WAF - WAF Release - 2026-10-30

<p>This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative changes based on reports from Security Researchers as part of <a href="https://blog.cloudflare.com/php-ctf" target="_blank" rel="noopener">PHP Capture the Flag (CTF) challenge<span class="external-link"> ↗︎</span></a>.</p> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="771c654ae1154d4daa72f4e1545d163c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 771c654ae1154d4daa72f4e1545d163c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...545d163c</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3</td><td>Block</td><td>Block</td><td>Rule detection updated.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="48ddf592361e4fdb97a8a85982dab691"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 48ddf592361e4fdb97a8a85982dab691" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...82dab691</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3</td><td>Block</td><td>Block</td><td>Rule detection updated.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="217005865f0145f392300bac212afcc9"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 217005865f0145f392300bac212afcc9" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...212afcc9</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4</td><td>Block</td><td>Block</td><td>Rule detection updated.</td></tr><tr><td>Cloudflare Free Ruleset</td><td><span class="rule-id" data-rule-id="3556683d512a47f2937899c524b1a4c6"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 3556683d512a47f2937899c524b1a4c6" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...24b1a4c6</span></button></span></td><td>N/A</td><td>PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4</td><td>Block</td><td>Block</td><td>Rule detection updated.</td></tr><tr><td>Cloudflare Response Ruleset</td><td><span class="rule-id" data-rule-id="afffe22785674c80a31875c848d2242a"><button type="button" title="Copy rule ID" aria-label="Copy rule ID afffe22785674c80a31875c848d2242a" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...48d2242a</span></button></span></td><td>N/A</td><td>Default block for High confidence Signatures</td><td>Block</td><td>Block</td><td>Rule detection updated.</td></tr></tbody></table>