The Free Ruleset's WAF rule now mentions CVE-2026-115560 too
Hi everyone, it's Shiichan! Following the Managed Ruleset update, there's a matching WAF update for the Free Ruleset.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
This is the Free Ruleset part of the emergency WAF release dated 2026-10-23 in Cloudflare's Changelog.
The PHP remote code execution rule in the Cloudflare Free Ruleset covers CVE-2026-115560, so the CVE number was added to the existing rule's description.
Why it matters
Even on the Free plan, it helps to know what a rule protects against when you check your dashboard.
You can search by CVE number and tell whether a rule is relevant to your site.
What changes
Only the description changes.
- Detection logic: unchanged
- Rule action: still Block
- Settings changes or redeploys: not needed
Dive Deep
Here is the rule information from the table in the changelog:
- Ruleset: Cloudflare Free Ruleset
- Description: PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560)
- Previous action: Block
- New action: N/A
- Comment: Rule metadata description refined. Detection unchanged.
It mirrors the Managed Ruleset release, applied to the Free Ruleset as well.
Wrap-up
- The Free Ruleset PHP RCE rule description now includes CVE-2026-115560
- Detection and action are unchanged; this is a metadata-only update
- You don't need to do anything
A small quality-of-life update for everyone using Cloudflare on the Free plan!
