JA EN
shiichan

Free Plan Too! WAF Free Ruleset's PHP RCE Rules Now Name Their CVEs

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hi everyone, it's Shii-chan! After the Managed Ruleset, the Free Ruleset got an emergency release too!

Cloudflare Changelog developers.cloudflare.com

What was announced?

The Cloudflare Changelog announced the 2026-10-22 emergency WAF release for the Cloudflare Free Ruleset. It updates the names and metadata of seven existing rules to identify CVE-2026-109618 and CVE-2026-109619.

What changes

Behavior does not change.

  • Detection logic is unchanged
  • Actions are unchanged
  • Only names and description metadata change

On the Free plan too, rule names now tell you which CVEs they cover.

Dive Deep

The affected rules are described as "PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)".

  • Seven rules: the base one plus #2 to #7
  • Previous action is Block, new action is N/A (unchanged)
  • Comment: "Rule metadata description refined. Detection unchanged."

Wrap-up

  • Names and metadata of seven PHP RCE rules in the Free Ruleset are updated
  • CVE-2026-109618 and CVE-2026-109619 are now identified
  • Detection logic and actions are unchanged

If you watch WAF logs on the Free plan, no need to worry when you notice the rule names change!

Related posts