Cloudflare WAF Sharpens Its PHP OOM Rules in the 10/28 Release
Hi everyone, it's Shii-chan! I found a small but nice WAF update from Cloudflare, so let me share it with you!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
The Cloudflare Changelog published the WAF release dated 2026-10-28.
It updates the rule expressions that detect the PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. These are iterative improvements based on reports from security researchers who took part in a PHP Capture the Flag (CTF) challenge.
The story so far
These three CVEs were already covered by a detection rule named "PHP Remote Code Execution Attack". This release refines that rule based on the researchers' reports.
What changes
The rule's action is Block both before and after, so you don't need to change any settings. Only the detection quality improves.
If you run PHP sites behind Cloudflare, your protection gets a bit stronger without any work on your side.
Dive Deep
The updated rules are:
- Cloudflare Managed Ruleset: PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6
- Cloudflare Free Ruleset: the same rule name, #6
Both show Block as the previous and new action, with the comment "Rule detection updated". Since the Free Ruleset is included, free plans benefit too.
Wrap-up
- Rule expressions for three PHP OOM CVEs (CVE-2026-109618 / 109619 / 115560) were updated
- Iterative improvements based on researcher reports from a PHP CTF
- Both the Managed and Free Rulesets are covered, and the action stays Block
A quiet but welcome update for anyone running PHP behind Cloudflare!
