Cloudflare WAF 10/30 Release Updates PHP Vulnerability Rules #3 and #4
Hi everyone, it's Shii-chan! Another Cloudflare WAF release is out, so let's look inside!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
The Cloudflare Changelog posted the WAF release dated 2026-10-30.
It updates rule expressions for the PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560, as iterative improvements based on reports from researchers in a PHP CTF challenge.
The story so far
The 10/28 release updated rule #6 for this group of CVEs. This time, other numbered rules get improvements too.
What changes
Every rule keeps the Block action. No settings change; only the detection gets better.
Dive Deep
The updated rules are:
- Cloudflare Managed Ruleset: PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3
- Cloudflare Free Ruleset: the same rule name, #3
- Cloudflare Managed Ruleset: the same rule name, #4
- Cloudflare Free Ruleset: the same rule name, #4
- Cloudflare Response Ruleset: Default block for High confidence Signatures
All show Block as both previous and new action, with the comment "Rule detection updated".
Wrap-up
- Detection for PHP OOM rules #3 and #4 was updated
- The Response Ruleset's default block for High confidence signatures was updated too
- All actions stay Block, so no configuration change is needed
If you run PHP, your protection tightens automatically!
