Cloudflare WAF 2026-11-03更新：优化PHP漏洞规则并新增phpMyAdmin检测
WAF - WAF Release - 2026-11-03
推荐理由
涉及核心 WAF 规则库的变更，特别是新增了 phpMyAdmin 身份绕过的高危检测能力。建议管理员检查 Managed Ruleset 中该新规则的启用状态，以防御潜在的未授权访问风险。
This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative changes based on reports from Security Researchers as part of PHP Capture the Flag (CTF) challenge ↗︎.
本次发布引入了对 PHP 内存溢出（OOM）漏洞 CVE-2026-109618、CVE-2026-109619 和 CVE-2026-115560 底层规则表达式的更新。这些改进是基于安全研究人员在 PHP Capture the Flag (CTF) 挑战 ↗︎ 中提交的报告所进行的迭代变更。
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Free Ruleset | ...bcd95984 | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | Block | Block | Rule detection updated. |
| Cloudflare Free Ruleset | ...82dab691 | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | Block | Block | Rule detection updated. |
| Cloudflare Managed Ruleset | ...0a0c2f64 | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2 | Block | Block | Rule detection updated. |
| Cloudflare Managed Ruleset | ...545d163c | N/A | PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3 | Block | Block | Rule detection updated. |
| Cloudflare Managed Ruleset | ...13f91633 | N/A | phpMyAdmin - Authentication Bypass | N/A | Disabled | This is a new detection. |
| 规则集 | 规则 ID | 旧版规则 ID | 描述 | 先前操作 | 新操作 | 备注 |
|---|---|---|---|---|---|---|
| Cloudflare Free Ruleset | ...bcd95984 | N/A | PHP 远程代码执行攻击 (CVE-2026-109618, CVE-2026-109619) #2 | Block | Block | 规则检测已更新。 |
| Cloudflare Free Ruleset | ...82dab691 | N/A | PHP 远程代码执行攻击 (CVE-2026-109618, CVE-2026-109619) #3 | Block | Block | 规则检测已更新。 |
| Cloudflare Managed Ruleset | ...0a0c2f64 | N/A | PHP 远程代码执行攻击 (CVE-2026-109618, CVE-2026-109619) #2 | Block | Block | 规则检测已更新。 |
| Cloudflare Managed Ruleset | ...545d163c | N/A | PHP 远程代码执行攻击 (CVE-2026-109618, CVE-2026-109619) #3 | Block | Block | 规则检测已更新。 |
| Cloudflare Managed Ruleset | ...13f91633 | N/A | phpMyAdmin - 身份验证绕过 | N/A | Disabled | 这是一项新的检测。 |
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力