Changelog

New updates and improvements at Cloudflare.

WAF Release - 2025-09-26

Sep 26, 2025

Managed Ruleset Updated

This update introduces 11 new detections in the Cloudflare Managed Ruleset (all currently set to Disabled mode to preserve remediation logic and allow quick activation if needed). The rules cover a broad spectrum of threats - SQL injection techniques, command and code injection, information disclosure of common files, URL anomalies, and cross-site scripting.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100859A	SQLi - UNION - 3	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100889	Command Injection - Generic 9	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100890	Information Disclosure - Common Files - 2	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100891	Anomaly:URL - Relative Paths	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100894	XSS - Inline Function	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100895	XSS - DOM	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100896	SQLi - MSSQL Length Enumeration	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100897	Generic Rules - Code Injection - 3	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100898	SQLi - Evasion	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100899	SQLi - Probing 2	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100900	SQLi - Probing	N/A	Disabled	This is a New Detection

Was this helpful?

Community
X
Discord
YouTube
GitHub