|
Cloudflare added two capabilities to its web application firewall that look at what an origin server sends back, not only at what comes in. Full transaction detections evaluate each HTTP request together with its response for evidence that an exploit worked, and response rules can block the origin's reply before it reaches the requester. In its announcement, Cloudflare said both are generally available to all customers, including Free plans, and that its first managed protections built on them address the php2shell flaws in PHP.
PHP shipped emergency releases on Oct. 21 for CVE-2026-109618 and CVE-2026-109619, two runtime bugs that can allow unauthenticated remote code execution, after Cloudflare had already seen attack traffic, as WebProNews reported earlier. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP advisory.
What the response check adds
A request-only WAF has to guess whether a suspicious input did any harm. Cloudflare's post, by Daniele Molteni, Elie Roudninski and Nick Downie, says the response "provides the missing evidence." "A suspicious input followed by a response exposing sensitive information tells a different story from the same input followed by a rejection or an error," they wrote. When a response rule matches, Cloudflare swaps the origin's reply for a WAF block page or a custom response.
Every customer gets the Cloudflare Managed Response Firewall Default ruleset, which Cloudflare describes as a one-click deploy that can be scoped to specific paths. All plans can also write up to three custom response rules with Log and Block actions, though rules on the response body are not available yet. Paying customers get detection results in new fields such as cf.waf.signature.response.confidence and cf.waf.signature.response.categories, which Cloudflare said are still rolling out to accounts. The controls sit at the bottom of the Security > Security Rules page in the dashboard. |
