Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds

Application security

May 20, 2026

1. WAF Release - 2026-05-20

   WAF

   Key Findings

   • Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.

   Continuous Rule Improvements

   We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...9e9c068d	N/A	Sitecore - Cache Poisoning - CVE:CVE-2025-53693 Beta	N/A	Block	This rule is merged into the original rule "Sitecore - Cache Poisoning - CVE:CVE-2025-53693" (ID: ...7c5b669c ).

May 15, 2026

1. WAF Release - 2026-05-15 - Emergency

   WAF

   This emergency release introduces two new rules to detect nginx heap buffer overflow and heap spray exploitation attempts targeting the rewrite module's is_args stale-state bug (CVE-2026-42945).

   Key Findings

   CVE-2026-42945: nginx Heap Buffer Overflow via Stale is_args in Rewrite Module

   Successful exploitation allows remote attackers to trigger a heap buffer overflow in nginx's rewrite module by sending crafted URIs containing escapable characters. A length/copy pass mismatch in ngx_http_script_copy_capture_code() causes the copy pass to write escaped data into an undersized buffer, leading to heap corruption. This enables denial of service (worker process crash) and, with heap feng shui techniques, potential remote code execution.

   We strongly recommend upgrading to nginx 1.30.1 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, avoid rewrite directives with ? in the replacement string followed by set or if referencing capture groups.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...7e52be73	N/A	nginx - Remote Code Execution - Buffer Overread - CVE:CVE-2026-42945	N/A	Block	This is a new detection.
   Cloudflare Managed Ruleset	...9df0ee6c	N/A	nginx - Remote Code Execution - Heap Spray - CVE:CVE-2026-42945	N/A	Block	This is a new detection.

May 11, 2026

1. WAF Release - 2026-05-11

   WAF

   Key Findings

   • Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.

   Continuous Rule Improvements

   We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...68b3c389	N/A	Remote Code Execution - Java Deserialization - Body - Beta	Block	Disabled	This is a new detection. This rule is merged into the original rule "Remote Code Execution - Java Deserialization" (ID: ...744305c4 ).

May 11, 2026

1. WAF Release - Scheduled changes for 2026-05-18

   WAF

   Announcement Date	Release Date	Release Behavior	Legacy Rule ID	Rule ID	Description	Comments
   2026-05-11	2026-05-18	Disabled	N/A	...9e9c068d	Sitecore - Cache Poisoning - CVE:CVE-2025-53693	This is a new detection. This rule will be merged into the original rule "Remote Code Execution - Java Deserialization" (ID: ...7c5b669c )

May 07, 2026

1. WAF and framework adapter mitigations for React and Next.js vulnerabilities

   Workers WAF

   Multiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range of severity levels.

   We strongly recommend updating your application and its dependencies immediately. Patched versions are available for React (react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack 19.0.6, 19.1.7, and 19.2.6) and Next.js (15.5.16 and 16.2.5).

   WAF protections

   Cloudflare WAF rules deployed in response to prior React Server Component CVEs (CVE-2025-55184 ↗ and CVE-2026-23864 ↗) already provide coverage for the newly disclosed denial-of-service vulnerabilities. These rules are enabled by default with a Block action for all customers using the Cloudflare Managed Ruleset, including Free plan customers using the Free Managed Ruleset.

   Ruleset	Rule description	Rule ID	Default action
   Cloudflare Managed Ruleset	React - DoS - CVE-2025-55184 ↗	2694f1610c0b471393b21aef102ec699	Block
   Cloudflare Managed Ruleset	React - DoS - CVE-2026-23864 ↗	aaede80b4d414dc89c443cea61680354	Block

   The existing rules detect the underlying attack patterns generically. As a result, they apply to the new CVE-2026-23870 ↗ denial-of-service vulnerability in Server Components and the corresponding Next.js advisory GHSA-8h8q-6873-q5fj ↗.

   Cloudflare is investigating whether WAF rules can be safely and effectively deployed for three of the high-severity advisories: CVE-2026-23870 ↗ / GHSA-8h8q-6873-q5fj ↗, GHSA-267c-6grr-h53f ↗, and GHSA-mg66-mrh9-m8jx ↗. If it is possible to create a managed WAF rule that mitigates these CVEs and does not potentially break application behavior, Cloudflare will add additional managed WAF rules. These rules will be announced through the WAF changelog. Because these vulnerabilities were shared with Cloudflare with minimal advance notice, we are still investigating what WAF mitigations are possible.

   Several of the disclosed vulnerabilities are not possible to block in WAF. We strongly recommend updating your applications so they are not purely reliant on WAF mitigations.

   Customers on Pro, Business, or Enterprise plans should ensure that Managed Rules are enabled.

   Next.js adapters

   Vinext: Vinext ↗ is a Vite plugin that reimplements the Next.js API surface. Vinext's latest release is not vulnerable to any of the disclosed CVEs. Vinext's architecture differs from stock Next.js in ways that sidestep the affected code paths. For example, it does not implement the PPR resume protocol, does not expose Pages Router data-route endpoints, and strips internal headers such as x-nextjs-data at request boundaries. As an extra layer of defense, we added a React 19.2.6 or later requirement when running vinext init (PR #1118 ↗, PR #1112 ↗) to prevent accidentally running a vulnerable version of React with Vinext.

   OpenNext on Cloudflare: OpenNext is an adapter that lets you deploy Next.js apps to the Cloudflare Workers platform. OpenNext itself is not directly vulnerable to the React denial-of-service CVE, but users must update the Next.js version in their application. The OpenNext team has updated the adapter to further harden against these vectors and released a new version of the Cloudflare adapter. Test fixtures and examples have been updated to use patched versions (PR #1255 ↗).

   Summary of disclosed vulnerabilities

   Advisory	Severity	Issue	WAF status
   CVE-2026-23870 ↗ / GHSA-8h8q-6873-q5fj ↗	High	Denial of service in Server Components	WAF rules in place: 2694f1610c0b471393b21aef102ec699, aaede80b4d414dc89c443cea61680354 Cloudflare is investigating additional managed WAF coverage
   GHSA-267c-6grr-h53f ↗	High	Middleware bypass via segment-prefetch routes	Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule
   GHSA-mg66-mrh9-m8jx ↗	High	Denial of service via connection exhaustion in Cache Components	Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule
   GHSA-492v-c6pp-mqqv ↗	High	Middleware bypass via dynamic route parameter injection	Not possible to safely enable a managed WAF rule without potentially breaking application behavior
   GHSA-c4j6-fc7j-m34r ↗	High	SSRF via WebSocket upgrades	Not possible to safely enable a managed WAF rule without potentially breaking application behavior
   GHSA-36qx-fr4f-26g5 ↗	High	Middleware bypass in Pages Router i18n	Custom WAF rule possible; global managed rule could potentially break application behavior
   GHSA-ffhc-5mcf-pf4q ↗	Moderate	XSS via CSP nonces	Custom WAF rule possible; global managed rule could potentially break application behavior
   GHSA-gx5p-jg67-6x7h ↗	Moderate	XSS in beforeInteractive scripts	Not possible to safely enable a managed WAF rule without potentially breaking application behavior
   GHSA-h64f-5h5j-jqjh ↗	Moderate	Denial of service in Image Optimization API	Custom WAF rule possible; global managed rule could potentially break application behavior
   GHSA-wfc6-r584-vfw7 ↗	Moderate	Cache poisoning in RSC responses	Custom WAF rule possible; global managed rule could potentially break application behavior
   GHSA-vfv6-92ff-j949 ↗	Low	Cache poisoning via RSC cache-busting collisions	Not possible to safely enable a managed WAF rule without potentially breaking application behavior
   GHSA-3g8h-86w9-wvmq ↗	Low	Middleware redirect cache poisoning	Custom WAF rule possible; global managed rule could potentially break application behavior

May 07, 2026

1. CSV export and adjustable page density for RFIs

   Security Center

   You can now export your Requests for Information (RFI) history to a CSV document and customize your dashboard view by choosing how many RFI records to load per page.

   Why this matters

   These quality-of-life updates focus on data portability and dashboard performance, allowing power users to manage high volumes of requests more efficiently:

   • The new CSV export allows you to move RFI data into external tools for custom reporting, internal auditing, or cross-referencing with other security projects without manual data entry
   • With adjustable page density, you can now choose to load more records at once (10, 25 or 50) to scan through history faster

   Cloudforce One subscribers can find these new options in Cloudflare Dashboard > Application Security > Threat Intelligence > Requests for Information ↗.

May 07, 2026

1. WAF Release - 2026-05-07 - Emergency

   WAF

   This emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes (CVE-2026-44575).

   Key Findings

   CVE-2026-44575: Next.js Middleware / Proxy Bypass in App Router Applications via Segment-Prefetch Routes

   Successful exploitation allows unauthenticated attackers to bypass middleware or proxy-based authorization checks in affected Next.js App Router applications. This leads to unauthorized access to protected content, potential exposure of sensitive application data, and compromise of application security boundaries.

   We strongly recommend upgrading to Next.js 15.5.16 or 16.2.5 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...e77e4a53	N/A	Next.js - Middleware Bypass via Invalid RSC Header - CVE:CVE-2026-44575	N/A	Disabled	This is a new detection.

May 06, 2026

1. TAXII support added to Threat Events API

   Security Center

   The Cloudforce One Threat Events API now supports TAXII ↗ as an output format, enabling standardized, automated sharing of cyber threat intelligence with your existing security stack.

   Why this matters

   • You can now ingest Cloudforce One threat data directly into your SIEM, TIP or SOAR tools that prefer TAXII-formatted streams without needing custom translation scripts.
   • By supporting the TAXII format parameter in our API, security teams can automate the synchronization of indicator data, reducing the manual overhead of updating blocklists and detection rules.
   • This alignment with industry standards ensures that your threat data remains consistent across different security ecosystems and partner integrations.

   How to use it

   When calling the Threat Events API, you can now specify taxii in the format query parameter:

   GET /accounts/{account_id}/cloudforce_one/threat_events?format=taxii

   You can find the updated documentation in the Cloudflare API Reference ↗.

May 04, 2026

1. WAF Release - 2026-05-04

   WAF

   This week's release focuses on new detections to expand coverage across command injection, SQL injection, PHP object injection, remote code execution, and XSS attack vectors.

   Key Findings

   • Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.

   Continuous Rule Improvements

   We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...f0884a68	N/A	XSS, HTML Injection - Object Tag - Body (beta)	Log	Block	This is a new detection. This rule is merged into the original rule "XSS, HTML Injection - Object Tag" (ID: ...0c14e284 ).
   Cloudflare Managed Ruleset	...ff012303	N/A	XSS, HTML Injection - Object Tag - Headers	Log	Block	This is a new detection. The rule previously known as "XSS, HTML Injection - Object Tag - Headers (beta)" is now renamed to "XSS, HTML Injection - Object Tag - Headers".
   Cloudflare Managed Ruleset	...16f921d9	N/A	XSS, HTML Injection - Object Tag - URI	Log	Block	This is a new detection. The rule previously known as "XSS, HTML Injection - Object Tag - URI (beta)" is now renamed to "XSS, HTML Injection - Object Tag - URI".
   Cloudflare Managed Ruleset	...dc90d21a	N/A	Command Injection - Generic 9 - Body Vector - Beta	N/A	Disabled	This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - Body Vector" (ID: ...0677175f )
   Cloudflare Managed Ruleset	...f8960375	N/A	Command Injection - Generic 9 - Header Vector - Beta	N/A	Disabled	This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - Header Vector" (ID: ...1eb7a999 )
   Cloudflare Managed Ruleset	...ef47a800	N/A	Command Injection - Generic 9 - URI Vector - Beta	N/A	Disabled	This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - URI Vector" (ID: ...97321c6c )
   Cloudflare Managed Ruleset	...beebf804	N/A	Command Injection - Sleep - Body	N/A	Disabled	This is a new detection. The rule previously known as "Command Injection Sleep" is now renamed to "Command Injection - Sleep - Body".
   Cloudflare Managed Ruleset	...0d257566	N/A	Command Injection - Sleep - Headers	N/A	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...1856fe86	N/A	Command Injection - Sleep - URI	N/A	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...e6e43c37	N/A	Fortinet FortiSandbox - Command Injection - CVE:CVE-2026-39808	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...88118795	N/A	Remote Code Execution - Common Bash Bypass - Headers	N/A	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...9299d53b	N/A	Remote Code Execution - Common Bash Bypass - URI	N/A	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...b0bf33f9	N/A	Remote Code Execution - Common Bash Bypass - Body - Beta	N/A	Disabled	This is a new detection. This rule is merged into the original rule "Remote Code Execution - Common Bash Bypass Body" (ID: ...efb7e5b9 ). The rule previously known as "Remote Code Execution - Common Bash Bypass Beta" is now renamed to "Remote Code Execution - Common Bash Bypass Body".
   Cloudflare Managed Ruleset	...33bfe8b9	N/A	PHP Object Injection - 2 - Body - Beta	N/A	Disabled	This is a new detection. This rule is merged into the original rule "PHP Object Injection - 2" (ID: ...161aafdc )
   Cloudflare Managed Ruleset	...29552387	N/A	PHP Object Injection - 2 - Headers	N/A	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...8104f4c5	N/A	PHP Object Injection - 2 - URI	N/A	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...6a46201e	N/A	SQLi - DROP - 2 - Beta	N/A	Disabled	This is a new detection. This rule is merged into the original rule "SQLi - DROP - 2" (ID: ...48ac2221 )
   Cloudflare Managed Ruleset	...8b7f85ee	N/A	SQLi - DROP - 2 - Headers	N/A	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...1546b5f0	N/A	SQLi - DROP - 2 - URI	N/A	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...1e053dce	N/A	SmarterMail - Remote Code Execution - CVE:CVE-2026-24423	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...d0023a36	N/A	SQLi - SELECT Expression - Body	Block	Disabled	Action changed
   Cloudflare Managed Ruleset	...26cc211f	N/A	SQLi - String Concatenation - URI	Block	Disabled	Action changed

Apr 30, 2026

1. WAF Release - 2026-04-30 - Emergency

   WAF

   This emergency release introduces a new rule to block a cPanel & WHM Authentication Bypass related to CVE-2026-41940.

   Key Findings

   • CVE-2026-41940: A critical authentication bypass vulnerability in cPanel & WHM allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized administrative access to the web hosting control panel. This vulnerability affects the session validation logic, enabling attackers to craft malicious requests that circumvent normal authentication checks.

   Impact

   Successful exploitation allows unauthenticated attackers to gain administrative control over affected cPanel & WHM installations. This leads to complete server compromise, potential theft or manipulation of hosted data, and significant service disruption across managed environments.

   We strongly recommend applying official vendor patches for cPanel & WHM immediately to address the underlying vulnerability.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...eb2b9e2f	N/A	cPanel - Auth Bypass - CVE:CVE-2026-41940	N/A	Block	This is a new detection.

Apr 27, 2026

1. Unified workspace for Brand Protection

   Security Center

   We have introduced a unified investigation workspace within Brand Protection to help analysts manage complex brand portfolios. Instead of jumping between individual queries, you can now consolidate your workflow into a single, cohesive view.

   What's new

   • You can now elect multiple saved queries from your dashboard to generate a consolidated "Combined Matches" view. This allows you to triage results from different brand queries in one unified table
   • You can open query extended views in distinct tabs within the Brand Protection dashboard. This enables you to maintain multiple investigation contexts simultaneously and switch between them without losing your place.
   • You can reset your workspace using the new "Clear Selection" action, making it easier to pivot between different investigation sets.

   Key benefits

   • Eliminate fragmented workflows by viewing all matches across different query buckets in a single table, reducing the need to click through dozens of individual query pages
   • Correlate related campaigns by seeing similar domains or infrastructure patterns that appear across multiple saved queries

   Learn more in our Brand Protection documentation.

Apr 27, 2026

1. WAF Release - 2026-04-27

   WAF

   This week's release focuses on new improvements to enhance coverage.

   Key Findings

   • Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.

   Continuous Rule Improvements

   We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...80cec1dd	N/A	PostgreSQL - SQLi - COPY - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "PostgreSQL - SQLi - COPY - Body (ID: ...e7265a4e ). The rule previously known as "PostgreSQL - SQLi - COPY" is now renamed to "PostgreSQL - SQLi - COPY - Body".
   Cloudflare Managed Ruleset	...2903de89	N/A	PostgreSQL - SQLi - COPY - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...1036cfa6	N/A	PostgreSQL - SQLi - COPY - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...55ff389e	N/A	SQLi - AND/OR MAKE_SET/ELT - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - AND/OR MAKE_SET/ELT - Body" (ID: ...252d3934 ). The rule previously known as "SQLi - AND/OR MAKE_SET/ELT" is now renamed to "SQLi - AND/OR MAKE_SET/ELT - Body".
   Cloudflare Managed Ruleset	...346487f9	N/A	SQLi - AND/OR MAKE_SET/ELT - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...1ac6ceca	N/A	SQLi - AND/OR MAKE_SET/ELT - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...dd471337	N/A	SQLi - Common Patterns - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - Common Patterns - Body" (ID: ...cb5d0b9b ). The rule previously known as "SQLi - Common Patterns" is now renamed to "SQLi - Common Patterns - Body".
   Cloudflare Managed Ruleset	...975c07b7	N/A	SQLi - Common Patterns - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...05b1b06b	N/A	SQLi - Common Patterns - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...dd0ba3c7	N/A	SQLi - Equation - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - Equation - Body" (ID: ...c2eb3e7f ). The rule previously known as "SQLi - Equation" is now renamed to "SQLi - Equation - Body".
   Cloudflare Managed Ruleset	...3d1c2384	N/A	SQLi - Equation - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...e1149ea6	N/A	SQLi - Equation - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...205adbb0	N/A	SQLi - AND/OR Digit Operator Digit - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - AND/OR Digit Operator Digit - Body" (ID: ...3893c564 ). The rule previously known as "SQLi - AND/OR Digit Operator Digit" is now renamed to "SQLi - AND/OR Digit Operator Digit - Body".
   Cloudflare Managed Ruleset	...ad2abbaa	N/A	SQLi - AND/OR Digit Operator Digit - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...53acbc0d	N/A	SQLi - AND/OR Digit Operator Digit - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...2b45a97d	N/A	SQLi - Benchmark Function - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - Benchmark Function - Body" (ID: ...2ebc44ad ). The rule previously known as "SQLi - Benchmark Function" is now renamed to "SQLi - Benchmark Function - Body".
   Cloudflare Managed Ruleset	...9889aadc	N/A	SQLi - Benchmark Function - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...491b28e9	N/A	SQLi - Benchmark Function - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...2aa649de	N/A	SQLi - Comparison - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - Comparison - Body" (ID: ...e7907480 ). The rule previously known as "SQLi - Comparison" is now renamed to "SQLi - Comparison - Body".
   Cloudflare Managed Ruleset	...39e3e013	N/A	SQLi - Comparison - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...f4bdb492	N/A	SQLi - Comparison - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...a1ff3b34	N/A	SQLi - String Concatenation - Body - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - String Concatenation - Headers" (ID: ...2116d2fe ).The rule previously known as "SQLi - String Concatenation - Headers" is now renamed to "SQLi - String Concatenation - Body".
   Cloudflare Managed Ruleset	...0d0e6c3b	N/A	SQLi - String Concatenation - Headers	Log	Block	This is a new detection.(Former Id was ...846d1940 )
   Cloudflare Managed Ruleset	...26cc211f	N/A	SQLi - String Concatenation - URI	Log	Block	This is a new detection. (Former Id was ...8fae8c84 )
   Cloudflare Managed Ruleset	...eacc78ab	N/A	SQLi - SELECT Expression - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - SELECT Expression - Body" (ID: ...d0023a36 ). The rule previously known as "SQLi - SELECT Expression" is now renamed to "SQLi - SELECT Expression - Body".
   Cloudflare Managed Ruleset	...630bb223	N/A	SQLi - SELECT Expression - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...dcd6efb5	N/A	SQLi - SELECT Expression - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...18c47cea	N/A	SQLi - ORD and ASCII - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - ORD and ASCII- Body" (ID: ...d0d207f9 ). The rule previously known as "SQLi - ORD and ASCII" is now renamed to "SQLi - ORD and ASCII- Body".
   Cloudflare Managed Ruleset	...bdb1618f	N/A	SQLi - ORD and ASCII - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...1d0906b6	N/A	SQLi - ORD and ASCII - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...9fe4eff5	N/A	SQLi - Destructive Operations	Log	Block	This is a new detection.

Apr 21, 2026

1. WAF Release - 2026-04-21

   WAF

   This week's release introduces a new detection for a Remote Code Execution (RCE) vulnerability in Apache ActiveMQ (CVE-2026-34197) and an updated signature for Magento 2 - Unrestricted File Upload. Alongside these detections, we are continuing our work on rule refinements to provide deeper security insights for our customers.

   Key Findings

   • Apache ActiveMQ (CVE-2026-34197): A vulnerability in Apache ActiveMQ allows an unauthenticated, remote attacker to execute arbitrary code. This flaw occurs during the processing of specially crafted network packets, leading to potential full system compromise.

   • Magento 2 - Unrestricted File Upload - 2: This is a follow-up enhancement to our existing protections for Magento and Adobe Commerce.

   Impact

   Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain full administrative control over affected servers. We strongly recommend applying official vendor patches for Apache ActiveMQ and Magento to address the underlying vulnerabilities.

   Continuous Rule Improvements

   We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...ee159e2e	N/A	Command Injection - Generic 8 - uri	Log	Block	This is a new detection. Previous description was "Command Injection - Generic 8 - uri - Beta"
   Cloudflare Managed Ruleset	...a15308cf	N/A	Command Injection - Generic 8 - body - Beta	Disabled	Disabled	This is a new detection. This rule is merged into the original rule "Command Injection - Generic 8 - body" (ID: ...413592e2 ). The rule previously known as "Command Injection - Generic 8" is now renamed to "Command Injection - Generic 8 - body".
   Cloudflare Managed Ruleset	...958047ed	N/A	MySQL - SQLi - Executable Comment - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "MySQL - SQLi - Executable Comment - Body" (ID: ...7bd2d8fa ) The rule previously known as "MySQL - SQLi - Executable Comment" is now renamed to "MySQL - SQLi - Executable Comment - Body".
   Cloudflare Managed Ruleset	...582cc559	N/A	MySQL - SQLi - Executable Comment - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...a16639d3	N/A	MySQL - SQLi - Executable Comment - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...44f24211	N/A	Magento 2 - Unrestricted file upload - 2	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...bf170a17	N/A	Apache ActiveMQ - Remote Code Execution - CVE:CVE-2026-34197	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...8c2ac1a7	N/A	SQLi - Sleep Function - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - Sleep Function" (ID: ...f77e8d54 )
   Cloudflare Managed Ruleset	...4dacaeb8	N/A	SQLi - Sleep Function - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...ed4c9ece	N/A	SQLi - Sleep Function - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...1dfa64df	N/A	SQLi - Probing - uri	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...4c62e2e7	N/A	SQLi - Probing - header	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...aab28ea1	N/A	SQLi - Probing - body	Disabled	Disabled	This is a new detection. This rule is merged into the original rule "SQLi - Probing" (ID: ...b4026c88 )
   Cloudflare Managed Ruleset	...20999be0	N/A	SQLi - Probing 2	Disabled	Disabled	This rule had duplicate detection logic and has been deprecated.
   Cloudflare Managed Ruleset	...d7aa0008	N/A	SQLi - UNION in MSSQL - Body	Disabled	Disabled	This rule has been renamed to differentiate from "SQLi - UNION in MSSQL" (ID: ...ee5e35fd ) and contains updated rule logic.
   Cloudflare Managed Ruleset	...a67d8561	N/A	SQLi - UNION - 3	Disabled	Disabled	This rule had duplicate detection logic and has been deprecated.
   Cloudflare Managed Ruleset	...0af34bba	N/A	XSS, HTML Injection - Embed Tag - URI	Disabled	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...70282f38	N/A	XSS, HTML Injection - Embed Tag - Headers	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...23f4d718	N/A	XSS, HTML Injection - IFrame Tag - Src and Srcdoc Attributes - Headers	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...6978def1	N/A	XSS, HTML Injection - Link Tag - Headers	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...ebd81645	N/A	XSS, HTML Injection - Link Tag - URI	Disabled	Disabled	This is a new detection.

Apr 20, 2026

1. Archive and audit security action items

   Security Overview

   Archive and audit security action items

   Introducing enhanced archiving capabilities for security action items within the Security Overview dashboard. This update allows security teams to maintain a cleaner workspace by removing resolved, accepted, or irrelevant items from their active list while maintaining a clear paper trail for compliance.

   ---

   Why this matters

   Managing a high volume of security insights can be overwhelming. Previously, users lacked a structured way to dismiss items without losing the context of why they were ignored.

   With these new archiving options—False Positive, Accept Risk, and Other—you can now suppress items indefinitely with required rationale text for risk-based decisions. This ensures that your team remains focused on critical, actionable vulnerabilities while preserving institutional knowledge for audits.

   Key features

   • Structured Archiving: Choose from specific categories to define why an action item is being moved.
   • Required Rationale: For "Accept Risk" and "Other" categories, users must provide documentation, ensuring accountability for security decisions.
   • Audit Log Transparency: New API endpoints allow you to programmatically retrieve the history of status changes and rationale for any insight at the account or zone level.
   • Reversible Actions: Any archived item can be moved back to the active list at any time if the security context changes.

   Note

   Archiving a suspicious activity item will remove it from the Security Overview page, but the activity will remain visible in your Security Analytics dashboard for deeper forensic analysis.

   ---

   Example: Retrieve audit logs via API

   To review the history and rationale of a specific archived issue at the account level, you can use the following API command:

   curl "[https://api.cloudflare.com/client/v4/accounts/](https://api.cloudflare.com/client/v4/accounts/){account_id}/insights/{insight_id}/audit-log" \
        -H "Authorization: Bearer <API_TOKEN>" \
        -H "Content-Type: application/json"

Apr 15, 2026

1. WAF Release - 2026-04-15

   WAF

   This week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).

   Key Findings

   • Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.

   • FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.

   • Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.

   Impact

   Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...aef9415b	N/A	Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...ee7be621	N/A	FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...c953a72b	N/A	Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...50c08f6f	N/A	React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta	Log	Block	This rule has been merged into the original rule "React Server - DOS - CVE:CVE-2026-23864 - 1" (ID: ...61680354 )
   Cloudflare Managed Ruleset	...ebd81645	N/A	XSS, HTML Injection - Link Tag - URI (beta)	N/A	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...0af34bba	N/A	XSS, HTML Injection - Embed Tag - URI (beta)	N/A	Disabled	This is a new detection.

Apr 14, 2026

1. Email obfuscation decode script is now non-render-blocking

   WAF

   The decode script injected by Email Address Obfuscation now loads with the defer attribute. This means the script no longer blocks page rendering. It downloads in parallel with HTML parsing and executes after the document is fully parsed, before the DOMContentLoaded event.

   This improves page loading performance, contributing to better Core Web Vitals, for all zones with Email Address Obfuscation on. No action is required.

   If you have custom JavaScript that depends on email addresses being decoded at a specific point during page load, note that the decode script now executes after HTML parsing completes rather than inline during parsing.

Apr 08, 2026

1. Real-time alerts and daily digests for Threat Events

   Security Center

   You can now automate your threat monitoring by setting up custom alerts in your saved views. Instead of manually checking the dashboard for updates, you can subscribe to notifications that trigger whenever new data matches your specific filter sets, like new activity associated to a particular threat actor or spikes in activity within your industry.

   Stay ahead of emerging threats

   By linking your saved views to the Cloudflare Notifications Center, you can ensure the right information reaches your team at the right time.

   • Immediate Alerts: receive real-time notifications the moment a critical event is detected that matches your saved criteria. This is essential for high-priority monitoring, such as tracking active campaigns from specific APT groups.

   • Daily Digests: opt for a summarized report delivered once a day. This is ideal for maintaining situational awareness of broader trends, like regional activity shifts or industry-wide threat landscapes, without cluttering your inbox.

   

   How to get started

   To set up an alert, go to Application Security > Threat Intelligence > Threat Events. From there:

   1. Choose your datasets and apply your desired filters and select Save View (or select an existing one).
   2. Open the Manage Saved Views menu.
   3. Select Add Alert next to your chosen view to configure your notification preferences in the Cloudflare dashboard.

   For more technical details on configuring notifications, refer to the Threat Events documentation.

Apr 07, 2026

1. Manage mTLS and BYO CA certificates from the Cloudflare dashboard

   SSL/TLS

   You can now manage mutual TLS (mTLS) and Bring Your Own Certificate Authority (BYO CA) configurations directly from the Cloudflare dashboard — no API required.

   Previously, these advanced workflows required the Cloudflare API. The following are now available in the dashboard:

   • AOP certificate management — Upload and manage your own certificate authorities for Authenticated Origin Pulls (AOP) directly from the dashboard.
   • BYO Client mTLS certificate management — Upload and manage your own CA certificates for client mTLS enforcement without needing API access.
   • CDN hostname to client mTLS certificate mapping — Associate client mTLS certificates with specific hostnames directly from the dashboard.

Apr 07, 2026

1. WAF Release - 2026-04-07

   WAF

   This week's release introduces new detections for a critical Remote Code Execution (RCE) vulnerability in MCP Server (CVE-2026-23744), alongside targeted protection for an authentication bypass vulnerability in SolarWinds products (CVE-2025-40552). Additionally, this release includes a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts leveraging "OnEvent" handlers within HTTP cookies.

   Key Findings

   • MCP Server (CVE-2026-23744): A vulnerability in the Model Context Protocol (MCP) server implementation where malformed input payloads can trigger a memory corruption state, allowing for arbitrary code execution.

   • SolarWinds (CVE-2025-40552): A critical flaw in the authentication module allows unauthenticated attackers to bypass security filters and gain unauthorized access to the management console due to improper identity token validation.

   • XSS OnEvents Cookies: This generic rule identifies malicious event handlers (such as onload or onerror) embedded within HTTP cookie values.

   Impact

   Successful exploitation of the MCP Server and SolarWinds vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain administrative control, leading to a full system takeover. Additionally, the new generic XSS detection prevents attackers from leveraging browser event handlers in cookies to hijack user sessions or execute malicious scripts.

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...0aa410af	N/A	Generic Rules - Command Execution - 5 - Body	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...9131ec2f	N/A	Generic Rules - Command Execution - 5 - Header	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...551eb9e5	N/A	Generic Rules - Command Execution - 5 - URI	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...d46229eb	N/A	MCP Server - Remote Code Execution - CVE:CVE-2026-23744	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...a864b9c2	N/A	XSS - OnEvents - Cookies	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...a78ad04e	N/A	SQLi - Evasion - Body	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...40732d48	N/A	SQLi - Evasion - Headers	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...e68a99b5	N/A	SQLi - Evasion - URI	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...3e8143d2	N/A	SQLi - LIKE 3 - Body	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...70e7fb97	N/A	SQLi - LIKE 3 - URI	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...4c538bd9	N/A	SQLi - UNION - 2 - Body	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...61c439c9	N/A	SQLi - UNION - 2 - URI	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...cf33ea10	N/A	SolarWinds - Auth Bypass - CVE:CVE-2025-40552	Log	Block	This is a new detection.

Apr 01, 2026

1. New QUIC RTT and delivery rate fields

   Rules

   Two new fields are now available in rule expressions that surface Layer 4 transport telemetry from the client connection. Together with the existing cf.timings.client_tcp_rtt_msec field, these fields give you a complete picture of connection quality for both TCP and QUIC traffic — enabling transport-aware rules without requiring any client-side changes.

   Previously, QUIC RTT and delivery rate data was only available via the Server-Timing: cfL4 response header. These new fields make the same data available directly in rule expressions, so you can use them in Transform Rules, WAF Custom Rules, and other phases that support dynamic fields.

   New fields

   Field	Type	Description
   cf.timings.client_quic_rtt_msec	Integer	The smoothed QUIC round-trip time (RTT) between Cloudflare and the client in milliseconds. Only populated for QUIC (HTTP/3) connections. Returns 0 for TCP connections.
   cf.edge.l4.delivery_rate	Integer	The most recent data delivery rate estimate for the client connection, in bytes per second. Returns 0 when L4 statistics are not available for the request.

   Example: Route slow connections to a lightweight origin

   Use a request header transform rule to tag requests from high-latency connections, so your origin can serve a lighter page variant:

   Rule expression:

   cf.timings.client_tcp_rtt_msec > 200 or cf.timings.client_quic_rtt_msec > 200

   Header modifications:

   Operation	Header name	Value
   Set	X-High-Latency	true

   Example: Match low-bandwidth connections

   cf.edge.l4.delivery_rate > 0 and cf.edge.l4.delivery_rate < 100000

   For more information, refer to Request Header Transform Rules and the fields reference.

Mar 30, 2026

1. WAF Release - 2026-03-30

   WAF

   This week's release introduces new detections for a critical authentication bypass vulnerability in Fortinet products (CVE-2025-59718), alongside three new generic detection rules designed to identify and block HTTP Parameter Pollution attempts. Additionally, this release includes targeted protection for a high-impact unrestricted file upload vulnerability in Magento and Adobe Commerce.

   Key Findings

   • CVE-2025-59718: An improper cryptographic signature verification vulnerability in Fortinet FortiOS, FortiProxy, and FortiSwitchManager. This may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication using a maliciously crafted SAML message, if that feature is enabled on the device.

   • Magento 2 - Unrestricted File Upload: A critical flaw in Magento and Adobe Commerce allows unauthenticated attackers to bypass security checks and upload malicious files to the server, potentially leading to Remote Code Execution (RCE).

   Impact

   Successful exploitation of the Fortinet and Magento vulnerabilities could allow unauthenticated attackers to gain administrative control or deploy webshells, leading to complete server compromise and data theft.

   
   
   
   

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...2f7f95e9	N/A	Generic Rules - Parameter Pollution - Body	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...319731a4	N/A	Generic Rules - Parameter Pollution - Header - Form	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...def262dd	N/A	Generic Rules - Parameter Pollution - URI	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...70a36147	N/A	Magento 2 - Unrestricted file upload	Log	Block	This is a new detection.
   Cloudflare Managed Ruleset	...2ffcca9f	N/A	Fortinet FortiCloud SSO - Authentication Bypass - CVE:CVE-2025-59718	Log	Block	This is a new detection.

Mar 25, 2026

1. New mTLS certificate fields for Transform Rules

   Rules

   Cloudflare now exposes four new fields in the Transform Rules phase that encode client certificate data in RFC 9440 ↗ format. Previously, forwarding client certificate information to your origin required custom parsing of PEM-encoded fields or non-standard HTTP header formats. These new fields produce output in the standardized Client-Cert and Client-Cert-Chain header format defined by RFC 9440, so your origin can consume them directly without any additional decoding logic.

   Each certificate is DER-encoded, Base64-encoded, and wrapped in colons. For example, :MIIDsT...Vw==:. A chain of intermediates is expressed as a comma-separated list of such values.

   New fields

   Field	Type	Description
   cf.tls_client_auth.cert_rfc9440	String	The client leaf certificate in RFC 9440 format. Empty if no client certificate was presented.
   cf.tls_client_auth.cert_rfc9440_too_large	Boolean	true if the leaf certificate exceeded 10 KB and was omitted. In practice this will almost always be false.
   cf.tls_client_auth.cert_chain_rfc9440	String	The intermediate certificate chain in RFC 9440 format as a comma-separated list. Empty if no intermediate certificates were sent or if the chain exceeded 16 KB.
   cf.tls_client_auth.cert_chain_rfc9440_too_large	Boolean	true if the intermediate chain exceeded 16 KB and was omitted.

   The chain encoding follows the same ordering as the TLS handshake: the certificate closest to the leaf appears first, working up toward the trust anchor. The root certificate is not included.

   Example: Forwarding client certificate headers to your origin server

   Add a request header transform rule to set the Client-Cert and Client-Cert-Chain headers on requests forwarded to your origin server. For example, to forward headers for verified, non-revoked certificates:

   Rule expression:

   cf.tls_client_auth.cert_verified and not cf.tls_client_auth.cert_revoked

   Header modifications:

   Operation	Header name	Value
   Set	Client-Cert	cf.tls_client_auth.cert_rfc9440
   Set	Client-Cert-Chain	cf.tls_client_auth.cert_chain_rfc9440

   To get the most out of these fields, upload your client CA certificate to Cloudflare so that Cloudflare validates the client certificate at the edge and populates cf.tls_client_auth.cert_verified and cf.tls_client_auth.cert_revoked.

   Prevent header injection

   You should ensure that Client-Cert and Client-Cert-Chain headers received by your origin server can only originate from this transform rule — any client could send these headers directly.

   • If you use WAF custom rules to block requests with invalid mTLS connections: The transform rule is sufficient. For all requests that reach your origin server, the rule will overwrite any existing Client-Cert and Client-Cert-Chain headers.
   • If you do not enforce mTLS at the WAF: Add another transform rule that removes any incoming Client-Cert and Client-Cert-Chain headers from all requests (use expression true), ordered before the rule above. This ensures your origin server cannot receive client-supplied values for these HTTP headers.

   For more information, refer to Mutual TLS authentication, Request Header Transform Rules, and the fields reference.

Mar 23, 2026

1. Web Assets fields now available in GraphQL Analytics API

   API Shield

   Two new fields are now available in the httpRequestsAdaptive and httpRequestsAdaptiveGroups GraphQL Analytics API datasets:

   • webAssetsOperationId — the ID of the saved endpoint that matched the incoming request.
   • webAssetsLabelsManaged — the managed labels mapped to the matched operation at the time of the request (for example, cf-llm, cf-log-in). At most 10 labels are returned per request.

   Both fields are empty when no operation matched. webAssetsLabelsManaged is also empty when no managed labels are assigned to the matched operation.

   These fields allow you to determine, per request, which Web Assets operation was matched and which managed labels were active. This is useful for troubleshooting downstream security detection verdicts — for example, understanding why AI Security for Apps did or did not flag a request.

   Refer to Endpoint labeling service for GraphQL query examples.

Mar 23, 2026

1. WAF Release - 2026-03-23

   WAF

   This week's release focuses on new improvements to enhance coverage.

   Key Findings

   • Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.
   
   
   
   

   Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
   Cloudflare Managed Ruleset	...97321c6c	N/A	Command Injection - Generic 9 - URI Vector	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...1eb7a999	N/A	Command Injection - Generic 9 - Header Vector	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...0677175f	N/A	Command Injection - Generic 9 - Body Vector	Log	Disabled	This is a new detection.
   Cloudflare Managed Ruleset	...479da68f	N/A	PHP, vBulletin, jQuery File Upload - Code Injection, Dangerous File Upload - CVE:CVE-2018-9206, CVE:CVE-2019-17132 (beta)	Log	Block	This rule has been merged into the original rule "PHP, vBulletin, jQuery File Upload - Code Injection, Dangerous File Upload - CVE:CVE-2018-9206, CVE:CVE-2019-17132" (ID: ...824b817c )

Mar 20, 2026

1. Stream logs from multiple replicas of Cloudflare Tunnel simultaneously

   Cloudflare Tunnel Cloudflare Tunnel for SASE

   In the Cloudflare One dashboard, the overview page for a specific Cloudflare Tunnel now shows all replicas of that tunnel and supports streaming logs from multiple replicas at once.

   

   Previously, you could only stream logs from one replica at a time. With this update:

   • Replicas on the tunnel overview — All active replicas for the selected tunnel now appear on that tunnel's overview page under Connectors. Select any replica to stream its logs.
   • Multi-connector log streaming — Stream logs from multiple replicas simultaneously, making it easier to correlate events across your infrastructure during debugging or incident response. To try it out, log in to Cloudflare One ↗ and go to Networks > Connectors > Cloudflare Tunnels. Select View logs next to the tunnel you want to monitor.

   For more information, refer to Tunnel log streams and Deploy replicas.

← Prev

12 … 7

Next →