/
← Voltar ao feed
low

Cloudflare launches full transaction WAF detection and response rules, with first managed protections for php2shell

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 11:10 · coletado há 8 horas

Cloudflare has made generally available to all customers, including Free plans, two new WAF capabilities: full transaction detections, which correlate each HTTP request with the origin's response to confirm exploitation, and response rules, which block the origin's response before it reaches the requester. The first managed protections target the recently disclosed php2shell vulnerability. Cloudflare argues that AI-driven vulnerability scanning is persistent and adaptive, and that request-only inspection forces a trade-off between false positives and coverage. This is a product announcement, not an incident report, and the article gives no CVE, IOCs or attribution.

Detalhes técnicos

  • Detections attach metadata to the request and response. Rules then decide the action, so detection and mitigation are kept separate.
  • New fields: cf.waf.signature.response.confidence, cf.waf.signature.response.categories and cf.waf.signature.response.ref (up to 10 signature reference IDs).
  • The example use case is a path traversal request (GET /download?file=../../config/database.ini) combined with a response that contains private configuration content. A response rule then replaces the origin response with a WAF block page and HTTP 403.
  • Response rules cannot undo actions already performed at the origin. Rules on the response body are not yet available.
  • All customers can create up to three custom response rules with Log and Block actions. The cf.waf.signature.response.* fields are available to paying customers and are still rolling out to accounts.
  • Events appear in Security Events and Security Analytics under the Managed Rules or Custom Rules service.
  • The first detections focus on exploit confirmation for high-profile vulnerabilities. Data exposure and exfiltration detections are planned.

Remediação

  • Check coverage under Security > Security Rules in the Cloudflare dashboard. The Cloudflare Managed Response Firewall Default ruleset offers one-click deployment.
  • Review full transaction detections in Security Analytics before building custom response phase policies.
  • Scope the managed ruleset to specific paths where needed to limit false positives.

Linha do tempo

  1. blog.cloudflare.com ↗ · pub. 21/10/2026 11:10 · coletado 21/10 12:00 primeiro registro

    Cloudflare launches full transaction WAF detection and response rules, with first managed protections for php2shell

    ler a análise desta fonte

    Cloudflare has made generally available to all customers, including Free plans, two new WAF capabilities: full transaction detections, which correlate each HTTP request with the origin's response to confirm exploitation, and response rules, which block the origin's response before it reaches the requester. The first managed protections target the recently disclosed php2shell vulnerability. Cloudflare argues that AI-driven vulnerability scanning is persistent and adaptive, and that request-only inspection forces a trade-off between false positives and coverage. This is a product announcement, not an incident report, and the article gives no CVE, IOCs or attribution.

    Technical Details

    • Detections attach metadata to the request and response. Rules then decide the action, so detection and mitigation are kept separate.
    • New fields: cf.waf.signature.response.confidence, cf.waf.signature.response.categories and cf.waf.signature.response.ref (up to 10 signature reference IDs).
    • The example use case is a path traversal request (GET /download?file=../../config/database.ini) combined with a response that contains private configuration content. A response rule then replaces the origin response with a WAF block page and HTTP 403.
    • Response rules cannot undo actions already performed at the origin. Rules on the response body are not yet available.
    • All customers can create up to three custom response rules with Log and Block actions. The cf.waf.signature.response.* fields are available to paying customers and are still rolling out to accounts.
    • Events appear in Security Events and Security Analytics under the Managed Rules or Custom Rules service.
    • The first detections focus on exploit confirmation for high-profile vulnerabilities. Data exposure and exfiltration detections are planned.

    Remediation

    • Check coverage under Security > Security Rules in the Cloudflare dashboard. The Cloudflare Managed Response Firewall Default ruleset offers one-click deployment.
    • Review full transaction detections in Security Analytics before building custom response phase policies.
    • Scope the managed ruleset to specific paths where needed to limit false positives.