WAF Emergency Release: Seven PHP RCE Rules in Managed Ruleset Now Name Their CVEs!
Hi everyone, it's Shii-chan! A WAF emergency release is out, so let's take a look!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
The Cloudflare Changelog announced the 2026-10-22 emergency WAF release for the Cloudflare Managed Ruleset. It updates the names and metadata of seven existing rules to identify CVE-2026-109618 and CVE-2026-109619.
What changes
The short version: behavior does not change.
- Detection logic is unchanged
- Rule actions are unchanged
- Only names and description metadata change
So you generally don't need to review your configuration. The nice part is that you can trace the CVEs from rule names in logs and dashboards.
Dive Deep
The affected rules are described as "PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)".
- Seven rules: the base one plus #2 to #7
- Previous action is Block, new action is N/A (unchanged)
- Comment: "Rule metadata description refined. Detection unchanged."
A similar emergency release was also published separately for the Free Ruleset.
Wrap-up
- Names and metadata of seven PHP RCE rules in the Managed Ruleset are updated
- CVE-2026-109618 and CVE-2026-109619 are now identified
- Detection logic and actions are unchanged
Good to know for security teams who track vulnerabilities through WAF logs and rule names!
