# waf Published articles for waf. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## GHSA-3h27-hjv7-fqjx: Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name DevFeed: [GHSA-3h27-hjv7-fqjx: Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name]() Original publisher: [Read original article]() Author: Fabien Potencier Published: 2026-11-04T11:54:00Z Content type: release Language: en Sources: [Symfony]() Topics: [Symfony](), [frontend security]() Tags: [admin](), [apache](), [block](), [branch](), [cdn](), [cve](), [foundation](), [http](), [location](), [nginx](), [patch](), [php](), [request](), [route](), [router](), [rules](), [script](), [security](), [symfony](), [waf]() ### AI overview Affected Symfony HTTP Foundation releases strip a script name such as `/index.php` even when it is only the beginning of a longer path segment. With `SCRIPT_NAME=/index.php`, `/index.phpadmin` can therefore be routed as `/admin`; encoded variants also work. Symfony `access_control` and firewall rules use the same path info as the router and are not affected, but front-of-PHP protections such as nginx or Apache path rules and CDN or WAF rules on `/admin` can be bypassed. The issue affects versions 5.4.50-5.4.55, 6.4.29-6.4.49, 7.3.7-7.4.22, and 8.0 through 8.1.10. The fix strips the script name only when followed by `/`, `?`, or the end of the URL; fixed releases are 5.4.56, 6.4.50, 7.4.23, and 8.1.11. ### Source excerpt Affected versions Symfony HTTP Foundation versions >=5.4.50, <5.4.56, >=6.4.29, <6.4.50, >=7.3.7, <7.4.23, >=8, <8.1.11 are affected by this security issue. The issue has been fixed in Symfony HTTP Foundation 5.4.56, 6.4.50, 7.4.23,... ## Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access DevFeed: [Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-11-03T15:59:19Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [exploit chaining](), [Authorization]() Tags: [2026](), [application-delivery](), [attack](), [authentication](), [authorization](), [barracuda](), [bypass](), [command-injection](), [cve](), [cve-2026-111560](), [cve-2026-116606](), [email-security](), [firewall](), [firmware](), [interface](), [interfaces](), [load-balancer](), [network-security](), [root](), [vulnerabilities](), [vulnerability](), [waf](), [web-security]() ### AI overview Barracuda disclosed two flaws that could be chained to bypass authorization and gain root access, but successful exploitation requires access to an affected product's administrative interface. CVE-2026-116606 (CVSS 9.3) affects Email Security Gateway; CVE-2026-111560 (CVSS 8.6) also affects Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Barracuda says systems whose administrative interfaces are not exposed to the internet are less vulnerable to this attack path. It advises restricting those interfaces to trusted internal networks, limiting access with network controls, and ensuring devices have current firmware and all security patches; devices several firmware versions behind may require multiple updates. ### Source excerpt Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible ... Read more Published Date: Nov 03, 2026 (4 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-116606 CVE-2026-111560 ## Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities DevFeed: [Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities]() Original publisher: [Read original article]() Author: Celso Martinho Published: 2026-11-03T14:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [cve remediation](), [Cloudflare](), [Security research](), [cybersecurity and infrastructure security agency]() Tags: [actions](), [active-exploitation](), [agent](), [ai](), [ai-agent](), [applications](), [assessment](), [attack](), [basic](), [blocking](), [cisa](), [cloudflare](), [critical](), [cve](), [cves](), [how-to](), [infrastructure](), [internet](), [product-news](), [radar](), [remediation](), [security](), [threat-intelligence](), [vulnerabilities](), [waf]() ### AI overview Zero Wire is a public vulnerability intelligence feed on Cloudflare Radar focused on significant critical CVEs in Internet-facing software. Its briefings explain impact, who should investigate, current exploitation evidence, remediation guidance, and relevant Cloudflare controls, with links to vendor advisories and other sources. Readers can use a supplied prompt for a read-only, evidence-based assessment of their own infrastructure. Briefings distinguish severity from observed exploitation, and traffic matching WAF rules is not proof of compromise or a count of successful exploits. A WAF rule, where available, is a compensating control requiring configuration review; it does not replace vendor patches or undo actions already taken at the origin. Status, last-checked dates, and update chronologies show how guidance changes, while "Reference" status does not mean every affected system is remediated. ### Source excerpt Zero Wire on Cloudflare Radar pairs plain-language briefings with global attack telemetry and remediation steps. Triage critical CVEs faster and decide how to protect your infrastructure. ## Cloudflare services for private origins is now generally available DevFeed: [Cloudflare services for private origins is now generally available]() Original publisher: [Read original article]() Author: Enrique Somoza Published: 2026-10-30T14:23:43Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Cloudflare](), [Application Services](), [Cloudflare One](), [Bot Management](), [Cloudflare Workers]() Tags: [2](), [3](), [acceleration](), [account](), [application-services](), [bot](), [bot-management](), [caching](), [cloudflare](), [cloudflare-one](), [cloudflare-zero-trust](), [connectivity](), [customer](), [dns](), [management](), [one](), [private](), [private-network](), [product-news](), [public](), [services](), [traffic](), [waf](), [with](), [workers](), [zero-trust]() ### AI overview Cloudflare services for private origins is generally available to customers with the required entitlement and Cloudflare One connectivity. A proxied A or AAAA record can point to a private origin; Cloudflare routes requests over the existing private connection, keeping the origin private while applying services such as WAF, bot management, rate limiting, caching, rewrite rules, and Workers. Private routing is enabled automatically for specified private address ranges and must be enabled manually for a public IP reachable only through the private network. Setup requires Unified Routing except with Cloudflare Tunnel, and Cloudflare WAN or Mesh also requires return routes for Cloudflare's source ranges. Argo Smart Routing and Dedicated CDN Egress IPs are unsupported; origin health checks require Load Balancing. The article says private-to-private access is still in development, with a closed beta targeted for early 2027. ### Source excerpt Public traffic to private origins, with WAF, bot management, caching, and Workers, is now available to every customer with Cloudflare One connectivity. ## Introducing the Cloudflare PHP Capture the Flag challenge DevFeed: [Introducing the Cloudflare PHP Capture the Flag challenge]() Original publisher: [Read original article]() Published: 2026-10-27T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog](), [Cyber Newsroom]() Topics: [ctf](), [Cloudflare](), [PHP](), [Application Services](), [cve remediation]() Tags: [books](), [bug-bounty](), [capture](), [capture-the-flag](), [certificates](), [challenge](), [cloudflare](), [cve](), [cve-2026-109618](), [cve-2026-109619](), [emudhra](), [first](), [flag](), [history](), [intermediate](), [internet](), [internet-security](), [minutes](), [one](), [php](), [security](), [vulnerabilities](), [waf]() ### AI overview Cloudflare launched a limited-time PHP CTF through its HackerOne Bug Bounty program to test WAF protections against CVE-2026-109618 and CVE-2026-109619. Researchers who first accept the bounty terms may test only POST requests to the challenge hostname's WAF-protected /php/* endpoints. To qualify, a submission must demonstrate attacker-controlled PHP code or command execution in the sandbox, recover /flag, verify it in the CTF interface before reset, and file a reproducible private HackerOne report. Only materially distinct bypass methods or payloads qualify; duplicate decisions and awards are Cloudflare's. The post says WAF response blocking does not replace patching vulnerable PHP, since it cannot undo actions already performed at the origin. ### Source excerpt Introducing the Cloudflare PHP Capture the Flag challenge Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged certificates that could be used to impers ... Read more Published Date: Oct 27, 2026 (3 hours, 8 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-109619 CVE-2026-109618 CVE-2023-50387 ## Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAF DevFeed: [Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAF]() Original publisher: [Read original article]() Author: abhinav modi Published: 2026-10-22T14:51:40Z Content type: news Language: en Sources: [VMware]() Topics: [PHP](), [memory handling](), [cve remediation]() Tags: [avi](), [avi-load-balancer](), [cloud-infrastructure](), [critical](), [load-balancing](), [php](), [php2shell](), [vmware](), [vmware-vdefend](), [waf]() ### AI overview The article describes two unauthenticated PHP RCE vulnerabilities, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), and proposes network controls to protect workloads while patches are prepared. vDefend Gateway Firewall decrypts HTTPS at Tier-0/Tier-1 boundaries and uses IDPS signatures to block exploit attempts and INFO-mode detectors for visibility; existing NSX overlay customers can enable inspection without added appliances or network redesign. Avi WAF identifies PHP versions from traffic headers, normalizes and inspects requests, applies CRS controls, and recommends CVE-specific virtual patches in Enforcement mode and IP Reputation. vDefend DFW micro-segments workloads, while ATP analyzes suspicious payloads and blocks command-and-control or reverse-shell traffic. These measures are presented as virtual patching and containment, not software fixes. ### Source excerpt The global threat landscape shifted dramatically today following the disclosure of PHP2Shell, a pair of critical Remote Code Execution (RCE) vulnerabilities tracked as CVE-2026-109618 (OOM memory corruption) and CVE-2026-109619 (stale global state). Both carry a CVSS score of 9.2 and affect core memory handling across decades of PHP releases. Because PHP powers a vast portion ... Continued The post Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAF appeared first on VMware Blogs. ## Introducing full transaction detection for Cloudflare WAF DevFeed: [Introducing full transaction detection for Cloudflare WAF]() Original publisher: [Read original article]() Author: Nick Downie Published: 2026-10-21T14:10:42Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Cloudflare](), [threat detection](), [Application Services](), [Detection engineering](), [Incident response]() Tags: [403](), [application](), [can](), [cloudflare](), [customer](), [data](), [data-exposure](), [detection](), [exploits](), [firewall](), [full](), [helps](), [http](), [inspection](), [managed-rules](), [request](), [security](), [security-analytics](), [transaction](), [vulnerabilities](), [waf](), [web](), [web-application-firewall](), [with]() ### AI overview Cloudflare WAF can now correlate an HTTP request with its origin response to detect evidence that an exploit succeeded. This adds outcome evidence that request-only inspection cannot establish, which can help distinguish a successful exposure from a rejected or failed attempt. Detection and mitigation are separate: detections attach metadata for investigation, and response rules can log or replace a matching origin response with a WAF block page or custom response before it reaches the requester. They cannot undo actions already performed at the origin. All plans have managed protections and up to three custom response rules with Log and Block actions; paying customers can use attack detection fields in tailored rules. Response body rules are not yet available, and response fields are still rolling out. Matching events appear in Security Events, while detections can be reviewed in Security Analytics. The first managed protections target php2shell. ### Source excerpt Cloudflare's web application firewall can now correlate an HTTP request with its response. Full transaction detection helps every customer find successful exploits, data exposure, and risky misconfigurations that request-only inspection can miss. ## Cloudflare deploys protections against php2shell vulnerability DevFeed: [Cloudflare deploys protections against php2shell vulnerability]() Original publisher: [Read original article]() Author: Kuber Nandwani Published: 2026-10-21T13:56:45Z Content type: news Language: en Sources: [Cloudflare Blog]() Topics: [Cloudflare](), [Application Services](), [Exploit](), [Memory Safety](), [cve remediation]() Tags: [2026](), [3](), [about](), [actions](), [application](), [cloudflare](), [data](), [disclosure](), [exploit](), [firewall](), [managed-rules](), [php](), [php2shell](), [public](), [request](), [rules](), [security](), [vulnerabilities](), [vulnerability](), [waf](), [web](), [web-application-firewall]() ### AI overview Cloudflare says its WAF protections for the php2shell PHP vulnerabilities were enabled by default on October 21, 2026, and were deployed about nine hours before public disclosure. Free plans receive the rules automatically; paid-plan customers should confirm their Managed Ruleset is deployed in block mode. The detection combines request and origin-response signals within one HTTP transaction, allowing it to identify likely successful exploits and block matching responses before they reach the requester. Cloudflare reports observing attack traffic and adapting rules as payloads changed. The WAF is defense in depth: administrators still need to update the PHP runtime, since updating application code or plugins alone does not fix these flaws. The excerpt also recommends keeping WAF protection enabled and says upload restrictions may reduce exposure but do not replace the PHP update. ### Source excerpt Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. ## Critical RCE Vulnerabilities Discovered in Core PHP: CVE-2026-109618 and CVE-2026-109619 DevFeed: [Critical RCE Vulnerabilities Discovered in Core PHP: CVE-2026-109618 and CVE-2026-109619]() Original publisher: [Read original article]() Author: Natalie Griffeth Published: 2026-10-21T00:00:00Z Content type: news Language: en Sources: [Fastly Blog]() Topics: [PHP](), [cve remediation]() Tags: [2026](), [7-4](), [about](), [account](), [all](), [attention](), [backports](), [branch](), [core](), [critical](), [cve](), [cve-2026-109618](), [cve-2026-109619](), [details](), [fastly](), [php](), [protection](), [rce](), [security](), [vulnerabilities](), [waf]() ### AI overview The excerpt describes two Core PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 and capable of remote code execution. The first involves out-of-memory handling that can leave request memory uninitialized; the second involves fatal-error handling that can leave global memory pointing to freed memory. The PHP Foundation fixed them in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The excerpt advises upgrading or checking with distribution and LTS vendors about backported fixes; minimal source backports are available for PHP 7.4, 8.0, and 8.1. Fastly customers can opt in to Next-Gen WAF rules for temporary protection through the dashboard. ### Source excerpt Discover details on critical Core PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619. Learn about impacts, patching guidance, and Fastly WAF protection. ## Protecting NetScaler gateways with access controls and origin restrictions DevFeed: [Protecting NetScaler gateways with access controls and origin restrictions]() Original publisher: [Read original article]() Author: Kenny Johnson Published: 2026-10-19T13:00:00Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Security](), [network security](), [Single sign-on (SSO)](), [ai security](), [software security audit]() Tags: [actively-exploited](), [application-security](), [citrix-netscaler](), [cloudflare-access](), [cloudflare-tunnel](), [cloudforce-one](), [cve-2026-88771](), [patching](), [security](), [vulnerabilities](), [waf](), [zero-trust]() ### AI overview The article explains how teams can reduce exposure of NetScaler Gateway and other public authentication services after patching. It recommends placing access policies before the service, restricting direct connections to the origin, and using a web application firewall to inspect requests. It also outlines checks for direct-origin bypasses and notes that DTLS listeners and desktop traffic require separate controls. ### Source excerpt CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams don't have, so the sign-in decision has to move in front of the vulnerable code. ## Hackers exploit SiteGuard WAF flaw to run commands as admins DevFeed: [Hackers exploit SiteGuard WAF flaw to run commands as admins]() Original publisher: [Read original article]() Author: Bill Toulas Published: 2026-10-18T14:23:16Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Vulnerabilities](), [ARKTunnel]() Tags: [2026](), [actively-exploited](), [apache](), [command-injection](), [computer-help](), [computer-security](), [computers](), [cve](), [exploitation](), [exploited](), [freebsd](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [nginx](), [rce](), [remote-code-execution](), [root](), [run](), [security](), [security-advisory](), [server](), [siteguard](), [spyware](), [support](), [system](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [vulnerability](), [waf](), [windows]() ### AI overview Attackers are exploiting CVE-2026-106931, an OS command-injection flaw in SiteGuard Server Edition that can grant root or SYSTEM privileges. The vulnerability affects certain versions when the statistics feature is active; the vendor provides patches and advises administrators to preserve diagnostic information before remediation. ### Source excerpt Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...] ## Fastly examines AI bot impersonation and probes for sensitive files DevFeed: [Fastly examines AI bot impersonation and probes for sensitive files]() Original publisher: [Read original article]() Author: Simran Khalsa; Fastly Security Research Team Published: 2026-10-13T00:00:00Z Content type: article Language: en Sources: [Fastly Blog]() Topics: [Secrets Management](), [Bot Management](), [Secret Scanning]() Tags: [ai](), [bot-traffic](), [credentials](), [waf]() ### AI overview Fastly reports that, during one day of traffic, about 6.3 million requests from nearly 10,200 IP addresses falsely identified themselves as AI crawlers or fetchers while probing for sensitive files. The article describes how the traffic targeted environment files and other private data, and explains how Fastly's Bot Management verification signals and a WAF rule can help block unverified requests claiming known AI bot identities. ### Source excerpt In a single day over 6M requests posed as AI bots to probe for .env files, Git metadata, credentials and other private files. Unpack the threat of AI bot cosplay and learn how Fastly's WAF rules can block impostors. ## Cloudflare Uses an AI Harness to Probe and Harden Its WAF DevFeed: [Cloudflare Uses an AI Harness to Probe and Harden Its WAF]() Original publisher: [Read original article]() Author: Matt Foster Published: 2026-10-07T07:21:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Application Services](), [software supply-chain attack](), [Frontier AI](), [Agent Harness](), [Cloudflare One]() Tags: [agentic-ai-architecture](), [ai](), [ai-harness](), [ai-ml-data-engineering](), [ai-security](), [application-security](), [architecture-design](), [based](), [cloud-metadata](), [cloudflare-sec-harness](), [command-injection](), [devsecops](), [human-review](), [investigation](), [ml-data-engineering](), [news](), [waf]() ### AI overview Cloudflare used a controlled harness to have frontier AI models probe its Web Application Firewall with variations on attacks it had already blocked. Across 45 scenarios, the system generated 1,107 attempts, which human reviewers narrowed to 49 findings for further remediation; the work contributed to three Managed Ruleset changes. The article describes how a Python harness constrained request execution and preserved scenario state while models proposed and reviewed mutations. It also compares this discovery and validation pattern with other AI-assisted vulnerability research systems. ### Source excerpt Cloudflare placed frontier AI models inside a controlled testing harness to probe its Web Application Firewall (WAF), using blocked attacks as starting points for models to generate and refine new variations. By Matt Foster ## Microfrontends Routing is now free for Firewall-mitigated traffic DevFeed: [Microfrontends Routing is now free for Firewall-mitigated traffic]() Original publisher: [Read original article]() Author: Sage Abraham Published: 2026-10-07T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Firewall]() Tags: [cdn](), [firewall](), [waf](), [web-application-firewall]() ### AI overview Vercel now makes Microfrontends Routing free for requests its Web Application Firewall denies, challenges, or rate limits. CDN Requests and Fast Data Transfer were already free for this traffic, and the change applies automatically to every project using microfrontends. ### Source excerpt Microfrontends Routing is now free for requests that the Web Application Firewall (WAF) denies, challenges, or rate limits. CDN Requests and Fast Data Transfer are already free for this traffic. The change applies automatically to every project using microfrontends. Learn how to set up WAF rules in the Firewall documentation. Read more ## Back to Basics: Insecure Deserialization DevFeed: [Back to Basics: Insecure Deserialization]() Original publisher: [Read original article]() Author: Matthew Mathur; Lorraine Bellon; Fastly Security Research Team Published: 2026-10-06T00:00:00Z Content type: article Language: en Sources: [Fastly Blog]() Topics: [Data serialization](), [Cybersecurity]() Tags: [application-security](), [attacks](), [basics](), [best-practices](), [fastly](), [how-to](), [prevent](), [secure-coding](), [security](), [waf]() ### AI overview Insecure deserialization occurs when an application reconstructs data from untrusted input, especially with language-native formats that can trigger extra actions during reconstruction. Attackers may combine available actions into gadget chains; successful exploits can expose information, alter or delete files, or enable remote code execution. The excerpt recommends reviewing serialization mechanisms, reducing deserialization of user-controlled data, choosing simpler formats such as JSON where practical, allow-listing expected data types, verifying signatures strictly, and auditing error logs. It also describes Fastly Next-Gen WAF as detecting malicious serialized inputs while allowing benign serialized data, including patterns involving PHP, Java, and FastJSON. ### Source excerpt Learn what insecure deserialization is, how attackers exploit it, and how to prevent attacks using secure coding best practices and the Fastly Next-Gen WAF. ## Protect MCP Endpoints at the Edge with Amazon CloudFront and AWS WAF DevFeed: [Protect MCP Endpoints at the Edge with Amazon CloudFront and AWS WAF]() Original publisher: [Read original article]() Author: Jaiganesh Girinathan Published: 2026-10-05T18:25:14Z Content type: tutorial Language: en Sources: [Networking & Content Delivery]() Topics: [MSP MCP](), [Amazon Web Services](), [Cloudflare Workers](), [TLS (Transport Layer Security)]() Tags: [advanced-300](), [amazon-cloudfront](), [aws](), [aws-waf](), [best-practices](), [model-context-protocol-mcp](), [networking-content-delivery](), [security](), [security-identity-compliance](), [thought-leadership](), [waf]() ### AI overview The article explains how to secure and monitor Model Context Protocol endpoints with AWS WAF at Amazon CloudFront or an Application Load Balancer. It presents nine controls, including protocol-version checks, caller labeling, request-size limits, tool allowlists, SQL and SSRF detection, and rate limits. It also describes observability and recommends testing rules in Count mode before blocking traffic. Per-user rate limits and token validation remain responsibilities of the origin server. ### Source excerpt AWS WAF gives you a practical way to secure and observe Model Context Protocol (MCP) endpoints at the edge. MCP has quickly become the standard way AI agents communicate to tools and data. Originally, it was a stateful protocol built around long-running sessions, persistent connections, and client-to-server-instance binding. The 2026-07-28 MCP revision redesigned MCP as [...] ## Enforce positive security with Cloudflare Application Profiles DevFeed: [Enforce positive security with Cloudflare Application Profiles]() Original publisher: [Read original article]() Author: Zhiyuan Zheng Published: 2026-09-29T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Application Services](), [Security](), [prompt injection](), [XSS]() Tags: [ai](), [api-security](), [application-security](), [application-services](), [attack-surface](), [birthday-week](), [cloudflare](), [cross-site-scripting](), [http](), [learning](), [security](), [waf]() ### AI overview Cloudflare is launching Application Profiles, which learn the structure and format of an application's HTTP requests and detect deviations. The profiles extend Cloudflare's positive security approach from APIs to web applications, with a closed beta for invited Enterprise customers and access for existing API Security customers. ### Source excerpt Cloudflare learns the structure of your HTTP requests and identifies deviations. You can add a positive security layer that helps reduce attack surface as AI makes it easier for attackers to generate and vary payloads. ## We tested our own WAF with frontier AI models. Here's what we found DevFeed: [We tested our own WAF with frontier AI models. Here's what we found]() Original publisher: [Read original article]() Author: Kuber Nandwani Published: 2026-09-29T13:00:00Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [LLM security](), [ai security](), [Frontier AI](), [Agentic SOC]() Tags: [ai](), [ai-waf](), [application-security](), [application-security-testing](), [application-services](), [birthday-week](), [cloudflare](), [deep-dive](), [detection](), [frontier-ai](), [frontier-ai-models](), [human-review](), [machine-learning](), [managed-rules](), [waf](), [waf-attack-score]() ### AI overview Cloudflare describes an adaptive tester that used frontier AI models to probe a web application firewall in an authorized staging environment. It varied exploit payloads based on HTTP responses, surfaced possible detection gaps for human review, and informed new WAF detections. ### Source excerpt We built a WAF tester that adapted each request based on what the WAF blocked or passed. This helped us explore variations that a fixed test might miss. We ran it across six attack categories on an authorized staging environment and discovered detection gaps worth fixing. Here's how the loop worked, what got through, and what we did about it. ## Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account DevFeed: [Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account]() Original publisher: [Read original article]() Author: Jacob Crisp Published: 2026-09-29T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Cloudflare](), [Cloudforce One](), [OSINT](), [Cloudflare One]() Tags: [agentic-workflows](), [agents](), [ai](), [automate](), [birthday-week](), [cloudforce-one](), [context](), [indicators-of-compromise](), [intel](), [product-news](), [security](), [threat-intelligence](), [waf]() ### AI overview Cloudflare introduces Threat Signals, which uses agentic skills to summarize chosen open-source threat reports, preserve context, extract and normalize indicators of compromise, and apply tags. The resulting intelligence is stored in an account-scoped dataset and can be applied to WAF policies. Cloudflare is expanding access to its Threat Events Platform, with free access for all accounts and expanded capabilities for enterprise customers. ### Source excerpt We are expanding access to Cloudforce One's Threat Events Platform to every Cloudflare account and introducing Threat Signals. Threat Signals automatically parses open-source threat reporting, extracts structured indicators, and connects threat context directly to your WAF rules. ## The Anatomy of Exposure: Why the Market Cannot Agree on What Counts as One DevFeed: [The Anatomy of Exposure: Why the Market Cannot Agree on What Counts as One]() Original publisher: [Read original article]() Author: Yuriy Butuzov Published: 2026-09-27T11:54:47Z Content type: article Language: en Sources: [HackerNoon]() Topics: [Exposure Management](), [alert triage]() Tags: [attack-surface-management](), [ctem](), [cve](), [cybersecurity](), [exposure-management](), [hackernoon-top-story](), [iam](), [identity-security](), [mfa](), [risk-management](), [security](), [vulnerability-management](), [waf]() ### AI overview Exposure-management tools can report very different totals because they count different objects, such as security conditions, tool findings, affected assets, or attack paths. The article defines an exposure as a reachable target combined with an attacker starting position, relevant conditions, and a technique, and distinguishes that exposure from probability, target value, and compensating controls. ### Source excerpt Two exposure tools can scan the same environment and return 40,000 findings or 900 exposures -- both correct, because each counts a different object. ## ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks DevFeed: [ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks]() Original publisher: [Read original article]() Author: Lawrence Abrams Published: 2026-09-26T19:03:34Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Cybersecurity](), [frontend security]() Tags: [bypass](), [computer-help](), [computer-security](), [computers](), [cve-2026-35273](), [decoding](), [exploitation](), [firewall](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [oracle](), [oracle-peoplesoft](), [remote-code-execution](), [search](), [security](), [security-update](), [shinyhunters](), [spyware](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [vulnerability](), [waf](), [web-application-firewall](), [windows](), [zero-day-vulnerability]() ### AI overview ShinyHunters is using percent-encoded URL paths to bypass web application firewall rules targeting Oracle PeopleSoft's vulnerable PSEMHUB endpoint. Because some WAFs check the literal path before decoding while WebLogic decodes it for routing, the rules can miss the request. Google warns attackers may use other path variations and recommends installing the security update; organizations can also review WebLogic logs for encoded endpoint requests. ### Source excerpt The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. [...] ## Caching Cognito M2M Tokens With Lambda, DynamoDB, and WAF DevFeed: [Caching Cognito M2M Tokens With Lambda, DynamoDB, and WAF]() Original publisher: [Read original article]() Author: Lucas Tonelli Published: 2026-09-24T17:00:19Z Content type: tutorial Language: en Sources: [HackerNoon]() Topics: [Amazon Web Services](), [Authentication](), [OAuth 2.0](), [Amazon API Gateway]() Tags: [access-token-caching](), [api-gateway](), [authentication](), [aws](), [aws-cognito](), [aws-cost-optimization](), [aws-lambda](), [aws-waf](), [caching](), [costs](), [dynamodb](), [dynamodb-ttl](), [lambda](), [m2m-authentication](), [oauth](), [oauth-2-0](), [oauth2-client-credentials](), [tokens](), [waf]() ### AI overview The tutorial describes placing a Lambda function between services and Amazon Cognito to cache machine-to-machine OAuth 2.0 access tokens in DynamoDB. It explains how expiry checks, TTL, scope-aware keys, and AWS WAF can reduce repeated token requests and related costs. ### Source excerpt A Lambda in front of Cognito's token endpoint caches tokens in DynamoDB, reducing the number of requests to Cognito and saving money. By adding AWS WAF to block direct requests to Cognito, the solution ensures that all requests go through the Lambda, further reducing costs. ## How we built ngrok's WAF with OWASP CRS and Coraza DevFeed: [How we built ngrok's WAF with OWASP CRS and Coraza]() Original publisher: [Read original article]() Author: Ben Chan Published: 2025-12-10T00:00:00Z Content type: article Language: en Sources: [\[ngrok news\]]() Topics: [zero trust network access](), [service-mesh](), [rate-limiting]() Tags: [api-gateway](), [engineering](), [ngrok](), [owasp](), [waf]() ### AI overview ngrok describes integrating OWASP CRS rules through the Coraza WAF engine into its Traffic Policy system. The post covers design choices for sharing Coraza instances across endpoints, limiting request-body buffering to manage memory and stability, and handling false positives through dry-run operation and configurable rule exclusions. ngrok reports that the WAF actions blocked about 1.2% of requests to ngrok.com during more than six months of operation. ### Source excerpt We integrated Coraza into our Traffic Policy system, ran it against every request to ngrok.com, and blocked 1.2% of traffic. Here's how we designed it and what attack patterns we're seeing. ## Block threats with ngrok's new WAF actions DevFeed: [Block threats with ngrok's new WAF actions]() Original publisher: [Read original article]() Author: Nijiko Yonskai Published: 2025-08-18T00:00:00Z Content type: release Language: en Sources: [\[ngrok news\]]() Topics: [threat detection](), [Cross-origin resource sharing (CORS)]() Tags: [403](), [api](), [blocking](), [company](), [data](), [latency](), [local-file-inclusion](), [ngrok](), [observability](), [owasp](), [policy](), [threats](), [waf]() ### AI overview ngrok introduces two Traffic Policy actions powered by the OWASP Core Rule Set to inspect and block malicious inbound requests and outbound responses at the edge. The actions use anomaly score thresholds, support optional body inspection and rule exclusions, and require no separate WAF service. ### Source excerpt Two new Traffic Policy actions, powered by OWASP CRS, drop malicious requests and responses at the edge, with no extra WAF service required.