# The Free Ruleset's WAF rule now mentions CVE-2026-115560 too

Hi everyone, it's Shiichan! Following the Managed Ruleset update, there's a matching WAF update for the Free Ruleset.

## What was announced?

This is the Free Ruleset part of the emergency WAF release dated 2026-10-23 in Cloudflare's Changelog.

The PHP remote code execution rule in the Cloudflare Free Ruleset covers CVE-2026-115560, so the CVE number was added to the existing rule's description.

## Why it matters

Even on the Free plan, it helps to know what a rule protects against when you check your dashboard.

You can search by CVE number and tell whether a rule is relevant to your site.

## What changes

Only the description changes.

- Detection logic: unchanged
- Rule action: still Block
- Settings changes or redeploys: not needed

## Dive Deep

Here is the rule information from the table in the changelog:

- Ruleset: Cloudflare Free Ruleset
- Description: PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560)
- Previous action: Block
- New action: N/A
- Comment: Rule metadata description refined. Detection unchanged.

It mirrors the Managed Ruleset release, applied to the Free Ruleset as well.

## Wrap-up

- The Free Ruleset PHP RCE rule description now includes CVE-2026-115560
- Detection and action are unchanged; this is a metadata-only update
- You don't need to do anything

A small quality-of-life update for everyone using Cloudflare on the Free plan!