Emergency WAF release for the Free plan: Anomalous Execution rules added to the Cloudflare Free Ruleset!
Hi everyone, it's Shii-chan! Following the Managed Ruleset, the Free Ruleset also got an emergency WAF release.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
Cloudflare's Changelog published an emergency WAF release dated October 21, 2026. It adds rules to the Cloudflare Free Ruleset to block anomalous request patterns.
The table lists these rules, all new detections with no legacy rule ID and a new action of Block:
- Generic Rules - Anomalous Execution - 1 (rule ID ending b5ccf32f)
- Generic Rules - Anomalous Execution - 2 (ending bcd95984)
- Generic Rules - Anomalous Execution - 3 (ending 82dab691)
- Generic Rules - Anomalous Execution - 4 (ending 24b1a4c6)
Why it matters
The Free Ruleset is the WAF ruleset applied to Free plan zones. An emergency release adds new blocking rules, which can change how matching requests are handled.
What changes
Matching anomalous requests can now be stopped by the Block rules. The changelog doesn't describe the specific attack behind the detections.
Dive Deep
The source contains an inconsistency:
- The intro says the release adds two rules
- The table lists four rules, Anomalous Execution 1 through 4
The source doesn't say which is right, so it's safest to check which rules are actually active in your dashboard.
For more, see WAF Managed Rules in the Cloudflare documentation.
Wrap-up
- New Anomalous Execution rules were added to the Cloudflare Free Ruleset
- All are new detections with no legacy rule ID and a Block action
- The rule count differs: two in the intro, four in the table
- Check the actual rules in your dashboard
Worth a look for anyone using WAF on the Cloudflare Free plan!
