WAF - WAF Release - 2026-08-25
BetaUnverifiedAdded Sep 24, 2026
This release moves four new detections from Log to Block, merges the XSS, HTML Injection - Script Tag - Beta rule into the original rule, and adds a Generic Rules - Remote Code Execution rule in Block mode.
Topics: Governance, Observability
More Cloudflare developer platform releases
Every Cloudflare developer platform release| Date | Release | Type |
|---|---|---|
| Aug 25 | Access - Grace periods for service token rotationunverified Update | Update |
| Aug 25 | Access - Temporarily turn off Access service tokensunverified Update | Update |
| Aug 25 | AI Search - Store larger custom metadata values in AI Searchunverified Update | Update |
| Aug 25 | API Shield - Symmetric key support for JWT validationunverified Update | Update |
| Aug 25 | Cloudflare One, Access - MCP server portals support MCP 2026-07-28 specificationunverified Update | Update |
| Aug 25 | Durable Objects - Prevent Durable Object alarm retries when using `ctx.abort()`unverified Update | Update |
| Aug 26 | Access - Access service token secrets use a scannable formatunverified Update | Update |
| Aug 26 | AI Search - New Workers AI text generation models in AI Searchunverified Update | Update |
Also shipped on Aug 25, 2026
Cloudflare in August 2026
Sources: each vendor's own release notes, changelogs and GitHub releases, read daily to monthly by how often it posts. Logos via logo.dev; trademarks belong to their owners.