FeatureSep 1, 2026

WAF Release - 2026-09-01

This release introduces a new threat detection to enhance protection against SQL injection (SQLi) attempts exploiting complex query syntax.

Key Findings

SQLi Protection: Improved coverage for SQL injection patterns involving WHERE comparisons combined with WITH clauses.

Ruleset · Rule ID · Legacy Rule ID · Description · Previous Action · New Action · Comments

Cloudflare Managed Ruleset · d2d75b2f0614405f9fab0354bcfa0966 · N/A · SQLi - WHERE Comparison With WITH Clause · Log · Block · This is a new detection.

Read the original announcement

All WAF updates →

WAF Release - 2026-10-12
This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.
WAFFeatureOct 12, 2026
WAF Release - Scheduled changes for 2026-10-19
Announcement Date Release Date Release Behavior Legacy Rule ID Rule ID Description Comments 2026-10-12 2026-10-19 Log N/A d60e605ed36842df9ca0232f5ea9966d Broken Access Control - Directory Traversal (Beta) This rule will be merged into the original rule "Broken Access Control -…
WAFFeature

WAF Release - 2026-09-01

More from WAF

WAF Release - 2026-09-01

More from WAF