Application Security

Rule detection is updated across the Cloudflare Managed, Free, and Response rulesets for PHP out-of-memory vulnerabilities CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560, based on researcher reports from Cloudflare's PHP CTF challenge. Detection actions remain Block.

Workers subrequests targeting Cloudflare-proxied BYOIP hostnames are now identified as Cloudflare-to-Cloudflare traffic, preserving the CF-Worker header and cf.worker.upstream_zone field and making Bot Management fields reflect the original end-user connection instead of the internal one. Cross-zone subrequests now set CF-Connecting-IP to the Workers client IP 2a06:98c0:3600::103, while same-zone subrequests still reflect the client IP.

An emergency release adds a disabled-by-default Cloudflare Managed Ruleset rule for a vulnerability in Nuxt Image and IPX, offering only partial coverage; the advisory recommends patching to the latest version.

Cloudflare updated the underlying rule expressions in its Managed and Free rulesets for PHP out-of-memory vulnerabilities CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560, based on researcher reports from its PHP CTF challenge. Both rules keep the Block action; only detection changed.

Challenge Pages served through the Cloudflare China Network now use Turnstile widgets hosted in Mainland China, so visitors there no longer need cross-border requests to complete challenges. The change applies automatically to China Network zones, and global-network visitors continue to receive the global Challenge Page experience.

Two Cloudflare Managed Ruleset rules for CVE-2026-111497 are enabled by default in Log mode: one matching requests with Content-Encoding: br, one matching the Next.js image optimization path /_next/image. Customers with a ruleset-level Block action override will have matching legitimate traffic blocked on deployment unless they add rule-specific Log overrides.

An emergency release updates the names and metadata of seven existing Cloudflare Managed Ruleset rules to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.

Emergency release updates the names and metadata of seven existing Cloudflare Free Ruleset rules to identify CVE-2026-109618 and CVE-2026-109619, all covering PHP remote code execution attacks. Detection logic and block actions remain unchanged.

An emergency WAF release adds two rules to the Cloudflare Free Ruleset that block generic anomalous execution request patterns. Both are new detections that move straight to a Block action.

An emergency WAF release adds four rules to the Cloudflare Managed Ruleset to detect anomalous request patterns, two blocking matching requests and two logging matches without blocking.

The Precursor Status dropdown now offers Off, Monitor, and Arm, where Monitor lets detections be tested without affecting bot score or Challenge clearance. The Precursor Interstitial is also separated from the mode, with a sitewide Show Interstitial default plus Interstitial Rules for specific requests such as requiring a challenge on /checkout.

An emergency release adds a new Cloudflare Managed Ruleset rule (Generic Rules - Remote Code Execution, rule ID ending fd1bf420) set to Block, targeting active exploitation of a critical RCE vulnerability in popular web frameworks where malicious input with invalid path sequences lets attackers run system commands with web server privileges.

Workers subrequests targeting BYOIP hostnames now preserve the CF-Worker header and cf.worker.upstream_zone field, and Bot Management fields on the destination zone reflect the original end-user connection instead of the internal Cloudflare connection. The change fixes unexpected security rule evaluation and false 403 responses, and applies automatically with no configuration changes.

New WAF detections block CVE-2026-102989, a reflected XSS in TanStack, and CVE-2026-21589, an arbitrary file access flaw in Atlassian products. The Generic Rules template injection beta rule was merged into the original rule.

API Shield now supports manually triggering a schema learning run from the operations table's More options menu via Ad-hoc learn schema, covering the entire zone and using observed traffic with existing learning thresholds. The dialog shows learning status and the last completed zone run, and the Learned schema view reports results per operation while the zone-wide run continues.

A new cf.appsec.request.failed_detections field exposes an Array of detection IDs that reported failures from content scanning, WAF attack score, attack signature detection, leaked credentials detection, and AI prompt detections. It can be used in custom rules, rate limiting rules, and Request Header Transform Rules, and returns an empty array when no failures are reported.

AI Security for Apps now uses an updated set of categories for detecting unsafe topics in incoming prompts, changing the available values of cf.llm.prompt.unsafe_topic_categories. Existing WAF custom rules remain valid, but rules referencing a removed or renamed category will no longer match that category.

New Cloudflare Managed Ruleset detection for CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP that allows arbitrary code execution, now blocks instead of logging. Command Injection - Generic 8 - uri beta logic is merged into the baseline rule and moves from log to block, and the Next.js cache poisoning rule description was refined with no detection change.

Cloudflare Managed Ruleset adds a new block rule for CVE-2026-88771, an improper input validation flaw in Citrix NetScaler ADC and Gateway that allows an unauthenticated attacker to execute arbitrary commands. Administrators are advised to apply the latest Citrix versions and review configurations against applicable preconditions.

New managed ruleset detections for GitLab path traversal CVE-2026-85706 and broken access control directory traversal switch from log to block, and a new rule blocks generic request routing cache inconsistency. Beta HTTP request smuggling and command injection rules are merged into their original rules.