This emergency release updates the names and metadata of seven existing rules in the Cloudflare Managed Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged. Ruleset Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Managed Ruleset …c438d5dd N/A PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) Block N/A Rule metadata description refined.
WAF - WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset
calendar_today
October 22, 2026
domain
cloudflare