WAF Release: Four new detections moved to Block, XSS rule merged
Four new WAF detections including HTTP/2 Request Smuggling and XSS JavaScript Event Handler Coercion are moved from Log to Block mode. The XSS, HTML Injection - Script Tag - Beta rule is merged into the original rule, and a new Generic Rules - Remote Code Execution detection is added in Block mode.
This release moves four new detections from Log to Block, merges the XSS, HTML Injection - Script Tag - Beta rule into the original rule, and adds a Generic Rules - Remote Code Execution rule in Block mode.
Key Findings
-
Four new detections move from Log to Block: HTTP/2 Request Smuggling - Request Body Anomaly and XSS - JavaScript Event Handler Coercion across Headers, Body, and URI.
-
The XSS, HTML Injection - Script Tag - Beta rule is merged into the original rule.
-
A Generic Rules - Remote Code Execution detection is added in Block mode.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...1489d892 | N/A | HTTP/2 Request Smuggling - Request Body Anomaly | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...20646260 | N/A | XSS - JavaScript Event Handler Coercion - Headers | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...d706d517 | N/A | XSS - JavaScript Event Handler Coercion - Body | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...660886c8 | N/A | XSS - JavaScript Event Handler Coercion - URI | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...c293b926 | N/A | XSS, HTML Injection - Script Tag - Beta | Log | Block | This rule is merged into the original rule "XSS, HTML Injection - Script Tag" (ID: ...7b58420b). |
| Cloudflare Managed Ruleset | ...2ca6cce3 | N/A | Generic Rules - Remote Code Execution | N/A | Block | This is a new detection. |
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
DNS - Configure Advanced Custom Nameservers with nameserver sets
Nameserver sets are now available in beta for Enterprise accounts, allowing you to group custom nameserver names with Cloudflare-assigned IP addresses and assign them to multiple zones. This new approach replaces legacy custom_ns sets with reusable, immutable objects that support up to 3 IPv4 and 3 IPv6 addresses per nameserver and can leverage Advanced anycast network groups for improved resiliency.
Emergency WAF managed rule for active RCE vulnerability
Cloudflare released an emergency WAF update with a new managed rule to block exploitation of a critical remote code execution vulnerability in popular web frameworks. The Generic Rules - Remote Code Execution detection prevents attackers from executing arbitrary system commands via malicious input with invalid path sequences.
Cloudflare API MCP server sends Workers Issues as MCP Events
The Cloudflare API MCP server now exposes Workers Issues as MCP Events through webhook subscriptions, allowing agents to receive real-time notifications when production failures are detected without polling. Clients can subscribe to cloudflare.alert.workers_observability_real_time_issue scoped to an account or individual Worker.