{"id":"src_qqhTsbg70x4e1IMbX1Dbx","slug":"cloudflare-application-security","name":"Application Security Changelog","type":"feed","url":"https://developers.cloudflare.com/changelog/?area=application-security","orgId":"org_fW6EY8PY8Cr42ifo1IUAm","productId":"prod_02S8cxZHdXV8zT_lFRq25","productSlug":"application-security","org":{"id":"org_fW6EY8PY8Cr42ifo1IUAm","slug":"cloudflare","name":"Cloudflare"},"isPrimary":false,"isHidden":false,"discovery":"curated","fetchPriority":"normal","metadata":"{\"feedUrl\":\"https://developers.cloudflare.com/changelog/rss/application-security.xml\",\"feedType\":\"rss\",\"feedDiscoveredAt\":\"2026-06-19T21:04:41.921Z\",\"noFeedFound\":false,\"feedContentDepth\":\"full\",\"feedEtag\":\"\\\"4146ac95db4c6fff28eb0b9aa6cd3044\\\"\",\"feedContentLength\":\"961927\",\"enrichment\":{\"consecutiveFailures\":0},\"sourceActor\":{\"nextAlarmAt\":\"2026-11-03T14:06:00.515Z\",\"lastAlarmAt\":\"2026-11-03T10:06:01.199Z\",\"managed\":true}}","notice":null,"kind":null,"stars":null,"starsFetchedAt":null,"releaseCount":193,"releasesLast30Days":19,"avgReleasesPerWeek":3.2,"latestVersion":null,"latestDate":"2026-10-30T00:00:00.000Z","changelogUrl":null,"hasChangelogFile":false,"lastFetchedAt":"2026-11-03T06:06:12.047Z","lastPolledAt":"2026-11-03T10:08:12.004Z","changeDetectedAt":null,"trackingSince":"2025-01-06T00:00:00.000Z","releases":[{"id":"rel_RaAoyrmscIIuhljY9dx79","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-30","summary":"Rule detection is updated across the Cloudflare Managed, Free, and Response rulesets for PHP out-of-memory vulnerabilities CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560, based on researcher reports from Cloudflare's PHP CTF challenge. Detection actions remain Block.","titleGenerated":"Cloudflare updates WAF rules for PHP OOM vulnerabilities CVE-2026-109618 and CVE-2026-109619","titleShort":"WAF rules retuned for PHP OOM CVEs","breaking":"none","importance":3,"content":"This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative changes based on reports from Security Researchers as part of [PHP Capture the Flag (CTF) challenge ↗︎](https://blog.cloudflare.com/php-ctf).\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...545d163c\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3\n\nBlock\n\nBlock\n\nRule detection updated.\n\nCloudflare Free Ruleset\n\n...82dab691\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3\n\nBlock\n\nBlock\n\nRule detection updated.\n\nCloudflare Managed Ruleset\n\n...212afcc9\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4\n\nBlock\n\nBlock\n\nRule detection updated.\n\nCloudflare Free Ruleset\n\n...24b1a4c6\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4\n\nBlock\n\nBlock\n\nRule detection updated.\n\nCloudflare Response Ruleset\n\n...48d2242a\n\nN/A\n\nDefault block for High confidence Signatures\n\nBlock\n\nBlock\n\nRule detection updated.","publishedAt":"2026-10-30T00:00:00.000Z","fetchedAt":"2026-10-31T01:24:12.334Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/","media":[],"coverageCount":0},{"id":"rel_60bOeyusjzvLuOB3-w4z3","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-30 - Emergency","summary":"An emergency release adds a disabled-by-default Cloudflare Managed Ruleset rule for a vulnerability in Nuxt Image and IPX, offering only partial coverage; the advisory recommends patching to the latest version.","titleGenerated":"Cloudflare adds WAF rule for Nuxt Image and IPX vulnerability","titleShort":"New WAF rule targets Nuxt Image and IPX bug","breaking":"none","importance":3,"content":"This emergency release adds a new rule to the Cloudflare Managed Ruleset, disabled by default, for a vulnerability in Nuxt Image and IPX. The rule offers partial coverage. Please follow the advisory and patch to the latest version.\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...5b82bffe\n\nN/A\n\nNuxt Image / IPX - Explicit GIF or Animation Modifier Exposure\n\nN/A\n\nDisabled\n\nThis is a new detection.","publishedAt":"2026-10-30T00:00:00.000Z","fetchedAt":"2026-10-31T01:24:12.334Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-30-emergency-waf-release/","media":[],"coverageCount":0},{"id":"rel_NRVHgNtDdyIckVeM2p2K2","version":null,"type":"feature","title":"Workers, BYOIP, Bots - Workers subrequests now preserve context for BYOIP destinations","summary":"Workers subrequests targeting Cloudflare-proxied BYOIP hostnames are now identified as Cloudflare-to-Cloudflare traffic, preserving the CF-Worker header and cf.worker.upstream_zone field and making Bot Management fields reflect the original end-user connection instead of the internal one. Cross-zone subrequests now set CF-Connecting-IP to the Workers client IP 2a06:98c0:3600::103, while same-zone subrequests still reflect the client IP.","titleGenerated":"Cloudflare Workers subrequests to BYOIP destinations keep context and client bot signals","titleShort":"BYOIP subrequests keep Workers context; bot scores use real client","breaking":"minor","importance":3,"content":"Cloudflare now preserves Workers context when a subrequest targets a Cloudflare-proxied hostname using [Bring Your Own IP (BYOIP)](https://developers.cloudflare.com/byoip/). These requests are identified as Cloudflare-to-Cloudflare traffic instead of external Internet traffic.\n\nPreviously, some BYOIP subrequests could lose Workers context and original client signals. This could cause security rules to behave unexpectedly, Bot Management to evaluate an internal Cloudflare connection instead of the original client, or affected requests to return false `403` responses.\n\nWorkers subrequests to BYOIP destinations now preserve the [`CF-Worker`](https://developers.cloudflare.com/fundamentals/reference/http-headers/#cf-worker) header and [`cf.worker.upstream_zone`](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.worker.upstream_zone/) field. This supports consistent security rule evaluation across same-zone and cross-zone subrequests.\n\n[Bot Management fields](https://developers.cloudflare.com/bots/reference/bot-management-variables/#o2o-and-subrequests) on the destination zone now represent the original end-user connection for affected BYOIP subrequests. Bot scores, verified bot status, and JA3/JA4 fingerprints no longer represent the internal connection between Cloudflare services.\n\nBecause Cloudflare-proxied BYOIP destinations now follow standard Workers subrequest handling, cross-zone requests set [`CF-Connecting-IP`](https://developers.cloudflare.com/fundamentals/reference/http-headers/#cf-connecting-ip-in-worker-subrequests) to the Workers client IP address `2a06:98c0:3600::103` for security reasons. This applies when a Worker in one Cloudflare zone sends a subrequest to a hostname in another Cloudflare zone. Same-zone subrequests continue to reflect the client IP through `CF-Connecting-IP`.\n\nFor more information, refer to [Cloudflare BYOIP](https://developers.cloudflare.com/byoip/), [Workers subrequests](https://developers.cloudflare.com/workers/platform/limits/#subrequests), and [`CF-Connecting-IP` in Worker subrequests](https://developers.cloudflare.com/fundamentals/reference/http-headers/#cf-connecting-ip-in-worker-subrequests).","publishedAt":"2026-10-30T00:00:00.000Z","fetchedAt":"2026-10-30T13:17:35.501Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-30-byoip-workers-subrequest-context/","media":[],"coverageCount":0},{"id":"rel_Qm9ALPhj53KE-TRwvOuhB","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-28","summary":"Cloudflare updated the underlying rule expressions in its Managed and Free rulesets for PHP out-of-memory vulnerabilities CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560, based on researcher reports from its PHP CTF challenge. Both rules keep the Block action; only detection changed.","titleGenerated":"Cloudflare updates WAF rules for PHP OOM and RCE CVEs","titleShort":"WAF rules refreshed for three PHP RCE CVEs","breaking":"none","importance":3,"content":"This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative changes based on reports from Security Researchers as part of [PHP Capture the Flag (CTF) challenge ↗︎](https://blog.cloudflare.com/php-ctf).\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...9d9c073d\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6\n\nBlock\n\nBlock\n\nRule detection updated.\n\nCloudflare Free Ruleset\n\n...7975ce1b\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6\n\nBlock\n\nBlock\n\nRule detection updated.","publishedAt":"2026-10-28T00:00:00.000Z","fetchedAt":"2026-10-31T01:24:12.659Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-28-waf-release/","media":[],"coverageCount":0},{"id":"rel_D-AtztS3_BpgB499TNYyd","version":null,"type":"feature","title":"China Network, Challenges, Bots - China-native Challenge Pages for the China Network","summary":"Challenge Pages served through the Cloudflare China Network now use Turnstile widgets hosted in Mainland China, so visitors there no longer need cross-border requests to complete challenges. The change applies automatically to China Network zones, and global-network visitors continue to receive the global Challenge Page experience.","titleGenerated":"Cloudflare China Network serves China-native Challenge Pages via local Turnstile widgets","titleShort":"China Network Challenge Pages use in-country Turnstile widgets","breaking":"none","importance":2,"content":"Challenge Pages served through the Cloudflare China Network now use Turnstile widgets hosted in Mainland China. This means that visitors in Mainland China can complete challenges faster and more reliably because widgets no longer need to make cross-border requests.\n\n**You do not need to take any action: this change applies automatically when a China Network zone presents a Challenge Page.** Visitors served by Cloudflare's global network will continue to receive the global Challenge Page experience.\n\nFor more information, refer to [Interstitial Challenge Pages](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/) and [Cloudflare China Network](https://developers.cloudflare.com/china-network/).","publishedAt":"2026-10-28T00:00:00.000Z","fetchedAt":"2026-10-28T20:55:31.906Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-28-china-native-challenge-pages/","media":[],"coverageCount":0},{"id":"rel_yxgY9HvWNGHFi056Es_Yj","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-25 - Emergency - Cloudflare Managed Ruleset","summary":"Two Cloudflare Managed Ruleset rules for CVE-2026-111497 are enabled by default in Log mode: one matching requests with Content-Encoding: br, one matching the Next.js image optimization path /_next/image. Customers with a ruleset-level Block action override will have matching legitimate traffic blocked on deployment unless they add rule-specific Log overrides.","titleGenerated":"Cloudflare adds default-on WAF rules for Brotli CVE-2026-111497","titleShort":"WAF rules for Brotli CVE ship in Log mode; ruleset overrides may block","breaking":"minor","importance":3,"content":"This emergency release will add two rules related to the Brotli vulnerability **CVE-2026-111497** to the Cloudflare Managed Ruleset. Both rules will be **enabled by default** with their action set to **Log**, providing visibility into matching requests so customers can evaluate the impact before choosing to block them.\n\n**Rule behavior**\n\n- **Brotli rule:** Matches incoming requests that declare Brotli request-body encoding (`Content-Encoding: br`), including legitimate clients submitting Brotli-encoded request bodies. It does not match `Accept-Encoding: br` or affect Cloudflare's Brotli response-compression settings. The rule's default action is **Log**.\n- **Next.js rule:** Matches requests to the Next.js image optimization endpoint (`/_next/image`), including legitimate image optimization traffic. The default action is **Log** and does not block requests. Changing the action to **Block** may prevent optimized images from loading and disrupt image delivery for applications using this endpoint.\n\n**Default behavior**\n\n- Both rules will log matching requests without blocking them when the ruleset defaults are used.\n- Customers will be able to review matches in analytics and configure a blocking action for either rule if desired.\n- Enabling these rules in **Log** mode provides visibility only; it does not block requests matching these rules.\n\n**Important: Check existing action overrides**\n\nIf you have configured a ruleset-level action override that applies **Block** to these rules, matching requests may be blocked as soon as the rules are deployed, despite their default **Log** action. This may result in false positives and block legitimate traffic.\n\nReview your existing ruleset overrides before deployment. If you want to evaluate these rules without blocking traffic, configure rule-specific overrides to use **Log** and review matching requests before switching to **Block**.\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...ca706f3c\n\nN/A\n\nBrotli - Request Content-Encoding - CVE:CVE-2026-111497\n\nN/A\n\nLog\n\nThis is a new detection.\n\nCloudflare Managed Ruleset\n\n...402fe5bb\n\nN/A\n\nNext.js - Image Optimizer Path - CVE:CVE-2026-111497\n\nN/A\n\nLog\n\nThis is a new detection.","publishedAt":"2026-10-25T00:00:00.000Z","fetchedAt":"2026-10-25T04:06:42.789Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release/","media":[],"coverageCount":0},{"id":"rel_SOiwf0Zxr3B6s_U_GE2g3","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset","summary":"An emergency release updates the names and metadata of seven existing Cloudflare Managed Ruleset rules to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.","titleGenerated":"Cloudflare emergency WAF release renames seven PHP RCE rules for CVE-2026-109618/109619","titleShort":"PHP RCE rules renamed; detection unchanged","breaking":"none","importance":3,"content":"This emergency release updates the names and metadata of seven existing rules in the Cloudflare Managed Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...c438d5dd\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Managed Ruleset\n\n...0a0c2f64\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Managed Ruleset\n\n...545d163c\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Managed Ruleset\n\n...212afcc9\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Managed Ruleset\n\n...1867b12e\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Managed Ruleset\n\n...9d9c073d\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Managed Ruleset\n\n...48143645\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nFor more information, refer to [WAF Managed Rules](https://developers.cloudflare.com/waf/managed-rules/).","publishedAt":"2026-10-22T00:00:00.000Z","fetchedAt":"2026-10-22T19:35:42.172Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/","media":[],"coverageCount":0},{"id":"rel_5rWUfNmWJXLqkn-s-0AAW","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset","summary":"Emergency release updates the names and metadata of seven existing Cloudflare Free Ruleset rules to identify CVE-2026-109618 and CVE-2026-109619, all covering PHP remote code execution attacks. Detection logic and block actions remain unchanged.","titleGenerated":"Cloudflare renames seven Free Ruleset WAF rules for CVE-2026-109618 and CVE-2026-109619","titleShort":"Free Ruleset rule metadata refined; detection unchanged","breaking":"none","importance":2,"content":"This emergency release updates the names and metadata of seven existing rules in the Cloudflare Free Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Free Ruleset\n\n...b5ccf32f\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619)\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Free Ruleset\n\n...bcd95984\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Free Ruleset\n\n...82dab691\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Free Ruleset\n\n...24b1a4c6\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Free Ruleset\n\n...302ede46\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Free Ruleset\n\n...7975ce1b\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nCloudflare Free Ruleset\n\n...e8d613fa\n\nN/A\n\nPHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7\n\nBlock\n\nN/A\n\nRule metadata description refined. Detection unchanged.\n\nFor more information, refer to [WAF Managed Rules](https://developers.cloudflare.com/waf/managed-rules/).","publishedAt":"2026-10-22T00:00:00.000Z","fetchedAt":"2026-10-22T19:35:42.172Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/","media":[],"coverageCount":0},{"id":"rel_xYS8hvBePvzApEzFmdym8","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-21 - Emergency - Cloudflare Free Ruleset","summary":"An emergency WAF release adds two rules to the Cloudflare Free Ruleset that block generic anomalous execution request patterns. Both are new detections that move straight to a Block action.","titleGenerated":"Cloudflare Free Ruleset adds two WAF rules blocking anomalous execution patterns","titleShort":"Two anomalous execution rules join Free Ruleset","breaking":"none","importance":3,"content":"This emergency release adds two rules to the Cloudflare Free Ruleset to block anomalous request patterns.\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Free Ruleset\n\n...b5ccf32f\n\nN/A\n\nGeneric Rules - Anomalous Execution - 1\n\nN/A\n\nBlock\n\nThis is a new detection.\n\nCloudflare Free Ruleset\n\n...82dab691\n\nN/A\n\nGeneric Rules - Anomalous Execution - 3\n\nN/A\n\nBlock\n\nThis is a new detection.\n\nFor more information, refer to [WAF Managed Rules](https://developers.cloudflare.com/waf/managed-rules/).","publishedAt":"2026-10-21T00:00:00.000Z","fetchedAt":"2026-10-21T03:13:29.140Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-21-emergency-waf-release-free/","media":[],"coverageCount":0},{"id":"rel_GWMn1GK4zZcT29S_9Mv5L","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-21 - Emergency - Cloudflare Managed Ruleset","summary":"An emergency WAF release adds four rules to the Cloudflare Managed Ruleset to detect anomalous request patterns, two blocking matching requests and two logging matches without blocking.","titleGenerated":"Cloudflare adds four anomalous request rules to Managed Ruleset","titleShort":"Four anomalous request rules added to Managed Ruleset","breaking":"none","importance":3,"content":"This emergency release adds four rules to the Cloudflare Managed Ruleset to detect anomalous request patterns. Two rules block matching requests, and two log matches without blocking.\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...c438d5dd\n\nN/A\n\nGeneric Rules - Anomalous Execution - 1\n\nN/A\n\nBlock\n\nThis is a new detection.\n\nCloudflare Managed Ruleset\n\n...0a0c2f64\n\nN/A\n\nGeneric Rules - Anomalous Execution - 2\n\nN/A\n\nLog\n\nThis is a new detection.\n\nCloudflare Managed Ruleset\n\n...545d163c\n\nN/A\n\nGeneric Rules - Anomalous Execution - 3\n\nN/A\n\nBlock\n\nThis is a new detection.\n\nCloudflare Managed Ruleset\n\n...212afcc9\n\nN/A\n\nGeneric Rules - Anomalous Execution - 4\n\nN/A\n\nLog\n\nThis is a new detection.\n\nFor more information, refer to [WAF Managed Rules](https://developers.cloudflare.com/waf/managed-rules/).","publishedAt":"2026-10-21T00:00:00.000Z","fetchedAt":"2026-10-21T03:13:29.140Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-21-emergency-waf-release-cfmr/","media":[],"coverageCount":0},{"id":"rel_7k-qo4d2BaQZsKadEburT","version":null,"type":"feature","title":"Bots - Precursor adds Monitor mode","summary":"The Precursor Status dropdown now offers Off, Monitor, and Arm, where Monitor lets detections be tested without affecting bot score or Challenge clearance. The Precursor Interstitial is also separated from the mode, with a sitewide Show Interstitial default plus Interstitial Rules for specific requests such as requiring a challenge on /checkout.","titleGenerated":"Cloudflare Application Security adds Monitor mode for Precursor bot detections","titleShort":"Precursor gets Monitor mode; interstitial decoupled from mode","breaking":"none","importance":3,"content":"We released Monitor mode at customers' request so they can test Precursor and the Precursor Interstitial without updating bot score.\n\nIn **Security** > **Settings**, the Precursor **Status** dropdown now offers *Off*, *Monitor*, and *Arm*. Selecting *Arm* means Precursor detections can affect bot score and Challenge clearance. Selecting *Monitor* means Precursor detections do not affect bot score or Challenge clearance.\n\n![Precursor Status dropdown with Off, Monitor, and Arm options](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=739,height=235,format=webp/_astro/precursor-monitor-mode-status.CRb5Sudr.png)\n\nWe also separated the Precursor Interstitial from the mode. Set the sitewide default with **Show Interstitial**, then add **Interstitial Rules** to customize it for specific requests. For example, leave **Show Interstitial** off across most of your site, but require an interstitial Challenge on `/checkout` to enforce a valid session before purchase.\n\n![Precursor settings with Show Interstitial off and an Open interstitial rules button](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=600,height=441,format=webp/_astro/precursor-interstitial-settings.Bpb_aV0o.png)\n\nFor more information, refer to the [**Precursor**](https://developers.cloudflare.com/cloudflare-challenges/precursor/) documentation.","publishedAt":"2026-10-19T00:00:00.000Z","fetchedAt":"2026-10-19T06:49:09.228Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-19-precursor-monitor-mode/","media":[{"type":"image","url":"https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=739,height=235,format=webp/_astro/precursor-monitor-mode-status.CRb5Sudr.png","alt":"Precursor Status dropdown with Off, Monitor, and Arm options","r2Key":"releases/5ea23e8b7e14d595abd76372d879f0b2f7f2733553ac2de406e9ecd937b9ee94.png","r2Url":"https://media.releases.sh/releases/5ea23e8b7e14d595abd76372d879f0b2f7f2733553ac2de406e9ecd937b9ee94.png"},{"type":"image","url":"https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=600,height=441,format=webp/_astro/precursor-interstitial-settings.Bpb_aV0o.png","alt":"Precursor settings with Show Interstitial off and an Open interstitial rules button","r2Key":"releases/9d6e247917a4831e6b0f77b5eaa7b8aa41333350618bb8b325dc209076521f84.png","r2Url":"https://media.releases.sh/releases/9d6e247917a4831e6b0f77b5eaa7b8aa41333350618bb8b325dc209076521f84.png"}],"coverageCount":0},{"id":"rel_bCFkCuqjxq2qvBqDi1bbr","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-14 - Emergency","summary":"An emergency release adds a new Cloudflare Managed Ruleset rule (Generic Rules - Remote Code Execution, rule ID ending fd1bf420) set to Block, targeting active exploitation of a critical RCE vulnerability in popular web frameworks where malicious input with invalid path sequences lets attackers run system commands with web server privileges.","titleGenerated":"Cloudflare WAF adds emergency managed rule blocking RCE exploitation in web frameworks","titleShort":"Emergency WAF rule blocks active RCE exploitation","breaking":"none","importance":4,"content":"This emergency release adds a new managed rule to block active exploitation of a critical remote code execution (RCE) vulnerability found in popular web frameworks.\n\n**Key Findings**\n\nKey Findings\n\n- Generic Rules - Remote Code Execution: Attackers can execute arbitrary system commands with web server privileges by sending malicious input containing invalid path sequences during request processing.\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...fd1bf420\n\nN/A\n\nGeneric Rules - Remote Code Execution\n\nN/A\n\nBlock\n\nThis is a new detection.","publishedAt":"2026-10-14T00:00:00.000Z","fetchedAt":"2026-10-14T13:47:11.921Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-14-emergency-waf-release/","media":[],"coverageCount":0},{"id":"rel_6n4sCuGlyRKVb-Ee_ItCN","version":null,"type":"feature","title":"Workers, BYOIP, Bots - Workers subrequests now preserve context for BYOIP destinations","summary":"Workers subrequests targeting BYOIP hostnames now preserve the CF-Worker header and cf.worker.upstream_zone field, and Bot Management fields on the destination zone reflect the original end-user connection instead of the internal Cloudflare connection. The change fixes unexpected security rule evaluation and false 403 responses, and applies automatically with no configuration changes.","titleGenerated":"Cloudflare preserves Workers context for BYOIP subrequests","titleShort":"BYOIP subrequests keep Workers context; false 403s fixed","breaking":"none","importance":3,"content":"Cloudflare now preserves Workers context when a subrequest targets a Cloudflare-proxied hostname using [Bring Your Own IP (BYOIP)](https://developers.cloudflare.com/byoip/). These requests are identified as Cloudflare-to-Cloudflare traffic instead of external Internet traffic.\n\nPreviously, some BYOIP subrequests could lose Workers context and original client signals. This could cause security rules to behave unexpectedly, Bot Management to evaluate an internal Cloudflare connection instead of the original client, or affected requests to return false `403` responses.\n\nWorkers subrequests to BYOIP destinations now preserve the [`CF-Worker`](https://developers.cloudflare.com/fundamentals/reference/http-headers/#cf-worker) header and [`cf.worker.upstream_zone`](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.worker.upstream_zone/) field. This supports consistent security rule evaluation across same-zone and cross-zone subrequests.\n\n[Bot Management fields](https://developers.cloudflare.com/bots/reference/bot-management-variables/#o2o-and-subrequests) on the destination zone now represent the original end-user connection for affected BYOIP subrequests. Bot scores, verified bot status, and JA3/JA4 fingerprints no longer represent the internal connection between Cloudflare services.\n\nCustomers benefit from consistent security rule evaluation, accurate Bot Management results, and fewer unexpected failures when Workers access BYOIP-backed hostnames. The improvement is automatic and requires no configuration changes.\n\nFor more information, refer to [Cloudflare BYOIP](https://developers.cloudflare.com/byoip/) and [Workers subrequests](https://developers.cloudflare.com/workers/platform/limits/#subrequests).","publishedAt":"2026-10-13T00:00:00.000Z","fetchedAt":"2026-10-13T13:33:56.752Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-13-byoip-workers-subrequest-context/","media":[],"coverageCount":0},{"id":"rel_nNt_h-26JM_6aI-FSEGWl","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-12","summary":"New WAF detections block CVE-2026-102989, a reflected XSS in TanStack, and CVE-2026-21589, an arbitrary file access flaw in Atlassian products. The Generic Rules template injection beta rule was merged into the original rule.","titleGenerated":"Cloudflare Application Security adds WAF blocks for TanStack XSS and Atlassian file access CVEs","titleShort":"TanStack XSS and Atlassian file access now blocked","breaking":"none","importance":3,"content":"This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.\n\n**Key Findings**\n\n- CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.\n    \n- CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.\n    \n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...02751ef3\n\nN/A\n\nGeneric Rules - Template Injection - 2 - Beta\n\nDisabled\n\nDisabled\n\nThis rule is merged into the original rule \"Generic Rules - Template Injection - 2\" (ID: ...d3ed0123).\n\nCloudflare Managed Ruleset\n\n...4ee560b2\n\nN/A\n\nTanStack - Reflected XSS - CVE:CVE-2026-102989\n\nN/A\n\nBlock\n\nThis is a new detection.\n\nCloudflare Managed Ruleset\n\n...e919cd31\n\nN/A\n\nAtlassian - Arbitrary File Access - CVE:CVE-2026-21589\n\nN/A\n\nBlock\n\nThis is a new detection.","publishedAt":"2026-10-12T00:00:00.000Z","fetchedAt":"2026-10-12T13:20:42.122Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/","media":[],"coverageCount":0},{"id":"rel_S9daKMle1KDisOsga--_R","version":null,"type":"feature","title":"API Shield - Run schema learning on demand","summary":"API Shield now supports manually triggering a schema learning run from the operations table's More options menu via Ad-hoc learn schema, covering the entire zone and using observed traffic with existing learning thresholds. The dialog shows learning status and the last completed zone run, and the Learned schema view reports results per operation while the zone-wide run continues.","titleGenerated":"Cloudflare API Shield adds on-demand schema learning runs","titleShort":"Schema learning runs on demand, no weekly wait","breaking":"none","importance":3,"content":"You can now manually request an API Shield schema learning run without waiting for the weekly schedule. Use this during testing after sending representative traffic to your API.\n\nIn **Web Assets** > **Operations**, open the **More options** menu for the operations table and select **Ad-hoc learn schema**. In the **Schema learning** dialog, select **Run learning**. The run covers the entire zone and uses observed traffic. Existing learning thresholds still apply.\n\nThe dialog shows the learning status and last completed run for the zone. The **Learned schema** view shows the learning result and last learning run for each operation. You can review individual results while the zone-wide run continues.\n\nFor instructions and traffic requirements, refer to [Run schema learning manually](https://developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-management/schema-learning/#run-schema-learning-manually).","publishedAt":"2026-10-12T00:00:00.000Z","fetchedAt":"2026-10-12T09:18:28.846Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-12-manual-schema-learning/","media":[],"coverageCount":0},{"id":"rel_qFh2FEM_8EgQxAGPrELtp","version":null,"type":"feature","title":"WAF, Rules - Failed detections field available in Rules","summary":"A new cf.appsec.request.failed_detections field exposes an Array<String> of detection IDs that reported failures from content scanning, WAF attack score, attack signature detection, leaked credentials detection, and AI prompt detections. It can be used in custom rules, rate limiting rules, and Request Header Transform Rules, and returns an empty array when no failures are reported.","titleGenerated":"Cloudflare Application Security adds cf.appsec.request.failed_detections field for WAF rules","titleShort":"WAF rules gain failed_detections field","breaking":"none","importance":3,"content":"You can now use `cf.appsec.request.failed_detections` to control how your rules handle requests when a security detection reports a failure.\n\nThe field is an `Array<String>` of detection IDs that reports failures from content scanning, WAF attack score, attack signature detection, leaked credentials detection, and AI prompt detections for personally identifiable information (PII), prompt injection, custom topics, and unsafe topics.\n\nThe field does not alter the existing behavior of detections. Use it in rules to choose how to handle requests with reported failures.\n\nWhen no failures are reported, the field returns `[]`. You can use it on all plans, but your plan must still include the detections and rule features you want to use.\n\nSupported rules:\n\n- Custom rules at the zone and account levels\n- Rate limiting rules at the zone and account levels\n- Request Header Transform Rules at the zone level\n\nMatch any reported failure:\n\n```\n<span class=\"line\"><span class=\"nb-shiki-wvjl67\">len(cf.appsec.request.failed_detections) gt 0</span></span>\n```\n\nMatch a reported leaked credentials detection failure:\n\n```\n<span class=\"line\"><span class=\"nb-shiki-wvjl67\">any(cf.appsec.request.failed_detections[*] eq \"waf_credential_check\")</span></span>\n```\n\nFor more information, refer to the [Failed detections field reference](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.appsec.request.failed_detections/).","publishedAt":"2026-10-09T00:00:00.000Z","fetchedAt":"2026-10-09T12:40:54.217Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-09-failed-detections/","media":[],"coverageCount":0},{"id":"rel_qwNqHIJIXbD_WgkRNJ5sV","version":null,"type":"feature","title":"WAF - Updated unsafe topic detection for AI Security for Apps","summary":"AI Security for Apps now uses an updated set of categories for detecting unsafe topics in incoming prompts, changing the available values of cf.llm.prompt.unsafe_topic_categories. Existing WAF custom rules remain valid, but rules referencing a removed or renamed category will no longer match that category.","titleGenerated":"Cloudflare Application Security updates WAF unsafe topic detection for AI Security for Apps","titleShort":"WAF unsafe topic categories changed; rules referencing removed values stop matching","breaking":"major","importance":3,"content":"AI Security for Apps now supports an updated set of categories for detecting unsafe topics in incoming prompts.\n\nThe values available in [`cf.llm.prompt.unsafe_topic_categories`](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.unsafe_topic_categories/) have changed. Existing WAF custom rules remain valid, but rules that reference a removed or renamed category will no longer match that category. Review any rules that use this field and update their expressions to use the currently supported values.\n\nFor category descriptions and configuration guidance, refer to [Unsafe topics](https://developers.cloudflare.com/waf/detections/ai-security-for-apps/unsafe-topics/).","publishedAt":"2026-10-07T00:00:00.000Z","fetchedAt":"2026-10-08T20:32:02.503Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-07-ai-security-for-apps-unsafe-topic-detection/","media":[],"coverageCount":0},{"id":"rel_ZkH5RszREJmkCLqPpsjMU","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-06","summary":"New Cloudflare Managed Ruleset detection for CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP that allows arbitrary code execution, now blocks instead of logging. Command Injection - Generic 8 - uri beta logic is merged into the baseline rule and moves from log to block, and the Next.js cache poisoning rule description was refined with no detection change.","titleGenerated":"Cloudflare WAF adds F5 BIG-IP heap-overflow detection and blocks command injection rule","titleShort":"F5 BIG-IP heap-overflow detection added; command injection rule now blocks","breaking":"none","importance":4,"content":"This release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.\n\n**Key Findings**\n\n- CVE-2026-94127: A heap-based buffer overflow vulnerability in F5 BIG-IP. Attackers can exploit this flaw to execute arbitrary code on the affected system.\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...a056caff\n\nN/A\n\nCommand Injection - Generic 8 - uri - Beta\n\nLog\n\nBlock\n\nThis rule is merged into the original rule \"Command Injection - Generic 8 - uri\" (ID: ...ee159e2e).\n\nCloudflare Managed Ruleset\n\n...7206c737\n\nN/A\n\nF5 BIG-IP - UnAuth Heap-Overflow - CVE:CVE-2026-94127\n\nLog\n\nBlock\n\nThis is a new detection.\n\nCloudflare Managed Ruleset\n\n...549f7356\n\nN/A\n\nNext.js - Cache Poisoning - CVE:CVE-2026-94543\n\nBlock\n\nBlock\n\nRule metadata description refined. Detection unchanged.","publishedAt":"2026-10-06T00:00:00.000Z","fetchedAt":"2026-10-06T16:03:19.582Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-06-waf-release/","media":[],"coverageCount":0},{"id":"rel_LmZ-7FH8tIBq5FBb9KOXx","version":null,"type":"feature","title":"WAF - WAF Release - 2026-10-01 - Emergency","summary":"Cloudflare Managed Ruleset adds a new block rule for CVE-2026-88771, an improper input validation flaw in Citrix NetScaler ADC and Gateway that allows an unauthenticated attacker to execute arbitrary commands. Administrators are advised to apply the latest Citrix versions and review configurations against applicable preconditions.","titleGenerated":"Cloudflare WAF adds emergency block rule for Citrix NetScaler CVE-2026-88771","titleShort":"Emergency WAF rule blocks Citrix NetScaler CVE-2026-88771","breaking":"none","importance":4,"content":"This update provides immediate defense against a vulnerability affecting Citrix NetScaler ADC and Gateway appliances, deploying protection against improper input validation vectors.\n\n**Key Findings**\n\n- CVE-2026-88771: An improper input validation vulnerability affecting Citrix NetScaler ADC and Gateway allows an unauthenticated attacker to execute arbitrary commands.\n\n**Impact**\n\nWe strongly recommend that administrators apply the latest versions to fully secure origin servers. Additionally, customers should review configurations against applicable preconditions and follow standard incident response processes if signs of compromise are identified.\n\nDetailed Rule Changes\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...827ab216\n\nN/A\n\nCitrix Netscaler ADC and Gateway - Improper input validation - CVE:CVE-2026-88771\n\nN/A\n\nBlock\n\nThis is a new detection.","publishedAt":"2026-10-01T00:00:00.000Z","fetchedAt":"2026-10-01T14:57:00.426Z","url":"https://developers.cloudflare.com/changelog/post/2026-10-01-emergency-waf-release/","media":[],"coverageCount":0},{"id":"rel_KBDjgxXT0z7FSfbyodYs9","version":null,"type":"feature","title":"WAF - WAF Release - 2026-09-30","summary":"New managed ruleset detections for GitLab path traversal CVE-2026-85706 and broken access control directory traversal switch from log to block, and a new rule blocks generic request routing cache inconsistency. Beta HTTP request smuggling and command injection rules are merged into their original rules.","titleGenerated":"Cloudflare WAF blocks GitLab path traversal CVE-2026-85706","titleShort":"GitLab path traversal CVE now blocked; smuggling ruleset merged","breaking":"major","importance":3,"content":"This release introduces new detections to enhance protection against a specific GitLab path traversal vulnerability, alongside advanced generic rules targeting HTTP request smuggling, directory traversal, and command injection attempts.\n\n**Key Findings**\n\n- CVE-2026-85706: A path traversal vulnerability affecting GitLab.\n\nRuleset\n\nRule ID\n\nLegacy Rule ID\n\nDescription\n\nPrevious Action\n\nNew Action\n\nComments\n\nCloudflare Managed Ruleset\n\n...cb14ded8\n\nN/A\n\nBroken Access Control - Directory Traversal\n\nLog\n\nBlock\n\nThis is a new detection.\n\nCloudflare Managed Ruleset\n\n...0364bd7e\n\nN/A\n\nHTTP Request Smuggling - Request Body Anomaly - Beta\n\nLog\n\nBlock\n\nThis rule is merged into the original rule \"HTTP/2 Request Smuggling - Request Body Anomaly\" (ID: ...1489d892).\n\nCloudflare Managed Ruleset\n\n...d498a69a\n\nN/A\n\nCommand Injection - Generic 8 - body - Beta\n\nDisabled\n\nDisabled\n\nThis rule is merged into the original rule \"Command Injection - Generic 8 - body\" (ID: ...413592e2).\n\nCloudflare Managed Ruleset\n\n...87ae8cfc\n\nN/A\n\nGitLab - Path Traversal- CVE:CVE-2026-85706\n\nLog\n\nBlock\n\nThis is a new detection.\n\nCloudflare Managed Ruleset\n\n...549f7356\n\nN/A\n\nGeneric - Request routing cache inconsistency\n\nN/A\n\nBlock\n\nThis is a new detection.","publishedAt":"2026-09-30T00:00:00.000Z","fetchedAt":"2026-10-01T06:52:32.836Z","url":"https://developers.cloudflare.com/changelog/post/2026-09-30-waf-release/","media":[],"coverageCount":0}],"pagination":{"nextCursor":"2026-09-30T00:00:00.000Z|2026-10-01T06:52:32.836Z|rel_KBDjgxXT0z7FSfbyodYs9","limit":20},"summaries":{"rolling":null,"monthly":[]}}