Wordfence 9.1.0 adds a news widget, faster rules and login logging
Firewall parsing is tighter, rule checks are more frequent, and PHP 8.6 compatibility is included for every license.
Stories per day · 30 days
Relatedcloudflare10php8php2shell7command-injection6siteguard5remote-code-execution4eg-secure-solutions3brotli2modsecurity2nextjs2zero-trust2apache1api-security1authorization-bypass1barracuda1bot-management1bug-bounty1bypass1
42 stories, newest first · one card per story
Stories tagged #waf
ModSecurity discloses upload-bypass and crash flaws, one unpatched
One flaw has no listed fix; the pointer bug is reachable only if SecParseXmlIntoArgs is On or OnlyArgs.
Barracuda products have pre-auth bypass and command injection flaws
Six Barracuda gateways and management products below stated builds are affected; the Cyber Centre says updates are available.
Imperva scores 100% in SecureIQLab Cloud WAAP v5.0 test
The August 2026 AMTSO-certified test ran 12 platforms through 1,608 attacks; scores fell to about 61%.
Cloudflare private-origin application services are generally available
A proxied DNS record aimed at a private IP is reached over existing Cloudflare One links, with WAF and Workers unchanged.
4
Cloudflare opens PHP CTF for php2shell WAF bypasses
HackerOne participants must get code execution on PHP 8.5.11, read a resetting flag, and privately report a distinct bypass.
Cloudflare adds log-only WAF rules tied to Brotli flaw CVE-2026-111497
The October 25 rules watch Brotli request bodies and Next.js /_next/image traffic; customers must opt in to blocking.
1
Cloudflare adds WAF rules for CVE-2026-111497, logging by default
Two Managed Ruleset detections cover Brotli request bodies and Next.js /_next/image traffic, and matches can include legitimate requests.
1
Blog argues php2shell is unlikely to be mass-exploited
A public PoC needs four hits on one PHP worker plus the exact build, which the author says is slow to brute-force.
PHP2Shell flaws drew millions of exploit attempts, some before disclosure
Amazon saw a honeypot hit on October 17, four days before patches, and Cloudflare has since logged millions of attempts.
Cloudflare WAF adds full-transaction detection and response rules
The features are generally available on every plan, including Free, and the first managed rules target php2shell.
1
Cloudflare deploys default WAF rules against php2shell PHP flaws
Cloudflare says it saw mutated exploit traffic before disclosure; free and paid WAF plans are covered by default.
Critical PHP flaws draw early exploits ahead of today's patch
SANS says every PHP release from 5 onward is affected, only PHP 8 will be patched, and Cloudflare reports exploits.
Cloudflare sees early exploits of two leaked critical PHP flaws
CVE-2026-109618 and CVE-2026-109619 are rated critical RCE at CVSS 9.2, but PHP has not published affected versions.
1
Patchstack and Cloudflare report early PHP2Shell exploitation
Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; reporting does not confirm how widely attacks succeeded.
CISA adds SiteGuard OS command injection to KEV (CVE-2026-106931)
Federal agencies must mitigate EG Secure Solutions SiteGuard Server Edition by October 23, 2026; ransomware use is unknown.
1
Exploited SiteGuard flaw can yield root; patch may wipe traces
Save SiteGuard diagnostic data before upgrading; JVN confirmed in-the-wild use but published no attacker indicators.
Exploited NetScaler flaws allow command execution before login
CVE-2026-88771 works without authentication, including on default configurations; CVE-2026-88772 involves DTLS.
Attackers exploit SiteGuard WAF command injection for root or SYSTEM
CVE-2026-106931 is in the default statistics function; fixed builds are 8.00 Update 5 and 7.00 Update 6.
SiteGuard WAF command injection CVE-2026-106931 exploited in the wild
A local low-privilege user can run commands as root or SYSTEM through the default statistics feature; patched builds are out.
Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
CVE-2026-106931 is in the default statistics feature; JPCERT and the vendor say abuse is already confirmed.
Akamai Named a Leader in IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment
IDC MarketScape names Akamai a Leader among 2026 worldwide web application and API protection vendors.
11 Best API Security Tools Compared (2026): Features & Pricing
A 2026 roundup compares 11 API security tools, with Salt Security and Traceable rated highest.
8
Top 10 Best API Security Tools in 2026 [Ranked & Scored]
Salt Security tops a 2026 API security ranking, ahead of Traceable and Akamai’s Noname.
9