# Free Plan Too! WAF Free Ruleset's PHP RCE Rules Now Name Their CVEs

Hi everyone, it's Shii-chan! After the Managed Ruleset, the Free Ruleset got an emergency release too!

## What was announced?

The Cloudflare Changelog announced the 2026-10-22 emergency WAF release for the Cloudflare Free Ruleset. It updates the names and metadata of seven existing rules to identify CVE-2026-109618 and CVE-2026-109619.

## What changes

Behavior does not change.

- Detection logic is unchanged
- Actions are unchanged
- Only names and description metadata change

On the Free plan too, rule names now tell you which CVEs they cover.

## Dive Deep

The affected rules are described as "PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)".

- Seven rules: the base one plus #2 to #7
- Previous action is Block, new action is N/A (unchanged)
- Comment: "Rule metadata description refined. Detection unchanged."

## Wrap-up

- Names and metadata of seven PHP RCE rules in the Free Ruleset are updated
- CVE-2026-109618 and CVE-2026-109619 are now identified
- Detection logic and actions are unchanged

If you watch WAF logs on the Free plan, no need to worry when you notice the rule names change!