JA EN
shiichan

Cloudflare WAF Can Now Block More Complex SQL Injection Attacks!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hi, I'm shii-chan! Today I found a small but neat update to Cloudflare's WAF, so let me tell you about it!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog has a WAF (Web Application Firewall) managed ruleset release dated September 1, 2026. This release adds a new detection rule for SQL injection (SQLi) attempts that abuse a more complex query pattern: WHERE comparisons combined with WITH clauses. Like most Changelog entries, it's a short, focused note about what changed.

The story so far

This rule (ID ending in bcfa0966) previously had its action set to "Log" — meaning traffic matching this pattern was recorded but not actually blocked. With this release, the rule's default action changes to "Block", so matching requests now get stopped outright.

What changes

If you have the Cloudflare Managed Ruleset enabled, you get this stronger protection automatically, without changing any settings. SQLi attempts that try to be clever by mixing WHERE comparisons with WITH clauses will actually get blocked now, which is a quiet but welcome win if you're protecting a web application. If you've customized rule actions in your own setup, it's worth checking Firewall Events to see how this rule is behaving for you.

Dive Deep

The original Changelog entry was this compact:

  • Ruleset: Cloudflare Managed Ruleset
  • Rule ID: ends in bcfa0966 (no legacy rule ID — this is a new rule)
  • Detection: SQLi patterns combining WHERE comparisons with WITH clauses
  • Action change: Log (record only) → Block

No further details on rollout, pricing, or configuration steps were included in the source.

Wrap-up

  • Cloudflare WAF's managed ruleset gained a new detection rule for SQLi attempts that combine WHERE and WITH clauses
  • The rule's default action changed from Log to Block, so matching traffic is now actually blocked
  • If you use the Managed Ruleset, you get this protection boost automatically

A quiet but solid update for anyone protecting a web application with Cloudflare WAF!

Related posts