WAF Release - 2026-10-21 - Emergency - Cloudflare Managed Ruleset

WAF Release - 2026-10-21 - Emergency - Cloudflare Free Ruleset

This emergency release adds two rules to the Cloudflare Free Ruleset to block anomalous request patterns.

WAF Release - 2026-10-14 - Emergency

This emergency release adds a new managed rule to block active exploitation of a critical remote code execution (RCE) vulnerability found in popular web frameworks.

WAF Release - 2026-10-12

This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.

WAF Release - Scheduled changes for 2026-10-19

Announcement Date Release Date Release Behavior Legacy Rule ID Rule ID Description Comments 2026-10-12 2026-10-19 Log N/A d60e605ed36842df9ca0232f5ea9966d Broken Access Control - Directory Traversal (Beta) This rule will be merged into the original rule "Broken Access Control -…

Failed detections field available in Rules

You can now use cf.appsec.request.failed_detections to control how your rules handle requests when a security detection reports a failure.