WAF - WAF Release - 2026-09-15

<p>This release introduces new threat detections to enhance protection against command injection attempts, Server-Side Request Forgery (SSRF) targeting cloud metadata, and information disclosure within version control history.</p> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="b2170b7b1a2c4b8eba0b498eca453d31"><button type="button" title="Copy rule ID" aria-label="Copy rule ID b2170b7b1a2c4b8eba0b498eca453d31" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...ca453d31</span></button></span></td><td>N/A</td><td>SSRF - Cloud - 3</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="02c818297e6d42aaa55e67f5e540f17f"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 02c818297e6d42aaa55e67f5e540f17f" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...e540f17f</span></button></span></td><td>N/A</td><td>Version Control - Information Disclosure - Beta</td><td>Log</td><td>Block</td><td>This rule is merged into the original rule &quot;Version Control - Information Disclosure&quot; (ID: <span class="rule-id" data-rule-id="23548ee2b36547a1be09bb2c0550c529"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 23548ee2b36547a1be09bb2c0550c529" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...0550c529</span></button></span>).</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="93793848937f4f988f1dfdabba458b4b"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 93793848937f4f988f1dfdabba458b4b" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...ba458b4b</span></button></span></td><td>N/A</td><td>Command Injection - Generic 10</td><td>Log</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="9c8dda9708cc4452ac76e7be7b58420b"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 9c8dda9708cc4452ac76e7be7b58420b" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...7b58420b</span></button></span></td><td>N/A</td><td>XSS, HTML Injection - Script Tag</td><td>Block</td><td>Block</td><td>Reverts the detection changes introduced on August 25, 2026</td></tr></tbody></table>