WAF Release - 2026-10-14 - Emergency

This emergency release adds a new managed rule to block active exploitation of a critical remote code execution (RCE) vulnerability found in popular web frameworks.

Key Findings

Key Findings

• Generic Rules - Remote Code Execution: Attackers can execute arbitrary system commands with web server privileges by sending malicious input containing invalid path sequences during request processing.

Ruleset · Rule ID · Legacy Rule ID · Description · Previous Action · New Action · Comments

Cloudflare Managed Ruleset · 44131076d2fa41fb97c61ec2fd1bf420 · N/A · Generic Rules - Remote Code Execution · N/A · Block · This is a new detection.