WAF - WAF Release - 2026-05-04

This week's release focuses on new detections to expand coverage across command injection, SQL injection, PHP object injection, remote code execution, and XSS attack vectors.

Key Findings

• Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.

Continuous Rule Improvements

We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.

Ruleset

Rule ID

Legacy Rule ID

Description

Previous Action

New Action

Comments

Cloudflare Managed Ruleset

607ec27233b54beb8b89386ef0884a68

N/A

XSS, HTML Injection - Object Tag - Body (beta)

Log

Block

This is a new detection. This rule is merged into the original rule "XSS, HTML Injection - Object Tag" (ID: e9e3ac45a6d842f1a132fbf70c14e284 ).

Cloudflare Managed Ruleset

0087c27420c54168a10bc05eff012303

N/A

XSS, HTML Injection - Object Tag - Headers

Log

Block

This is a new detection. The rule previously known as "XSS, HTML Injection - Object Tag - Headers (beta)" is now renamed to "XSS, HTML Injection - Object Tag - Headers".

Cloudflare Managed Ruleset

38dc97853ebf40ed9476ec7816f921d9

N/A

XSS, HTML Injection - Object Tag - URI

Log

Block

This is a new detection. The rule previously known as "XSS, HTML Injection - Object Tag - URI (beta)" is now renamed to "XSS, HTML Injection - Object Tag - URI".

Cloudflare Managed Ruleset

963cb530f72d4c75b2ae7befdc90d21a

N/A

Command Injection - Generic 9 - Body Vector - Beta

N/A

Disabled

This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - Body Vector" (ID: 155bb67d1061479e995a38510677175f )

Cloudflare Managed Ruleset

6ac1b6dfe22449a798cc7021f8960375

N/A

Command Injection - Generic 9 - Header Vector - Beta

N/A

Disabled

This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - Header Vector" (ID: b31c34a7b29b4aaf9be6883d1eb7a999 )

Cloudflare Managed Ruleset

47a9b66dd73a4a558590c4bdef47a800

N/A

Command Injection - Generic 9 - URI Vector - Beta

N/A

Disabled

This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - URI Vector" (ID: 54ad0465c30d4cd2ac7a707197321c6c )

Cloudflare Managed Ruleset

d2ae4a8093f245a1b9de71bbbeebf804

N/A

Command Injection - Sleep - Body

N/A

Disabled

This is a new detection. The rule previously known as "Command Injection

• Sleep" is now renamed to "Command Injection - Sleep - Body".

Cloudflare Managed Ruleset

da91868c0d3d44afb846e7830d257566

N/A

Command Injection - Sleep - Headers

N/A

Disabled

This is a new detection.

Cloudflare Managed Ruleset

04863c61e982464b91778f051856fe86

N/A

Command Injection - Sleep - URI

N/A

Disabled

This is a new detection.

Cloudflare Managed Ruleset

9dc1a0b8dbb7425db619309be6e43c37

N/A

Fortinet FortiSandbox - Command Injection - CVE:CVE-2026-39808

Log

Block

This is a new detection.

Cloudflare Managed Ruleset

b84c10f5a8f84800905932dc88118795

N/A

Remote Code Execution - Common Bash Bypass - Headers

N/A

Disabled

This is a new detection.

Cloudflare Managed Ruleset

f496c40011f14bfdb5f55ec79299d53b

N/A

Remote Code Execution - Common Bash Bypass - URI

N/A

Disabled

This is a new detection.

Cloudflare Managed Ruleset

a5f75abac2664554a984d061b0bf33f9

N/A

Remote Code Execution - Common Bash Bypass - Body - Beta

N/A

Disabled

This is a new detection. This rule is merged into the original rule "Remote Code Execution - Common Bash Bypass Body" (ID: 6e2f7a696ea74c979e7d069cefb7e5b9 ). The rule previously known as "Remote Code Execution - Common Bash Bypass Beta" is now renamed to "Remote Code Execution - Common Bash Bypass Body".

Cloudflare Managed Ruleset

bbb31a886ab54f6c8cdd220d33bfe8b9

N/A

PHP Object Injection - 2 - Body - Beta

N/A

Disabled

This is a new detection. This rule is merged into the original rule "PHP Object Injection - 2" (ID: 8ef3c3f91eef46919cc9cb6d161aafdc )

Cloudflare Managed Ruleset

e199688ab69746c88c33457f29552387

N/A

PHP Object Injection - 2 - Headers

N/A

Disabled

This is a new detection.

Cloudflare Managed Ruleset

eb33d40e96c54e929af6ed9c8104f4c5

N/A

PHP Object Injection - 2 - URI

N/A

Disabled

This is a new detection.

Cloudflare Managed Ruleset

76b15b7b122a4be6a40d8aa96a46201e

N/A

SQLi - DROP - 2 - Beta

N/A

Disabled

This is a new detection. This rule is merged into the original rule "SQLi - DROP - 2" (ID: a967a167874b42b6898be46e48ac2221 )

Cloudflare Managed Ruleset

e24b2ef4a5c54f97a62db7a68b7f85ee

N/A

SQLi - DROP - 2 - Headers

N/A

Disabled

This is a new detection.

Cloudflare Managed Ruleset

51123f35f1d249358aea8fb11546b5f0

N/A

SQLi - DROP - 2 - URI

N/A

Disabled

This is a new detection.

Cloudflare Managed Ruleset

d86d8873310d41f2877458a91e053dce

N/A

SmarterMail - Remote Code Execution - CVE:CVE-2026-24423

Log

Block

This is a new detection.

Cloudflare Managed Ruleset

00da180570d34b5bae2121acd0023a36

N/A

SQLi - SELECT Expression - Body

Block

Disabled

Action changed

Cloudflare Managed Ruleset

c46d9097c9ef419aa4d9f10626cc211f

N/A

SQLi - String Concatenation - URI

Block

Disabled

Action changed