October 23, 2026 · Cloudflare

WAF Release - 2026-10-23 - Emergency - Cloudflare Free Ruleset

WAF
Security, identity and compliance

The existing PHP remote code execution rule in the Cloudflare Free Ruleset covers CVE-2026-115560. This emergency release adds the CVE identifier to existing rule. Detection logic and rule actions remain unchanged.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Free Ruleset...7975ce1bN/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6BlockN/ARule metadata description refined. Detection unchanged.

For more information, refer to WAF Managed Rules.

Read on developers.cloudflare.com

More WAF changes

Nov 3
Updated detections for PHP OOM CVEs; new disabled phpMyAdmin authentication bypass rule
Oct 30
New managed rule for Nuxt Image and IPX vulnerability, disabled by default, partial coverage
Oct 30
Updated detections for PHP out-of-memory vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560
Oct 28
Detection updated for PHP RCE rule covering CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560
Oct 25
Emergency release adds two Log-action rules for Brotli vulnerability CVE-2026-111497

All WAF changes