'%3e%3crect%20x='16'%20y='51'%20width='68'%20height='27'%20rx='13.5'/%3e%3ccircle%20cx='32'%20cy='53'%20r='15'/%3e%3ccircle%20cx='53'%20cy='43'%20r='20'/%3e%3ccircle%20cx='71'%20cy='57'%20r='12'/%3e%3c/g%3e%3c/svg%3e){kind=small}
Cloud Changelog
WAF changelog
136 announcements since January 2025 · 2 previews
Free. One email a day, only on days when something you follow has an announcement, or one a week if you switch it in your preferences. You confirm your email with a one-time code; there is no password.
October 202615
New managed rule for Nuxt Image and IPX vulnerability, disabled by default, partial coverage
Detection updated for PHP RCE rule covering CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560
Emergency release adds two Log-action rules for Brotli vulnerability CVE-2026-111497
Emergency update renames seven PHP remote code execution rules to cite two CVEs; detection unchanged
Emergency update renames seven PHP remote code execution rules to cite two CVEs; detection unchanged
Emergency release adds seven Anomalous Execution rules with Block action
Emergency release adds seven Anomalous Execution rules with Block action
New block detections for TanStack XSS CVE-2026-102989 and Atlassian file access CVE-2026-21589
Beta Directory Traversal rule to merge into original rule on 2026-10-19, in Log mode
New detection for F5 BIG-IP CVE-2026-94127; command injection beta rule merged into baseline
New block rule for Citrix NetScaler ADC and Gateway command execution flaw CVE-2026-88771
September 202610
New rules for GitLab CVE-2026-85706 path traversal and generic request smuggling detections
New block rules for WordPress and JFrog Artifactory vulnerabilities, including three CVEs
New blocking detections for SSRF non-standard IP notations, jar loopback and Jinja SSTI
New block rule for Adobe Commerce and Magento remote code execution, CVE-2026-75650
Two beta Next.js RCE rules merged into baseline rules, action changed from Log to Block
Early Access detection logs signature matches without applying a mitigation actionPreview
Updated PII detection categories; WAF rules using removed or renamed categories no longer match
New managed rule blocks SQL injection using WHERE comparisons combined with WITH clauses
August 20267
July 20265
New rules for ColdFusion, Next.js and WordPress CVEs, plus updated SSRF, LFI and XSS detections
Emergency release adds managed rules blocking unauthenticated RCE and SQLi in popular web frameworks
New rules block Citrix NetScaler CVE-2026-8451 and Kemp LoadMaster CVE-2026-8037 exploits
New rule for Fortinet FortiSandbox CVE-2026-39813; fake Bing bot rule changes from Block to Disabled
June 20264
New rule blocks Ivanti Sentry command injection, CVE-2026-10520
Cloudforce One threat intelligence fields (cf.intel.ip.) usable in custom and rate limiting rules
New rules for Ghost CMS SQLi CVE-2026-26980 and obfuscated boolean SQLi
New detections for Drupal, Mirasvit Cache Warmer and Axios CVEs plus obfuscated SQLi rules