WAF - WAF Release - 2025-09-26

Managed Ruleset Updated This update introduces 11 new detections in the Cloudflare Managed Ruleset (all currently set to Disabled mode to preserve remediation logic and allow quick activation if needed). The rules cover a broad spectrum of threats - SQL injection techniques, command and code injection, information disclosure of common files, URL anomalies, and cross-site scripting. Ruleset Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Managed Ruleset 3ffd242b4ba242ca965022d3a67d8561 100859A SQLi - UNION - 3 N/A Disabled This is a New Detection Cloudflare Managed Ruleset 91d9cf56355b4ab88481b2fd4de80468 100889 Command Injection - Generic 9 N/A Disabled This is a New Detection Cloudflare Managed Ruleset c15ca8e8290f485287037665f2be3ddf 100890 Information Disclosure - Common Files - 2 N/A Disabled This is a New Detection Cloudflare Managed Ruleset 56669615f2984c2cac8c608980a252a8 100891 Anomaly:URL - Relative Paths N/A Disabled This is a New Detection Cloudflare Managed Ruleset c41789fb6370431d809567d17e7d3865 100894 XSS - Inline Function N/A Disabled This is a New Detection Cloudflare Managed Ruleset b995d0b930604fa6b8d9b2a13792565c 100895 XSS - DOM N/A Disabled This is a New Detection Cloudflare Managed Ruleset ab8277e3f432400bbd9403dd42978e38 100896 SQLi - MSSQL Length Enumeration N/A Disabled This is a New Detection Cloudflare Managed Ruleset 3ec33bc5ac77495a9f55020e3ab43f7e 100897 Generic Rules - Code Injection - 3 N/A Disabled This is a New Detection Cloudflare Managed Ruleset 4375dc90c7af4c55908f6b95c1686741 100898 SQLi - Evasion N/A Disabled This is a New Detection Cloudflare Managed Ruleset 945c5aa9f45141dd872d7ec920999be0 100899 SQLi - Probing 2 N/A Disabled This is a New Detection Cloudflare Managed Ruleset 2c20b5e8684043f48620ff77b4026c88 100900 SQLi - Probing N/A Disabled This is a New Detection