# Cloudflare WAF tidies up its Java deserialization detection!

Hey everyone, it's me, Shii-chan! Today I spotted a small but important security update to share with you.

## What was announced?

Cloudflare's Changelog published a [WAF](https://developers.cloudflare.com/waf/) (Web Application Firewall) release dated May 11, 2026. This one isn't a shiny new feature - it's an enhancement to the existing managed rules to strengthen detection against a broad range of web attacks.

## The story so far

Cloudflare keeps refining its WAF managed ruleset all the time. Attack patterns keep shifting, so the rules can't be "set once and forget" - they need steady updates to keep your defenses tight.

## What changes

The headline this time is a cleanup of the detection for remote code execution (RCE) via Java deserialization.

Specifically, a beta detection rule called "Remote Code Execution - Java Deserialization - Body - Beta" was merged into the existing "Remote Code Execution - Java Deserialization" rule. The beta one finished its job, and its action switched from `Block` to `Disabled`.

## Dive Deep

Here's the change at a glance:

- Ruleset: Cloudflare Managed Ruleset
- Rule: Remote Code Execution - Java Deserialization - Body - Beta
- Action: `Block` -> `Disabled`
- Reason: Merged into the original "Remote Code Execution - Java Deserialization" rule

When a rule update like this lands, the way detections fire (which requests get blocked) can shift a little. That's why Cloudflare recommends keeping an eye on your Security Events dashboard and adjusting rule actions if needed, so your production behavior never surprises you.

## Wrap-up

- Cloudflare's Changelog published a WAF release dated 2026-05-11
- It's about strengthening existing managed rules, not a new feature
- The beta Java deserialization RCE detection was merged into the main rule, and the beta side is now `Disabled`
- After the update, watch Security Events and tune actions if needed

This one quietly matters for web app admins running their own WAF!