WAF Release - 2026-10-21 - Emergency - Cloudflare Free Ruleset

WAF Release - 2026-10-21 - Emergency - Cloudflare Managed Ruleset

This emergency release adds four rules to the Cloudflare Managed Ruleset to detect anomalous request patterns. Two rules block matching requests, and two log matches without blocking.

WAF Release - 2026-10-14 - Emergency

This emergency release adds a new managed rule to block active exploitation of a critical remote code execution (RCE) vulnerability found in popular web frameworks.

WAF Release - 2026-10-12

This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.

WAF Release - Scheduled changes for 2026-10-19

Announcement Date Release Date Release Behavior Legacy Rule ID Rule ID Description Comments 2026-10-12 2026-10-19 Log N/A d60e605ed36842df9ca0232f5ea9966d Broken Access Control - Directory Traversal (Beta) This rule will be merged into the original rule "Broken Access Control -…

Failed detections field available in Rules

You can now use cf.appsec.request.failed_detections to control how your rules handle requests when a security detection reports a failure.