PHP Object Injection - 2" (ID: ...161aafdc)
Cloudflare Managed Ruleset...29552387N/APHP Object Injection - 2 - HeadersN/ADisabledThis is a new detection.Cloudflare Managed Ruleset...8104f4c5N/APHP Object Injection - 2 - URIN/ADisabledThis is a new detection.Cloudflare Managed Ruleset...6a46201eN/ASQLi - DROP - 2 - BetaN/ADisabledThis is a new detection. This rule is merged into the original rule "SQLi - DROP - 2" (ID: ...48ac2221)
Cloudflare Managed Ruleset...8b7f85eeN/ASQLi - DROP - 2 - HeadersN/ADisabledThis is a new detection.Cloudflare Managed Ruleset...1546b5f0N/ASQLi - DROP - 2 - URIN/ADisabledThis is a new detection.Cloudflare Managed Ruleset...1e053dceN/ASmarterMail - Remote Code Execution - CVE:CVE-2026-24423LogBlockThis is a new detection.Cloudflare Managed Ruleset...d0023a36N/ASQLi - SELECT Expression - BodyBlockDisabledAction changedCloudflare Managed Ruleset...26cc211fN/ASQLi - String Concatenation - URIBlockDisabledAction changed