This emergency release updates the names and metadata of seven existing rules in the Cloudflare Free Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged. Ruleset Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Free Ruleset …b5ccf32f N/A PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) Block N/A Rule metadata description refined.
WAF - WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset
calendar_today
October 22, 2026
domain
cloudflare