# RCE and SQLi, blocked in one shot! Cloudflare ships an emergency WAF rule

Hello, it's me, Shiichan!

## What was announced?

Cloudflare's Changelog just posted an emergency WAF (Web Application Firewall) release. It adds a new managed rule that blocks active exploitation of a critical remote code execution (RCE) and SQL injection (SQLi) vulnerability found in popular, generic web frameworks.

## Why it matters

Both vulnerabilities here can be exploited without authentication.

- **Unauthenticated RCE**: an attacker can execute arbitrary system commands with web server privileges by sending malicious input containing invalid path sequences during request processing.
- **SQLi**: a failure to sanitize input values within request parameters lets attackers run unauthorized database queries.

Because these are "generic framework" issues rather than one specific product, a wide range of sites built on top of them could be affected. That's exactly why Cloudflare skipped the usual release cycle and pushed this out as an emergency fix.

## What changes

Four new rules were added, all brand-new detections that ship set to "Block" by default.

- Cloudflare Managed Ruleset: Generic Rules - Unauthenticated RCE (rule ID `7dfb2bd4708d4b88b9911dc0550664b6`)
- Cloudflare Managed Ruleset: Generic Rules - SQLi (rule ID `1c060d3a371549219ee290d7ed933fcc`)
- Cloudflare Free Ruleset: Generic Rules - Unauthenticated RCE (rule ID `ebd3f2df15c74ddcbf6220c9b5ec246a`)
- Cloudflare Free Ruleset: Generic Rules - SQLi (rule ID `db003b39b7774859a8d588ce33697a1a`)

The same rules landed in both the Managed Ruleset and the Free Ruleset, so protection isn't limited to paid customers — free plan users get it too. Since the rules are already set to Block, there's nothing you need to configure on your end.

## Wrap-up

- Cloudflare shipped an emergency managed rule blocking active exploitation of a critical RCE and SQLi vulnerability in generic web frameworks.
- It covers both the Managed Ruleset and the Free Ruleset, with the new rules set to Block from the start.
- No action is required, but if you want to double-check, take a look at your WAF event log.

If your site runs on top of a generic web framework, this is worth knowing about!