WAF - WAF Release - 2025-12-02 - Emergency

This week's emergency release introduces a new rule to block a critical RCE vulnerability in widely-used web frameworks through unsafe deserialization patterns. Key Findings New WAF rule deployed for RCE Generic Framework to block malicious POST requests containing unsafe deserialization patterns. If successfully exploited, this vulnerability allows attackers with network access via HTTP to execute arbitrary code remotely. Impact Successful exploitation allows unauthenticated attackers to execute arbitrary code remotely through crafted serialization payloads, enabling complete system compromise, data exfiltration, and potential lateral movement within affected environments. Ruleset Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Managed Ruleset 33aa8a8a948b48b28d40450c5fb92fba N/A RCE Generic - Framework N/A Block This is a new detection. Cloudflare Free Ruleset 2b5d06e34a814a889bee9a0699702280 N/A RCE Generic - Framework N/A Block This is a new detection.