Cloudflare has released a new version of its Web Application Firewall (WAF) rule set that refines the detection logic for PHP OOM‑related remote‑code‑execution attacks. The update targets the Managed Ruleset, Free Ruleset, and Response Ruleset, keeping the block action unchanged while improving how the signatures identify the vulnerable patterns reported in CVE‑2026‑109618, CVE‑2026‑109619 and CVE‑2026‑115560.
What changed in the rule set
The release modifies the underlying rule expressions for four specific signatures:
- Two signatures labeled “PHP Remote Code Execution Attack #3” in both the Managed and Free rulesets.
- Two signatures labeled “PHP Remote Code Execution Attack #4” in both the Managed and Free rulesets.
- A default high‑confidence signature in the Response Ruleset that blocks suspicious traffic.
All affected rules continue to issue a Block response; the only difference is the updated detection criteria. No new rule IDs were introduced, and the legacy rule IDs remain listed as N/A.
Why it matters for engineers
Practitioners who host PHP applications behind Cloudflare’s WAF should be aware that the detection surface for these CVEs has been sharpened. The practical impact includes:
- Reduced false negatives: Updated expressions are designed to catch exploit attempts that may have slipped past the previous logic.
- Consistent blocking behavior: Because the action stays at
Block, existing automation that reacts to blocked events does not need to be altered. - Alignment with researcher findings: The changes incorporate feedback from the PHP Capture the Flag (CTF) challenge, indicating that the rule set now reflects the latest attack techniques observed in the wild.
Operational considerations
While the rule actions are unchanged, the update does have a few operational implications:
- Rule set versioning: Ensure that your Cloudflare account is set to automatically receive the latest Managed or Free ruleset version. Manual pinning could leave you on an older detection baseline.
- Custom rule interactions: If you have custom WAF rules that reference the same request attributes, verify that they still behave as intended after the detection tweak.
- Log monitoring: Expect a possible shift in the volume or pattern of
Blockevents for PHP traffic. Compare recent logs against a baseline to spot any unexpected spikes. - Testing in staging: Deploy the updated ruleset in a non‑production environment first, if you rely on a staged rollout, to confirm that legitimate traffic is not inadvertently blocked.
Related CloudNinjas coverage: security.
What This Means For Practitioners
In short, the rule update is a maintenance‑level improvement that strengthens protection against known PHP OOM exploits without requiring configuration changes. Keep your WAF ruleset current, watch for changes in blocked event metrics, and validate that any custom rule logic remains compatible. By doing so, you maintain a reliable defensive posture against the latest PHP‑related attack vectors.