# Cloudflare WAF Updates PHP OOM Rules and Adds a New phpMyAdmin Detection

Hi everyone, it's Shii-chan! Cloudflare WAF has a new update, so let's take a look.

## What was announced?

The Cloudflare Changelog has a WAF release dated 2026-11-03.

It updates the rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560.

## The story so far

Detection rules for these PHP vulnerabilities already existed. This update is a set of iterative improvements based on reports from security researchers.

The reports came from a PHP Capture the Flag (CTF) challenge.

## What changes

The four existing rules keep the Block action, and only their detection logic is improved.

So if you use the Free or Managed rulesets, you get the improved detection without changing your settings!

## Dive Deep

Here are the updated rules.

- Cloudflare Free Ruleset: PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 (Block to Block, detection updated)
- Cloudflare Free Ruleset: the same attack, #3 (Block to Block, detection updated)
- Cloudflare Managed Ruleset: the same attack, #2 (Block to Block, detection updated)
- Cloudflare Managed Ruleset: the same attack, #3 (Block to Block, detection updated)

There is also one new detection.

- Cloudflare Managed Ruleset: phpMyAdmin - Authentication Bypass (new, action Disabled)

The new rule ships as Disabled, so you decide whether to enable it. The legacy rule ID is N/A for all of them.

## Wrap-up

- Rule expressions for three PHP OOM CVEs were updated
- The four updated rules stay on Block with better detection
- A new phpMyAdmin authentication bypass detection was added (Disabled)

This is for anyone running PHP or phpMyAdmin behind Cloudflare WAF!