Emergency WAF release: four 'Anomalous Execution' rules added to the Cloudflare Managed Ruleset!

Hi everyone, it's Shii-chan! There's an emergency WAF release from Cloudflare, so let's go through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog published an emergency WAF release dated October 21, 2026. It adds four rules to the Cloudflare Managed Ruleset to detect anomalous request patterns.

All four are new detections with no legacy rule ID:

• Generic Rules - Anomalous Execution - 1 (rule ID ending c438d5dd)
• Generic Rules - Anomalous Execution - 2 (ending 0a0c2f64)
• Generic Rules - Anomalous Execution - 3 (ending 545d163c)
• Generic Rules - Anomalous Execution - 4 (ending 212afcc9)

Why it matters

An emergency release is a WAF update shipped without waiting for the regular schedule. If your zones use the Managed Ruleset, new rules can affect how requests are handled, so it's good to know what changed.

What changes

Matching requests will now be detected by the new rules. The changelog doesn't describe the specific attack behind the detections.

Dive Deep

There's one thing in the source to watch:

• The intro says two of the four rules block matching requests and two only log matches
• The table lists the new action as Block for all four rules

This inconsistency is in the source itself, so it's safest to verify the actual action in your dashboard before relying on it.

For more, see WAF Managed Rules in the Cloudflare documentation.

Wrap-up

• Four new Anomalous Execution rules were added to the Cloudflare Managed Ruleset
• All are new detections with no legacy rule ID
• Whether two or four of them block is inconsistent within the source
• Check the actual actions in your dashboard

Worth a look for security folks running Cloudflare WAF!