WAF - WAF Release - 2026-10-28

<p>This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative changes based on reports from Security Researchers as part of <a href="https://blog.cloudflare.com/php-ctf" target="_blank" rel="noopener">PHP Capture the Flag (CTF) challenge<span class="external-link"> ↗︎</span></a>.</p> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="4148ae686fdb4d01be673fab9d9c073d"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 4148ae686fdb4d01be673fab9d9c073d" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...9d9c073d</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6</td><td>Block</td><td>Block</td><td>Rule detection updated.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="19373a83abb840e18ab3ce5a7975ce1b"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 19373a83abb840e18ab3ce5a7975ce1b" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...7975ce1b</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6</td><td>Block</td><td>Block</td><td>Rule detection updated.</td></tr></tbody></table>