WAF Release - Scheduled changes for 2026-10-19

WAF Release - 2026-10-12

This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.

Failed detections field available in Rules

You can now use cf.appsec.request.failed_detections to control how your rules handle requests when a security detection reports a failure.

Updated unsafe topic detection for AI Security for Apps

AI Security for Apps now supports an updated set of categories for detecting unsafe topics in incoming prompts.

WAF Release - 2026-10-06

This release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.

WAF Release - 2026-10-01 - Emergency

This update provides immediate defense against a vulnerability affecting Citrix NetScaler ADC and Gateway appliances, deploying protection against improper input validation vectors.