Cloudflare WAF adds full transaction detection and response rules to block confirmed exploits
Cloudflare Blog · rss · 2026-10-21
- Cloudflare expanded its WAF with two capabilities: full transaction detection (correlating HTTP requests with their responses to confirm whether exploitation succeeded) and response rules (blocking or replacing origin responses, e.g. with a 403 block page, before they reach the requester).
- The AI tie-in: frontier models are uncovering deep vulnerabilities in widely used software (e.g. php2shell), and AI agents scanning for flaws are highly persistent — adapting payloads via feedback and chaining vulnerabilities, credentials, and permissions. Request inspection alone can't tell whether an attempt worked; the response often provides the evidence.
- Example: a path traversal request followed by a response containing config-file content with database credentials is strong evidence of sensitive data exposure, enabling inline blocking.
- Detection and mitigation are separated by design: new fields like cf.waf.signature.response. feed custom rules, with results visible in Security Analytics.
- First managed protections target php2shell; coverage will expand to data exposure/exfiltration. Everything, including managed and custom response rules, is available to all plans including Free.
More from Infra
- LiteLLM compromised: 92M-downloads/month Python package shipped credential-stealing malware in v1.107.0 — KyeGomezB · 2026-10-22
- NVIDIA streams GTC Berlin After Hours: keynote reactions and developer outlook — NVIDIAAI · 2026-10-22
- Nvidia's SK Hynix deal locks up 37% of 2027 HBM, leaving ~15% for everyone else — Beth_Kindig · 2026-10-22
- Analyst: every AI infra supply chain check points to deepening under-supply — BenBajarin · 2026-10-22
- Shift-1 coding router cuts agent costs up to 55%, custom router training opens on AC2 — ypatil125 · 2026-10-22
- Lam Research pre-earnings checklist: how much of the memory capex boom reaches tool deliveries by 2027 — tengyanAI · 2026-10-22