WAF Release - 2025-09-26
Managed Ruleset Updated
This update introduces 11 new detections in the Cloudflare Managed Ruleset (all currently set to Disabled mode to preserve remediation logic and allow quick activation if needed). The rules cover a broad spectrum of threats - SQL injection techniques, command and code injection, information disclosure of common files, URL anomalies, and cross-site scripting.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | 100859A | SQLi - UNION - 3 | N/A | Disabled | This is a New Detection | |
| Cloudflare Managed Ruleset | 100889 | Command Injection - Generic 9 | N/A | Disabled | This is a New Detection | |
| Cloudflare Managed Ruleset | 100890 | Information Disclosure - Common Files - 2 | N/A | Disabled | This is a New Detection | |
| Cloudflare Managed Ruleset | 100891 | Anomaly:URL - Relative Paths | N/A | Disabled | This is a New Detection | |
| Cloudflare Managed Ruleset | 100894 | XSS - Inline Function | N/A | Disabled | This is a New Detection | |
| Cloudflare Managed Ruleset | 100895 | XSS - DOM | N/A | Disabled | This is a New Detection | |
| Cloudflare Managed Ruleset | 100896 | SQLi - MSSQL Length Enumeration | N/A | Disabled | This is a New Detection | |
| Cloudflare Managed Ruleset | 100897 | Generic Rules - Code Injection - 3 | N/A | Disabled | This is a New Detection | |
| Cloudflare Managed Ruleset | 100898 | SQLi - Evasion | N/A | Disabled | This is a New Detection | |
| Cloudflare Managed Ruleset | 100899 | SQLi - Probing 2 | N/A | Disabled | This is a New Detection | |
| Cloudflare Managed Ruleset | 100900 | SQLi - Probing | N/A | Disabled | This is a New Detection |