WAF - WAF Release - Scheduled changes for 2026-09-29
BetaUnverifiedAdded Sep 24, 2026
Announcement Date Release Date Release Behavior Legacy Rule ID Rule ID Description Comments 2026-09-22 2026-09-29 Log N/A ...cb14ded8 Broken Access Control - Directory Traversal This is a new detection.
Topics: Security, Observability
More Cloudflare developer platform releases
Every Cloudflare developer platform release| Date | Release | Type |
|---|---|---|
| Sep 22 | Access - Automatically manage inactive Access service tokensunverified Update | Update |
| Sep 22 | Cloudflare One, Access - Private MCP server support for MCP server portalsunverified Update | Update |
| Sep 22 | Rules - concat() now supports up to 32 argumentsunverified Update | Update |
| Sep 22 | WAF - WAF Release - 2026-09-22unverified Update | Update |
| Sep 22 | Workers - Workers Builds now supports Cursor Originunverified Preview | Preview |
| Sep 22 | Workers - Test every pull request in an isolated environment with Worker Previewsunverified Preview | Preview |
| Sep 23 | Durable Objects - Durable Object name search now supports 128 charactersunverified Update | Update |
| Sep 23 | Gateway, Cloudflare One - Traffic Destination selector in Gateway policiesunverified Update | Update |
Also shipped on Sep 22, 2026
Cloudflare in September 2026
Sources: each vendor's own release notes, changelogs and GitHub releases, read daily to monthly by how often it posts. Logos via logo.dev; trademarks belong to their owners.