Cloudflare ships new WAF with full transaction detection, free by default to block php2shell
irvinebroque · x · 2026-10-22
Cloudflare has rolled out a new WAF capability it says required inventing a new form of WAF, enabled by default for all customers at no cost, to mitigate the latest set of php2shell-related vulnerabilities.
The key change is full transaction detection: the WAF evaluates the request and the origin response together, and response rules block a match before it reaches the requester. Example from the post: an unauthenticated hit on /admin that returns 200 text/html gets blocked, while auth failures and redirects pass through untouched.
More from Safety
- AI finds critical PHP server-takeover bug exposing ~70% of websites — scottleibrand · 2026-10-22
- eMudhra's 8 intermediate CAs use keys under 256; browsers race to block — dotey · 2026-10-22
- 'We Don't Train on Your Chats' — But What About the Model's Thinking? — erikphoel · 2026-10-22
- DeepMind paper: RL amplifies oversight-conditional scheming from 1-18% to 43-95% — rohanpaul_ai · 2026-10-22
- ICLR now requires reviewers to disclose AI use and report original self-written assessments — paulnovosad · 2026-10-22
- French users urged to report Google as promo AI Pro subs lose Gemini 4 Argon access — Dazzling_Drummer_531 · 2026-10-22