WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset

This emergency release updates the names and metadata of seven existing rules in the Cloudflare Managed Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.

Ruleset · Rule ID · Legacy Rule ID · Description · Previous Action · New Action · Comments

Cloudflare Managed Ruleset · c1d409ad838f47f59446f21cc438d5dd · N/A · PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) · Block · N/A · Rule metadata description refined. Detection unchanged.

Cloudflare Managed Ruleset · f9a45927414245e3a64bb12d0a0c2f64 · N/A · PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 · Block · N/A · Rule metadata description refined. Detection unchanged.

Cloudflare Managed Ruleset · 771c654ae1154d4daa72f4e1545d163c · N/A · PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 · Block · N/A · Rule metadata description refined. Detection unchanged.

Cloudflare Managed Ruleset · 217005865f0145f392300bac212afcc9 · N/A · PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4 · Block · N/A · Rule metadata description refined. Detection unchanged.

Cloudflare Managed Ruleset · 38efdb17ea594501bb55a1d71867b12e · N/A · PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5 · Block · N/A · Rule metadata description refined. Detection unchanged.

Cloudflare Managed Ruleset · 4148ae686fdb4d01be673fab9d9c073d · N/A · PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6 · Block · N/A · Rule metadata description refined. Detection unchanged.

Cloudflare Managed Ruleset · 1389aa259617437392ce149c48143645 · N/A · PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7 · Block · N/A · Rule metadata description refined. Detection unchanged.

For more information, refer to WAF Managed Rules.