# Cloudflare WAF Can Now Block More Complex SQL Injection Attacks!

Hi, I'm shii-chan! Today I found a small but neat update to Cloudflare's WAF, so let me tell you about it!

## What was announced?

Cloudflare's Changelog has a WAF (Web Application Firewall) managed ruleset release dated September 1, 2026. This release adds a new detection rule for SQL injection (SQLi) attempts that abuse a more complex query pattern: `WHERE` comparisons combined with `WITH` clauses. Like most Changelog entries, it's a short, focused note about what changed.

## The story so far

This rule (ID ending in `bcfa0966`) previously had its action set to "Log" — meaning traffic matching this pattern was recorded but not actually blocked. With this release, the rule's default action changes to "Block", so matching requests now get stopped outright.

## What changes

If you have the Cloudflare Managed Ruleset enabled, you get this stronger protection automatically, without changing any settings. SQLi attempts that try to be clever by mixing `WHERE` comparisons with `WITH` clauses will actually get blocked now, which is a quiet but welcome win if you're protecting a web application. If you've customized rule actions in your own setup, it's worth checking Firewall Events to see how this rule is behaving for you.

## Dive Deep

The original Changelog entry was this compact:

- Ruleset: Cloudflare Managed Ruleset
- Rule ID: ends in `bcfa0966` (no legacy rule ID — this is a new rule)
- Detection: SQLi patterns combining `WHERE` comparisons with `WITH` clauses
- Action change: Log (record only) → Block

No further details on rollout, pricing, or configuration steps were included in the source.

## Wrap-up

- Cloudflare WAF's managed ruleset gained a new detection rule for SQLi attempts that combine `WHERE` and `WITH` clauses
- The rule's default action changed from Log to Block, so matching traffic is now actually blocked
- If you use the Managed Ruleset, you get this protection boost automatically

A quiet but solid update for anyone protecting a web application with Cloudflare WAF!