WAF - WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset

<p>This emergency release updates the names and metadata of seven existing rules in the Cloudflare Free Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.</p> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="4e315666e8e344cdb64119a3b5ccf32f"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 4e315666e8e344cdb64119a3b5ccf32f" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...b5ccf32f</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="00c10e6cc4da4bd08722adeebcd95984"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 00c10e6cc4da4bd08722adeebcd95984" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...bcd95984</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="48ddf592361e4fdb97a8a85982dab691"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 48ddf592361e4fdb97a8a85982dab691" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...82dab691</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="3556683d512a47f2937899c524b1a4c6"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 3556683d512a47f2937899c524b1a4c6" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...24b1a4c6</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="da07c85852e34625bb478496302ede46"><button type="button" title="Copy rule ID" aria-label="Copy rule ID da07c85852e34625bb478496302ede46" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...302ede46</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="19373a83abb840e18ab3ce5a7975ce1b"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 19373a83abb840e18ab3ce5a7975ce1b" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...7975ce1b</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="07f0b6ddaabf40b1b2042dade8d613fa"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 07f0b6ddaabf40b1b2042dade8d613fa" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...e8d613fa</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7</td><td>Block</td><td>N/A</td><td>Rule metadata description refined. Detection unchanged.</td></tr></tbody></table> <p>For more information, refer to <a href="https://developers.cloudflare.com/waf/managed-rules/">WAF Managed Rules</a>.</p>