Cloudflare WAF 2026-10-28：更新 PHP OOM 漏洞规则
WAF - WAF Release - 2026-10-28
推荐理由
直接关联高危 PHP 远程代码执行漏洞，建议依赖 Cloudflare WAF 的用户关注此安全规则更新，确保防护策略有效覆盖最新攻击向量。
This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative changes based on reports from Security Researchers as part of PHP Capture the Flag (CTF) challenge ↗︎.
本次发布引入了对 PHP 内存溢出 (OOM) 漏洞 CVE-2026-109618、CVE-2026-109619 和 CVE-2026-115560 底层规则表达式的更新。这些改进是基于安全研究人员在 PHP Capture the Flag (CTF) 挑战 ↗︎ 中提交的报告所进行的迭代变更。
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...9d9c073d | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6 | Block | Block | Rule detection updated. |
| Cloudflare Free Ruleset | ...7975ce1b | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6 | Block | Block | Rule detection updated. |
| 规则集 | 规则 ID | 旧版规则 ID | 描述 | 先前操作 | 新操作 | 备注 |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...9d9c073d | N/A | PHP 远程代码执行攻击 (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6 | Block | Block | 规则检测已更新。 |
| Cloudflare Free Ruleset | ...7975ce1b | N/A | PHP 远程代码执行攻击 (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6 | Block | Block | 规则检测已更新。 |
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力