WAF - WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset

This emergency release updates the names and metadata of seven existing rules in the Cloudflare Free Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Free Ruleset...b5ccf32fN/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)BlockN/ARule metadata description refined. Detection unchanged.Cloudflare Free Ruleset...bcd95984N/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2BlockN/ARule metadata description refined. Detection unchanged.Cloudflare Free Ruleset...82dab691N/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3BlockN/ARule metadata description refined. Detection unchanged.Cloudflare Free Ruleset...24b1a4c6N/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4BlockN/ARule metadata description refined. Detection unchanged.Cloudflare Free Ruleset...302ede46N/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5BlockN/ARule metadata description refined. Detection unchanged.Cloudflare Free Ruleset...7975ce1bN/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6BlockN/ARule metadata description refined. Detection unchanged.Cloudflare Free Ruleset...e8d613faN/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7BlockN/ARule metadata description refined. Detection unchanged.

For more information, refer to WAF Managed Rules.