JA EN
shiichan

Cloudflare WAF now auto-blocks a Ghost CMS SQL injection flaw!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#web

Hey there, it's Shii-chan! Today I've got a quiet-but-important update that keeps your sites safe.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog posted its WAF release for June 15, 2026. The headline is two new managed rules: one closes a critical SQL injection flaw found in Ghost CMS (CVE-2026-26980), and the other is a generic rule that catches SQLi bypass attempts hiding behind obfuscated boolean logic.

These rules protect affected installations from unauthorized data exfiltration at the network edge.

That means the bad traffic gets stopped right at the network edge.

The story so far

Cloudflare's WAF ships regular updates to its managed rulesets, adding rules or changing their behavior as new vulnerabilities show up. This is one of those routine releases.

What changes

If you use the Cloudflare Managed Ruleset, the new detections kick in without any extra setup. And if you run Ghost CMS, the new rule blocks attacks targeting CVE-2026-26980, so you can breathe a little easier.

Dive Deep

Here are the two rules that change:

  • Ghost CMS - SQLi - CVE:CVE-2026-26980 (new detection) - action moved from Log to Block, going from "just record it" to "actually stop it".
  • SQLi - Obfuscated Boolean - URI (new detection) - action set from Log to Disabled, shipping in an off-by-default state for now.

Both are new rules in the Cloudflare Managed Ruleset, with no legacy Rule ID attached.

Wrap-up

  • Cloudflare's 2026-06-15 WAF release addresses the Ghost CMS SQLi flaw CVE-2026-26980
  • The new rule is promoted from Log to Block; a second generic SQLi rule arrives as Log to Disabled
  • Cloudflare Managed Ruleset users are protected with no extra configuration

This routine update is a treat for anyone running Ghost CMS or leaning on the WAF for automatic defense!

Related posts