Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds

Application security

Mar 12, 2026

1. WAF Release - 2026-03-12 - Emergency

   WAF

   This week's release introduces new detections for vulnerabilities in Ivanti Endpoint Manager Mobile (CVE-2026-1281 and CVE-2026-1340), alongside a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts within the Content-Security-Policy (CSP) HTTP request header.

   Key Findings

   • CVE-2026-1281 & CVE-2026-1340: Ivanti Endpoint Manager Mobile processes HTTP requests through Apache RevwriteMap directives that pass user-controlled input to Bash scripts (/mi/bin/map-appstore-url and /mi/bin/map-aft-store-url). Bash scripts do not sanitize user input and are vulnerable to shell arithmetic expansion thereby allowing attackers to achieve unauthenticated remote code execution.
   • Generic XSS in CSP Header: This rule identifies malicious payloads embedded within the request's Content-Security-Policy header. It specifically targets scenarios where web frameworks or applications trust and extract values directly from the CSP header in the incoming request without sufficient validation. Attackers can provide crafted header values to inject scripts or malicious directives that are subsequently processed by the server.

   Impact

   Successful exploitation of Ivanti EPMM vulnerability allows unauthenticated remote code execution and generic XSS in CSP header allows attackers to inject malicious scripts during page rendering. In environments using server-side caching, this poisoned XSS content can subsequently be cached and automatically served to all visitors.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...796ea2f6	N/A	Ivanti EPMM - Code Injection - CVE:CVE-2026-1281 CVE:CVE-2026-1340	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...ee964a8c	N/A	Anomaly:Header:Content-Security-Policy	N/A	Block	This is a new detection.

Mar 09, 2026

1. New Vulnerability Scanner for API Shield

   API Shield

   Introducing Cloudflare's Web and API Vulnerability Scanner (Open Beta)

   Cloudflare is launching the Open Beta of the Web and API Vulnerability Scanner ↗ for all API Shield customers. This new, stateful Dynamic Application Security Testing (DAST) platform helps teams proactively find logic flaws in their APIs.

   The initial release focuses on detecting Broken Object Level Authorization (BOLA) vulnerabilities by building API call graphs to simulate attacker and owner contexts, then testing these contexts by sending real HTTP requests to your APIs.

   The scanner is now available via the Cloudflare API. To scan, set up your target environment, owner and attacker credentials, and upload your OpenAPI file with response schemas. The scanner will be available in the Cloudflare dashboard in a future release.

   Access: This feature is only available to API Shield subscribers via the Cloudflare API. We hope you will use the API for programmatic integration into your CI/CD pipelines and security dashboards.

   Documentation: Refer to the developer documentation to start scanning your endpoints today.

Mar 06, 2026

1. Dismiss and filter matches in Brand Protection

   Security Center

   We have introduced new triage controls to help you manage your Brand Protection results more efficiently. You can now clear out the noise by dismissing matches while maintaining full visibility into your historical decisions.

   What's new

   • Dismiss matches: Users can now mark specific results as dismissed if they are determined to be benign or false positives, removing them from the primary triage view.
   • Show/Hide toggle: A new visibility control allows you to instantly switch between viewing only active matches and including previously dismissed ones.
   • Persistent review states: Dismissed status is saved across sessions, ensuring that your workspace remains organized and focused on new or high-priority threats.

   Key benefits of the dismiss match functionality:

   • Reduce alert fatigue by hiding known-safe results, allowing your team to focus exclusively on unreviewed or high-risk infringements.
   • Auditability and recovery through the visibility toggle, ensuring that no match is ever truly "lost" and can be re-evaluated if a site's content changes.
   • Improved collaboration as your team members can see which matches have already been vetted and dismissed by others.

   Ready to clean up your match queue? Learn more in our Brand Protection documentation.

Mar 02, 2026

1. WAF Release - 2026-03-02

   WAF

   This week's release introduces new detections for vulnerabilities in SmarterTools SmarterMail (CVE-2025-52691 and CVE-2026-23760), alongside improvements to an existing Command Injection (nslookup) detection to enhance coverage.

   Key Findings

   • CVE-2025-52691: SmarterTools SmarterMail mail server is vulnerable to Arbitrary File Upload, allowing an unauthenticated attacker to upload files to any location on the mail server, potentially enabling remote code execution.
   • CVE-2026-23760: SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API permitting unaunthenticated to reset system administrator accounts failing to verify existing password or reset token.

   Impact

   Successful exploitation of these SmarterMail vulnerabilities could lead to full system compromise or unauthorized administrative access to mail servers. Administrators are strongly encouraged to apply vendor patches without delay.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...966ec6b1	N/A	SmarterMail - Arbitrary File Upload - CVE-2025-52691	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...ee964a8c	N/A	SmarterMail - Authentication Bypass - CVE-2026-23760	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...75b64d99	N/A	Command Injection - Nslookup - Beta	Log	Block	This rule is merged into the original rule "Command Injection - Nslookup" (ID: ...b090ba9a )

Mar 02, 2026

1. WAF Release - Scheduled changes for 2026-03-09

   WAF

   Announcement Date	Release Date	Release Behavior	Legacy Rule ID	Rule ID	Description	Comments
   2026-03-02	2026-03-09	Log	N/A	...796ea2f6	Ivanti EPMM - Code Injection - CVE:CVE-2026-1281 CVE:CVE-2026-1340	This is a new detection.

Feb 23, 2026

1. Saved views for Threat Events

   Security Center

   TL;DR: You can now create and save custom configurations of the Threat Events dashboard, allowing you to instantly return to specific filtered views — such as industry-specific attacks or regional Sankey flows — without manual reconfiguration.

   Why this matters

   Threat intelligence is most effective when it is personalized. Previously, analysts had to manually re-apply complex filters (like combining specific industry datasets with geographic origins) every time they logged in. This update provides material value by:

   • Analysts can now jump straight into "Known Ransomware Infrastructure" or "Retail Sector Targets" views with a single click, eliminating repetitive setup tasks
   • Teams can ensure everyone is looking at the same data subsets by using standardized saved views, reducing the risk of missing critical patterns due to inconsistent filtering.

   Cloudforce One subscribers can start saving their custom views now in Application Security > Threat Intelligence > Threat Events ↗.

Feb 20, 2026

1. Manage Cloudflare Tunnel directly from the main Cloudflare Dashboard

   Cloudflare Tunnel Cloudflare Tunnel for SASE

   Cloudflare Tunnel is now available in the main Cloudflare Dashboard at Networking > Tunnels ↗, bringing first-class Tunnel management to developers using Tunnel for securing origin servers.

   

   This new experience provides everything you need to manage Tunnels for public applications, including:

   • Full Tunnel lifecycle management: Create, configure, delete, and monitor all your Tunnels in one place.
   • Native integrations: View Tunnels by name when configuring DNS records and Workers VPC — no more copy-pasting UUIDs.
   • Real-time visibility: Monitor replicas and Tunnel health status directly in the dashboard.
   • Routing map: Manage all ingress routes for your Tunnel, including public applications, private hostnames, private CIDRs, and Workers VPC services, from a single interactive interface.

   Choose the right dashboard for your use case

   Core Dashboard: Navigate to Networking > Tunnels ↗ to manage Tunnels for:

   • Securing origin servers and public applications with CDN, WAF, Load Balancing, and DDoS protection
   • Connecting Workers to private services via Workers VPC

   Cloudflare One Dashboard: Navigate to Zero Trust > Networks > Connectors ↗ to manage Tunnels for:

   • Securing your public applications with Zero Trust access policies
   • Connecting users to private applications
   • Building a private mesh network

   Both dashboards provide complete Tunnel management capabilities — choose based on your primary workflow.

   Get started

   New to Tunnel? Learn how to get started with Cloudflare Tunnel or explore advanced use cases like securing SSH servers or running Tunnels in Kubernetes.

Feb 19, 2026

1. Cloudforce One Threat events graphs are now visible in the dashboard

   Security Center

   We have introduced dynamic visualizations to the Threat Events dashboard to help you better understand the threat landscape and identify emerging patterns at a glance.

   What's new:

   • Sankey Diagrams: Trace the flow of attacks from country of origin to target country to identify which regions are being hit hardest and where the threat infrastructure resides.
   
   • Dataset Distribution over time: Instantly pivot your view to understand if a specific campaign is targeting your sector or if it is a broad-spectrum commodity attack.
   
   • Enhanced Filtering: Use these visual tools to filter and drill down into specific attack vectors directly from the charts.

   Cloudforce One subscribers can explore these new views now in Application Security > Threat Intelligence > Threat Events ↗.

Feb 16, 2026

1. WAF Release - 2026-02-16

   WAF

   This week’s release introduces new detections for CVE-2025-68645 and CVE-2025-31125.

   Key Findings

   • CVE-2025-68645: A Local File Inclusion (LFI) vulnerability in the Webmail Classic UI of Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 allows unauthenticated remote attackers to craft requests to the /h/rest endpoint, improperly influence internal dispatching, and include arbitrary files from the WebRoot directory.
   • CVE-2025-31125: Vite, the JavaScript frontend tooling framework, exposes content of non-allowed files via ?inline&import when its development server is network-exposed, enabling unauthorized attackers to read arbitrary files and potentially leak sensitive information.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...833761f7	N/A	Zimbra - Local File Inclusion - CVE:CVE-2025-68645	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...950ed8c8	N/A	Vite - WASM Import Path Traversal - CVE:CVE-2025-31125	Log	Block	This is a new detection.

Feb 12, 2026

1. Enhanced Logo Matching for Brand Protection

   Security Center

   We have significantly upgraded our Logo Matching capabilities within Brand Protection. While previously limited to approximately 100% matches, users can now detect a wider range of brand assets through a redesigned matching model and UI.

   What's new

   • Configurable match thresholds: Users can set a minimum match score (starting at 75%) when creating a logo query to capture subtle variations or high-quality impersonations.
   • Visual match scores: Allow users to see the exact percentage of the match directly in the results table, highlighted with color-coded lozenges to indicate severity.
   • Direct logo previews: Available in the Cloudflare dashboard — similar to string matches — to verify infringements at a glance.

   Key benefits

   • Expose sophisticated impersonators who use slightly altered logos to bypass basic detection filters.
   • Faster triage of the most relevant threats immediately using visual indicators, reducing the time spent manually reviewing matches.

   Ready to protect your visual identity? Learn more in our Brand Protection documentation.

Feb 10, 2026

1. WAF Release - 2026-02-10

   WAF

   This week’s release changes the rule action from BLOCK to Disabled for Anomaly:Header:User-Agent - Fake Google Bot.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...6aa0bef8	N/A	Anomaly:Header:User-Agent - Fake Google Bot	Enabled	Disabled	We are changing the action for this rule from BLOCK to Disabled

Feb 03, 2026

1. Threat actor identification with "also known as" aliases

   Security Center

   Identifying threat actors can be challenging, because naming conventions often vary across the security industry. To simplify your research, Cloudflare Threat Events now include an Also known as field, providing a list of common aliases and industry-standard names for the groups we track.

   This new field is available in both the Cloudflare dashboard and via the API. In the dashboard, you can view these aliases by expanding the event details side panel (under the Attacker field) or by adding it as a column in your configurable table view.

   Key benefits

   • Easily map Cloudflare-tracked actors to the naming conventions used by other vendors without manual cross-referencing.
   • Quickly identify if a detected threat actor matches a group your team is already monitoring via other intelligence feeds.

   For more information on how to access this data, refer to the Threat Events API documentation ↗.

Feb 02, 2026

1. WAF Release - 2026-02-02

   WAF

   This week’s release introduces new detections for CVE-2025-64459 and CVE-2025-24893.

   Key Findings

   • CVE-2025-64459: Django versions prior to 5.1.14, 5.2.8, and 4.2.26 are vulnerable to SQL injection via crafted dictionaries passed to QuerySet methods and the Q() class.
   • CVE-2025-24893: XWiki allows unauthenticated remote code execution through crafted requests to the SolrSearch endpoint, affecting the entire installation.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...30698ff3	N/A	XWiki - Remote Code Execution - CVE:CVE-2025-24893 2	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...da8ba7e6	N/A	Django SQLI - CVE:CVE-2025-64459	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...8d667511	N/A	NoSQL, MongoDB - SQLi - Comparison - 2	Block	Block	Rule metadata description refined. Detection unchanged.

Jan 27, 2026

1. Control request and response body buffering in Configuration Rules

   Rules

   You can now control how Cloudflare buffers HTTP request and response bodies using two new settings in Configuration Rules.

   Request body buffering

   Controls how Cloudflare buffers HTTP request bodies before forwarding them to your origin server:

   Mode	Behavior
   Standard (default)	Cloudflare can inspect a prefix of the request body for enabled functionality such as WAF and Bot Management.
   Full	Buffers the entire request body before sending to origin.
   None	No buffering — the request body streams directly to origin without inspection.

   Response body buffering

   Controls how Cloudflare buffers HTTP response bodies before forwarding them to the client:

   Mode	Behavior
   Standard (default)	Cloudflare can inspect a prefix of the response body for enabled functionality.
   None	No buffering — the response body streams directly to the client without inspection.

   Warning

   Setting body buffering to None may break security functionality that requires body inspection, including the Web Application Firewall (WAF) and Bot Management. Ensure that any paths where you disable buffering do not require security inspection.

   Availability

   These settings only take effect on zones running Cloudflare's latest CDN proxy ↗. Enterprise customers can contact their account team to enable the latest proxy on their zones.

   API example

   {
     "action": "set_config",
     "action_parameters": {
       "request_body_buffering": "standard",
       "response_body_buffering": "none"
     }
   }

   For more information, refer to Configuration Rules.

Jan 26, 2026

1. WAF Release - 2026-01-26

   WAF

   This week’s release introduces new detections for denial-of-service attempts targeting React CVE-2026-23864 (https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗).

   Key Findings

   • CVE-2026-23864 (https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗) affects react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages.
   • Attackers can send crafted HTTP requests to Server Function endpoints, causing server crashes, out-of-memory exceptions, or excessive CPU usage.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...61680354	N/A	React Server - DOS - CVE:CVE-2026-23864 - 1	N/A	Block	This is a new detection.
   Cloudflare Managed Ruleset	...dcdffcf8	N/A	React Server - DOS - CVE:CVE-2026-23864 - 2	N/A	Block	This is a new detection.
   Cloudflare Managed Ruleset	...349edbc6	N/A	React Server - DOS - CVE:CVE-2026-23864 - 3	N/A	Block	This is a new detection.

Jan 22, 2026

1. New cryptographic functions — encode_base64() and sha256()

   Rules

   Cloudflare Rulesets now includes encode_base64() and sha256() functions, enabling you to generate signed request headers directly in rule expressions. These functions support common patterns like constructing a canonical string from request attributes, computing a SHA256 digest, and Base64-encoding the result.

   ---

   New functions

   Function	Description	Availability
   encode_base64(input, flags)	Encodes a string to Base64 format. Optional flags parameter: u for URL-safe encoding, p for padding (adds = characters to make the output length a multiple of 4, as required by some systems). By default, output is standard Base64 without padding.	All plans (in header transform rules)
   sha256(input)	Computes a SHA256 hash of the input string.	Requires enablement

   Note

   The sha256() function is available as an Enterprise add-on and requires a specific entitlement. Contact your account team to enable it.

   ---

   Examples

   Encode a string to Base64 format:

   encode_base64("hello world")

   Returns: aGVsbG8gd29ybGQ

   Encode a string to Base64 format with padding:

   encode_base64("hello world", "p")

   Returns: aGVsbG8gd29ybGQ=

   Perform a URL-safe Base64 encoding of a string:

   encode_base64("hello world", "u")

   Returns: aGVsbG8gd29ybGQ

   Compute the SHA256 hash of a secret token:

   sha256("my-token")

   Returns a hash that your origin can validate to authenticate requests.

   Compute the SHA256 hash of a string and encode the result to Base64 format:

   encode_base64(sha256("my-token"))

   Combines hashing and encoding for systems that expect Base64-encoded signatures.

   For more information, refer to the Functions reference.

Jan 20, 2026

1. New functions for array and map operations

   Rules

   New functions for array and map operations

   Cloudflare Rulesets now include new functions that enable advanced expression logic for evaluating arrays and maps. These functions allow you to build rules that match against lists of values in request or response headers, enabling use cases like country-based blocking using custom headers.

   ---

   New functions

   Function	Description
   split(source, delimiter)	Splits a string into an array of strings using the specified delimiter.
   join(array, delimiter)	Joins an array of strings into a single string using the specified delimiter.
   has_key(map, key)	Returns true if the specified key exists in the map.
   has_value(map, value)	Returns true if the specified value exists in the map.

   ---

   Example use cases

   Check if a country code exists in a header list:

   has_value(split(http.response.headers["x-allow-country"][0], ","), ip.src.country)

   Check if a specific header key exists:

   has_key(http.request.headers, "x-custom-header")

   Join array values for logging or comparison:

   join(http.request.headers.names, ", ")

   For more information, refer to the Functions reference.

Jan 20, 2026

1. WAF Release - 2026-01-20

   WAF

   This week's release focuses on improvements to existing detections to enhance coverage.

   Key Findings

   • Existing rule enhancements have been deployed to improve detection resilience against SQL injection.
   
   

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...68d90c8f	N/A	SQLi - Comment - Beta	Log	Block	This rule is merged into the original rule "SQLi - Comment" (ID: ...6d8d8fe4 )
   Cloudflare Managed Ruleset	...faa045cf	N/A	SQLi - Comparison - Beta	Log	Block	This rule is merged into the original rule "SQLi - Comparison" (ID: ...e7907480 )

Jan 15, 2026

1. Verify WARP Connector connectivity with a simple ping

   Cloudflare Tunnel Cloudflare Tunnel for SASE

   We have made it easier to validate connectivity when deploying WARP Connector as part of your software-defined private network.

   You can now ping the WARP Connector host directly on its LAN IP address immediately after installation. This provides a fast, familiar way to confirm that the Connector is online and reachable within your network before testing access to downstream services.

   Starting with version 2025.10.186.0, WARP Connector responds to traffic addressed to its own LAN IP, giving you immediate visibility into Connector reachability.

   Learn more about deploying WARP Connector and building private network connectivity with Cloudflare One.

Jan 15, 2026

1. WAF Release - 2026-01-15

   WAF

   This week's release focuses on improvements to existing detections to enhance coverage.

   Key Findings

   • Existing rule enhancements have been deployed to improve detection resilience against SQL Injection.
   
   

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...ad7dad3e	N/A	SQLi - String Function - Beta	Log	Block	This rule is merged into the original rule "SQLi - String Function" (ID: ...d32b798c )
   Cloudflare Managed Ruleset	...9e553ad3	N/A	SQLi - Sub Query - Beta	Log	Block	This rule is merged into the original rule "SQLi - Sub Query" (ID: ...743e66b1 )

Jan 14, 2026

1. URL Scanner now supports PDF report downloads

   Security Center

   We have expanded the reporting capabilities of the Cloudflare URL Scanner. In addition to existing JSON and HAR exports, users can now generate and download a PDF report directly from the Cloudflare dashboard. This update streamlines how security analysts can share findings with stakeholders who may not have access to the Cloudflare dashboard or specialized tools to parse JSON and HAR files.

   Key Benefits:

   • Consolidate scan results, including screenshots, security signatures, and metadata, into a single, portable document
   • Easily share professional-grade summaries with non-technical stakeholders or legal teams for faster incident response

   What’s new:

   • PDF Export Button: A new download option is available in the URL Scanner results page within the Cloudflare dashboard
   • Unified Documentation: Access all scan details—from high-level summaries to specific security flags—in one offline-friendly file

   To get started with the URL Scanner and explore our reporting capabilities, visit the URL Scanner API documentation ↗.

   ---

Jan 12, 2026

1. Metro code field now available in Rules

   Rules

   The ip.src.metro_code field in the Ruleset Engine is now populated with DMA (Designated Market Area) data.

   You can use this field to build rules that target traffic based on geographic market areas, enabling more granular location-based policies for your applications.

   Field details

   Field	Type	Description
   ip.src.metro_code	String | null	The metro code (DMA) of the incoming request's IP address. Returns the designated market area code for the client's location.

   Example filter expression:

   ip.src.metro_code eq "501"

   For more information, refer to the Fields reference.

Jan 12, 2026

1. Cloudflare Threat Events now support STIX2 format

   Security Center

   We are excited to announce that Cloudflare Threat Events now supports the STIX2 (Structured Threat Information Expression) format. This was a highly requested feature designed to streamline how security teams consume and act upon our threat intelligence.

   By adopting this industry-standard format, you can now integrate Cloudflare's threat events data more effectively into your existing security ecosystem.

   Key benefits

   • Eliminate the need for custom parsers, as STIX2 allows for "out of the box" ingestion into major Threat Intel Platforms (TIPs), SIEMs, and SOAR tools.

   • STIX2 provides a standardized way to represent relationships between indicators, sightings, and threat actors, giving your analysts a clearer picture of the threat landscape.

   For technical details on how to query events using this format, please refer to our Threat Events API Documentation ↗.

   ---

Jan 12, 2026

1. WAF Release - 2026-01-12

   WAF

   This week's release focuses on improvements to existing detections to enhance coverage.

   Key Findings

   • Existing rule enhancements have been deployed to improve detection resilience against SQL Injection.
   
   

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...48a1841a	N/A	SQLi - AND/OR MAKE_SET/ELT - Beta	Log	Block	This rule is merged into the original rule "SQLi - AND/OR MAKE_SET/ELT" (ID: ...252d3934 )
   Cloudflare Managed Ruleset	...9e553ad3	N/A	SQLi - Benchmark Function - Beta	Log	Block	This rule is merged into the original rule "SQLi - Benchmark Function" (ID: ...2ebc44ad )

Dec 18, 2025

1. WAF Release - 2025-12-18

   WAF

   This week's release focuses on improvements to existing detections to enhance coverage.

   Key Findings

   • Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.
   
   
   
   

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...be5ec20c	N/A	Atlassian Confluence - Code Injection - CVE:CVE-2021-26084 - Beta	Log	Block	This rule is merged into the original rule "Atlassian Confluence - Code Injection - CVE:CVE-2021-26084" (ID: ...69e0b97a )
   Cloudflare Managed Ruleset	...0d9206e3	N/A	PostgreSQL - SQLi - Copy - Beta	Log	Block	This rule is merged into the original rule "PostgreSQL - SQLi - COPY" (ID: ...e7265a4e )
   Cloudflare Managed Ruleset	...0cd00ba7	N/A	Generic Rules - Command Execution - Body	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...cd679ad4	N/A	Generic Rules - Command Execution - Header	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...fd181fb3	N/A	Generic Rules - Command Execution - URI	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...7a95bc3a	N/A	SQLi - Tautology - URI - Beta	Log	Block	This rule is merged into the original rule "SQLi - Tautology - URI" (ID: ...b3de2e0a )
   Cloudflare Managed Ruleset	...432ac90d	N/A	SQLi - WaitFor Function - Beta	Log	Block	This rule is merged into the original rule "SQLi - WaitFor Function" (ID: ...d5faba59 )
   Cloudflare Managed Ruleset	...596c741e	N/A	SQLi - AND/OR Digit Operator Digit 2 - Beta	Log	Block	This rule is merged into the original rule "SQLi - AND/OR Digit Operator Digit" (ID: ...88d80772 )
   Cloudflare Managed Ruleset	...03b2f3fe	N/A	SQLi - Equation 2 - Beta	Log	Block	This rule is merged into the original rule "SQLi - Equation" (ID: ...a72a6b3a )

← Prev

12 … 6

Next →

Search all changelog entries