On 2026‑11‑03 Cloudflare published a WAF release that revises the rule expressions used to detect PHP out‑of‑memory (OOM) remote‑code‑execution (RCE) vulnerabilities (CVE‑2026‑109618, CVE‑2026‑109619) and adds a fresh detection for a phpMyAdmin authentication‑bypass issue (CVE‑2026‑115560). The changes are incremental, driven by findings from the PHP Capture the Flag challenge, and affect both the Free and Managed rulesets.
Updated PHP RCE detection
Four rules – two in the Free ruleset and two in the Managed ruleset – retain their Block action but have their detection logic refreshed. The rule identifiers are:
- Free ruleset:
00c10e6cc4da4bd08722adeebcd95984(rule #2) and48ddf592361e4fdb97a8a85982dab691(rule #3) - Managed ruleset:
f9a45927414245e3a64bb12d0a0c2f64(rule #2) and771c654ae1154d4daa72f4e1545d163c(rule #3)
All four continue to block matching traffic, but the underlying expression that triggers the block has been refined. The practical effect is a tighter match on the specific PHP OOM patterns that lead to RCE, potentially reducing false positives while preserving protection.
New phpMyAdmin authentication‑bypass rule
A fifth rule targeting a phpMyAdmin authentication‑bypass vulnerability (CVE‑2026‑115560) appears in the Managed ruleset with identifier 96284f85f5984e29be0616f013f91633. The rule’s action is listed as Disabled, indicating that the detection is present but not enforced. This is a “new detection” according to the release notes.
Because the rule is disabled, traffic will not be blocked automatically, but the rule can be enabled manually if an organization runs phpMyAdmin and wishes to enforce the check.
Operational considerations
From an operations standpoint, the rule updates require a brief validation step:
- Review WAF logs for the updated PHP RCE rule IDs to confirm that legitimate traffic is still being blocked as intended and that no new false positives appear.
- If phpMyAdmin is part of the application stack, evaluate the risk of the bypass vulnerability and decide whether to enable the newly added rule.
- Because the action for the phpMyAdmin rule is disabled, enabling it will change the security posture; plan a staged rollout and monitor for any impact on user access.
All changes are delivered automatically to customers using the affected rulesets; no manual rule‑set version bump is required.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Engineers should confirm that the refreshed PHP RCE rules are active in their environment and that existing alerting pipelines reference the new rule IDs. For sites that host phpMyAdmin, consider enabling the disabled detection after a risk assessment, and watch the WAF logs for any matches. Ongoing monitoring will ensure that the tighter detection does not unintentionally block legitimate PHP traffic while still protecting against the disclosed OOM‑based RCE vectors.