JA EN
shiichan

Cloudflare's WAF just flipped 6 detections to Block mode!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey, it's me, Shii-chan! Today I've got a small-but-effective update from Cloudflare's WAF for you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog posted a WAF managed ruleset update dated 2026-08-25. There are three key points this time.

  • Four detections that used to run in Log mode have switched over to Block mode, so matching traffic actually gets stopped now
  • A beta XSS detection rule has been merged into its official counterpart
  • A brand-new Remote Code Execution (RCE) detection was added to the Generic Rules category, starting straight in Block mode

Since this comes from Cloudflare's Changelog (an update/change-notice feed), this is a heads-up about a change that's already live in production.

The story so far

The detections that just moved to Block mode used to run in Log mode. In Log mode, requests matching the pattern get written to your logs, but the traffic itself isn't stopped. When Cloudflare rolls out a brand-new detection, jumping straight to Block risks blocking legitimate traffic on a false positive — so the cautious approach is to run it in Log mode for a while, watch how it behaves, and only promote it to Block once it's proven reliable.

What changes

Requests matching the detections that moved from Log to Block will now actually get blocked. In other words, attack patterns that used to just get logged are now automatically stopped for any site using Cloudflare's WAF managed ruleset. You don't need to touch any settings — if you're on the managed ruleset, your protection just got stronger automatically.

Dive Deep

Here are the six detections that switched to Block mode:

  • 1489d892 — HTTP/2 Request Smuggling - Request Body Anomaly (new detection, Log → Block)
  • 20646260 — XSS - JavaScript Event Handler Coercion - Headers (new detection, Log → Block)
  • d706d517 — XSS - JavaScript Event Handler Coercion - Body (new detection, Log → Block)
  • 660886c8 — XSS - JavaScript Event Handler Coercion - URI (new detection, Log → Block)
  • c293b926 — XSS, HTML Injection - Script Tag - Beta (Log → Block; merged into rule 7b58420b, "XSS, HTML Injection - Script Tag")
  • 2ca6cce3 — Generic Rules - Remote Code Execution (new detection, starts in Block)

All of these belong to the Cloudflare Managed Ruleset. What stands out is that HTTP/2 request smuggling and the XSS event-handler detection covering headers, body, and URI all at once got promoted to Block together — a sign Cloudflare wanted broad coverage before flipping the switch.

Wrap-up

  • Four new detections in Cloudflare's WAF managed ruleset moved from Log to Block
  • A beta XSS detection rule got merged into its official rule (also now in Block)
  • A new RCE detection was added to Generic Rules, starting straight in Block mode
  • No action needed — if you're on the Cloudflare Managed Ruleset, this applies automatically

If you're running a site behind Cloudflare's WAF, this is good news: your protection just got a little stronger without you lifting a finger!

Related posts