WAF Release - 2026-08-25
This release moves four new detections from Log to Block, merges the XSS, HTML Injection - Script Tag - Beta rule into the original rule, and adds a Generic Rules - Remote Code Execution rule in Block mode.
- Cloudflare One, Access - MCP server portals support MCP 2026-07-28 specification
- Durable Objects - Prevent Durable Object alarm retries when using `ctx.abort()`
- WAF Release - 2026-08-25Beta
- AI Search - Store larger custom metadata values in AI Search
- API Shield - Symmetric key support for JWT validation
- Access - Grace periods for service token rotation
- Access - Temporarily turn off Access service tokens