WAF Release - 2026-11-03

This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative changes based on reports from Security Researchers as part of PHP Capture the Flag (CTF) challenge ↗︎.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Free Ruleset...bcd95984N/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2BlockBlockRule detection updated.Cloudflare Free Ruleset...82dab691N/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3BlockBlockRule detection updated.Cloudflare Managed Ruleset...0a0c2f64N/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2BlockBlockRule detection updated.Cloudflare Managed Ruleset...545d163cN/APHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3BlockBlockRule detection updated.Cloudflare Managed Ruleset...13f91633N/AphpMyAdmin - Authentication BypassN/ADisabledThis is a new detection.