ContentsTap to jump to a section＋
- Seven Anomalous Execution detections were announced for each Free and Managed ruleset, defaulting to Block.
- The ruleset IDs differ; these notices do not name a CVE or establish a site compromise.
- Check actual proxy routing, exceptions, Security Events and form/checkout behavior.
A new change at the web-request filtering layer
Cloudflare announced emergency WAF updates on October 21, 2026, adding seven Anomalous Execution detections to each Free and Managed ruleset, with Block as the new action. Website teams should verify effective configuration and critical user journeys.
A WAF evaluates web requests before the application. These releases establish new defenses, not successful compromises of customer websites. The two notices do not name a CVE, so no linkage is inferred from timing alone.
Businesses should track both protection and successful legitimate forms, uploads and checkout. More blocked requests are an investigation signal, not a count of attackers, affected customers or revenue saved.
Distinguish rulesets and their effective exceptions
The Free Managed Ruleset is available across plans; the broader Cloudflare Managed Ruleset requires an eligible paid plan. Cloudflare says the separate Free ruleset is unnecessary when the broader one is deployed. Preserve ruleset plus rule IDs when correlating the two releases.
Overrides, disabled rules and skip exceptions affect actual enforcement. Cloudflare documents that exceptions take precedence over overrides; broad exclusions can leave requests outside expected checks.
Friday Works recommends reviewing effective configuration on the owned zone or account. Identify which rules run, which requests are excluded and who handles false positives rather than adding overlapping configurations without review.
Validate business flows before changing enforcement scope
Test authorized sample login, form submission, valid uploads and sandbox checkout. Capture time, path, response and request identifier without real payment credentials or private customer records.
Correlate a blocked operation with Security Events before blaming the WAF. A backend failure is not automatically a firewall failure, and a working homepage does not verify form APIs or payment webhooks.
For confirmed false positives, Friday Works recommends narrowly approved exceptions with a review time. Disabling an entire ruleset for one legitimate request weakens unrelated coverage. No customer firewall changes or false-positive measurements were performed for this article.
Verify the WAF and application patch separately
Only traffic routed through the configured proxy and checks receives that protection. Review owned hostnames, API paths and authorized origin access rather than assuming every route is filtered. This is internal architecture review, not third-party bypass testing.
Apply relevant application patches independently. A WAF detects patterns it recognizes; it does not replace vulnerable application code. A new detection announcement is not sufficient evidence to close a patch ticket.
The genuine Cloudflare Docs Configure deployment cover is CC BY4.0. Its WordPress, Drupal and older CVE rows are archival sample data, not the October 21 rules. It illustrates Action versus Status without changing labels or selections.
References
Sources used in this guide
We prioritise official guidance and primary technical sources. Visit each source for full context and the latest updates.
- Emergency Free Ruleset release —21 October 2026Cloudflare ↗︎
- Emergency Managed Ruleset release —21 October 2026Cloudflare ↗︎
- Managed Rules: availability, overrides and exception precedence; maintained backgroundCloudflare Docs ↗︎
- Review security events for an owned zone; maintained backgroundCloudflare Docs ↗︎
- Actual vendor interface; Cloudflare Docs, © Cloudflare, CC BY 4.0; capture date unspecified, checked 22 October 2026; resize/framing onlyCloudflare ↗︎
- Cloudflare Docs CC BY 4.0 license, full notice retainedCloudflare ↗︎
- CC BY 4.0Creative Commons ↗︎