Sign inGet started
Provider changes/CloudflareCLOUDFLARE · VERIFIED CHANGE

Cloudflare updated existing WAF rule detection

Cloudflare updated existing WAF rule detection for PHP vulnerabilities in the October 28 and October 30 releases. Block actions remain unchanged, but the underlying detection expressions change.

Verified Oct 30, 20261 official source

Mentioned in the evidence

  • Cloudflare WAF
  • Cloudflare Managed Ruleset
  • Cloudflare Free Ruleset
  • Cloudflare Response Ruleset

Official source

  • Cloudflare developer changelog (changelog) ↗
    This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative changes based on reports from Security Researchers as part of PHP Capture the Flag (

This is a global change, verified against Cloudflare’s own sources. It is not an assessment of your systems or your impact.

A global change is not your impact.

Auterim checks your confirmed dependencies and can verify repository references when GitHub is connected.

Scan a company URLMore Cloudflare changesMore from this provider