Shattered Cloudflare WAF Updates Address Critical Vulnerabilities
Article Content
- •Cloudflare's Managed Ruleset updated for CVE-2026-111497 and CVE-2026-109619.
- •CVE-2026-111497 has a CVSS score of 9.2 and defaults to Log action.
- •Rapid release of WAF rules highlights the urgency of addressing emerging vulnerabilities.
Cloudflare has released emergency updates to its Managed Ruleset to address two critical vulnerabilities, CVE-2026-111497 and CVE-2026-109619, with the latter being identified just days before. The updates include two new rules for CVE-2026-111497, which defaults to Log rather than Block, raising concerns about the immediate effectiveness of the protection. The updates come as part of a broader trend where multiple web application firewalls (WAFs) are rapidly releasing new rules to combat emerging threats. The release pace for Cloudflare has been notably aggressive, with six Managed Ruleset releases in just 20 days. In contrast, AWS WAF has begun auto-upgrading Web ACLs, while Azure has not confirmed any new rules since February 2026. The lack of a versioning system complicates comparisons between these services, as the operational response to vulnerabilities is becoming more critical than feature lists. As of now, the vulnerabilities are classified as critical, with public proof-of-concept code available for CVE-2026-111497.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Amazon Web Services and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What are the CVEs addressed in the updates?
How does the default action of the new rules affect security?
What should organizations do to mitigate these vulnerabilities?
Continue Reading
Lazarus Group Linked to PHP Vulnerability Exploitation Plans A cybersecurity report from Cyfirma indicates that a group suspected to be linked to North Korea's Lazarus Group is preparing to exploit critical vulnerabilities in PHP, specifically CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. The attackers, communicating in Korean, are… 
Japan Issues Warning Over Critical PHP Vulnerabilities Affecting Government Sites Japanese Prime Minister Sanae Takaichi announced critical vulnerabilities in the PHP programming language, widely used on government and commercial websites. The vulnerabilities, CVE-2026-109619 and CVE-2026-109618, both rated CVSS 9.2, were disclosed on October 21, 2026, with proof-of-concept code for CVE-2026-109618…