This emergency release adds a new managed rule to block active exploitation of a critical remote code execution (RCE) and SQL injection (SQLi) vulnerability found in popular web frameworks.
Key Findings
-
Generic Frameworks – Unauthenticated RCE: Attackers can execute arbitrary system commands with web server privileges by sending malicious input containing invalid path sequences during request processing.
-
Generic Frameworks – SQLi: Attackers can execute unauthorized database queries due to a failure to sanitize input values within request parameters.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | 7dfb2bd4708d4b88b9911dc0550664b6 | N/A | Generic Rules – Unauthenticated RCE | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | 1c060d3a371549219ee290d7ed933fcc | N/A | Generic Rules – SQLi | N/A | Block | This is a new detection. |
| Cloudflare Free Ruleset | ebd3f2df15c74ddcbf6220c9b5ec246a | N/A | Generic Rules – Unauthenticated RCE | N/A | Block | This is a new detection. |
| Cloudflare Free Ruleset | db003b39b7774859a8d588ce33697a1a | N/A | Generic Rules – SQLi | N/A | Block | This is a new detection. |
Source: Cloudflare
Latest Posts
- langcache-embed-v3-small, Mellum2-12B-A2.5B-Thinking, and LightOnOCR-2-1B models now available on Amazon SageMaker JumpStart
- Amazon EC2 High Memory U7i instances now available in AWS South America (São Paulo) region
- GLM-5.2 FP8, NVIDIA-Nemotron-Nano-12B-v2 and GLM-OCR models now available on Amazon SageMaker JumpStart
- FLUX.2-small-decoder and gemma-4-12B-it models now available on Amazon SageMaker JumpStart
