JA EN
shiichan

WAF's PHP RCE rule now lists CVE-2026-115560, with no change in detection

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#web

Hi, it's Shiichan! Today I found a small but useful WAF update, so let's go through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog has an emergency WAF release dated 2026-10-23 for the Cloudflare Managed Ruleset.

The existing PHP remote code execution (RCE) rule in the Managed Ruleset turns out to cover CVE-2026-115560 as well. So the release adds that CVE identifier to the rule's description.

Why it matters

When you run a WAF, you want to know which vulnerabilities a rule actually protects against, so you can judge your exposure.

With the CVE number in the rule description, you can compare it with vulnerability reports and quickly check whether a given CVE is already covered.

What changes

Only the rule metadata (the description) changed.

  • Detection logic: unchanged
  • Rule action: unchanged (still Block)
  • CVEs in the description: CVE-2026-109618, CVE-2026-109619, CVE-2026-115560

You don't need to change any settings or take any action.

Dive Deep

According to the table in the changelog, the affected rule looks like this:

  • Ruleset: Cloudflare Managed Ruleset
  • Description: PHP Remote Code Execution Attack
  • Previous action: Block
  • New action: N/A (no change)
  • Comment: Rule metadata description refined. Detection unchanged.

The comment says clearly that detection is unchanged. For more details, see the WAF Managed Rules documentation.

Wrap-up

  • The Managed Ruleset PHP RCE rule now explicitly lists CVE-2026-115560
  • Only the description (metadata) changed; detection and action stay the same
  • No work needed on your side

This one is for security folks who keep a map between CVEs and WAF rules!

Related posts