WAF - WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset

<p>This emergency release updates the names and metadata of seven existing rules in the Cloudflare Managed Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.</p> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="c1d409ad838f47f59446f21cc438d5dd"><button type="button" title="Copy rule ID" aria-label="Copy rule ID c1d409ad838f47f59446f21cc438d5dd" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...c438d5dd</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="f9a45927414245e3a64bb12d0a0c2f64"><button type="button" title="Copy rule ID" aria-label="Copy rule ID f9a45927414245e3a64bb12d0a0c2f64" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...0a0c2f64</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="771c654ae1154d4daa72f4e1545d163c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 771c654ae1154d4daa72f4e1545d163c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...545d163c</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="217005865f0145f392300bac212afcc9"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 217005865f0145f392300bac212afcc9" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...212afcc9</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="38efdb17ea594501bb55a1d71867b12e"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 38efdb17ea594501bb55a1d71867b12e" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...1867b12e</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="4148ae686fdb4d01be673fab9d9c073d"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 4148ae686fdb4d01be673fab9d9c073d" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...9d9c073d</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="1389aa259617437392ce149c48143645"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 1389aa259617437392ce149c48143645" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...48143645</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr></tbody></table> <p>For more information, refer to <a href="https://developers.cloudflare.com/waf/managed-rules/">WAF Managed Rules</a>.</p>