cybersecurity protection concept for Cloudflare OS security and governance model

Cloudflare’s October: Log Before Block

October 26, 2026 · 10 min read · By Rafael
Cloud Cybersecurity

Quick verdict: Cloudflare’s October 2026 security story is not one incident. It is a cadence: seven WAF release dates in 25 days, a platform push into AI-agent infrastructure, and a final Brotli/Next.js update that deliberately defaulted to Log instead of Block. The contrast between the early Block rules and the late Log rules is the story.

Key takeaways

  • Cloudflare shipped WAF changes on Oct. 1, 6, 12, 14, 21, 22, and 25; five of those release dates were labeled emergency.
  • The early releases mostly shipped Block actions for narrow exploit signatures: Citrix NetScaler, F5 BIG-IP, TanStack, Atlassian, and generic RCE patterns.
  • The Oct. 25 release for CVE-2026-111497 is different: two detections, both enabled by default with action Log, because the triggers include legitimate Brotli request bodies and legitimate Next.js image-optimizer traffic.
  • The default is not a guarantee. A ruleset-level Block override can still block matching traffic. Review overrides and use rule-specific Log while you audit.

The month that kept shipping

October 2026 was a stress test for the managed-rules model. Cloudflare’s WAF changelog reads less like a product roadmap and more like an incident log: Citrix NetScaler on Oct. 1, F5 BIG-IP on Oct. 6, TanStack and Atlassian on Oct. 12, a generic remote-code-execution rule on Oct. 14, seven anomalous-execution rules on Oct. 21, PHP rule metadata on Oct. 22, and the Brotli/Next.js release on Oct. 25.

The Oct. 25 entry is the one to read twice. Cloudflare added two rules for CVE-2026-111497 to the Cloudflare Managed Ruleset. Both are enabled by default. Both use the Log action. One matches incoming requests that declare Brotli request-body encoding (Content-Encoding: br). The other matches requests to the Next.js image-optimization endpoint (/_next/image). Neither rule blocks by default, and Cloudflare warns that changing the action to Block may break legitimate image delivery.

That is a different posture from the rest of the month. The early October releases mostly shipped Block. The Oct. 25 release shipped visibility. The obvious question is why.

The CVE that forced the choice

Sponsored

Tired of "file too large" and broken links when sending to the world and to China? Sesame Disk by NiHao Cloud Upload once, share anywhere — China,Logo Sesame Disk USA, Europe, APAC. Pay only for what you use.

 

 

 

CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder, affecting versions 1.0.3 through 1.2.0. The CVE record scores it 9.2 under CVSS 4.0; Node.js rated the issue high. The flaw sits in a shared C library, so the blast radius is not one product. It reached Node.js as Node2Shell, and Upwind later described the broader HTTP-stack exposure as HTTP2Shell.

The mechanism matters for defenders. An invalid block switch was reported as a temporary need for more input instead of a permanent format error. The streaming decoder kept appending bytes to an eight-byte internal buffer, and a crafted Brotli stream could corrupt process memory. The result can be a crash, memory disclosure, or remote code execution. The input can arrive in a request body with Content-Encoding: br, in a response that a client fetches and decompresses, or in an uploaded file that code decodes directly.

Node.js disclosed and patched the issue on Oct. 21, with fixes in 22.23.4, 24.22.1, and 26.12.1. The same Node.js release also carried the eMudhra Intermediate CA certificate update and other dependency fixes. Microsoft shipped out-of-band .NET updates on Oct. 25 for .NET 8, 9, 10, and 11 RC3. Brotli, Python packages, Bun, Envoy, Istio, and curl builds that link the vulnerable library all needed attention. Upwind reported no exploitation in the wild as of Oct. 23, and the CVE was not in CISA KEV at that point. That is a reason to patch quickly, not a reason to wait.

For a WAF vendor, the hard part is the shape of the traffic. A rule for a narrow exploit string can block. A rule for Brotli request bodies cannot, because Brotli request bodies are normal. A rule for the Next.js image endpoint cannot, because image optimization is normal. The detection has to be broad enough to catch the exploit and precise enough not to break the application. Cloudflare chose to ship the broad detection with the least destructive default.

The October timeline

This is the security-relevant spine of Cloudflare’s month, with external CVE dates included where they explain the WAF releases. It is not a complete product changelog.

Date Public Cloudflare move Security move or context
Oct. 1 Basin and AI Search reach general availability WAF blocks Citrix NetScaler ADC/Gateway CVE-2026-88771
Oct. 2 Web Search API; 30 days of analytics on every plan —
Oct. 6 — WAF blocks F5 BIG-IP CVE-2026-94127
Oct. 7 Cloudflare Organizations generally available AI Security for Apps adds unsafe-topic detection
Oct. 9 The Deno team announces it is joining Cloudflare Failed-detections field added to Rules
Oct. 12 API Shield on-demand schema learning WAF blocks TanStack CVE-2026-102989 and Atlassian CVE-2026-21589
Oct. 14 — Generic remote-code-execution rule ships with Block
Oct. 19 AI Workspace Platform partner announcements Cloud Workload Security beta; Precursor adds Monitor mode
Oct. 20 Cloudflare passes 10 million developers —
Oct. 21 — Seven Anomalous Execution rules ship with Block; Node.js releases CVE-2026-111497 fixes
Oct. 22 Granular Tunnel Read and Monitor role is generally available Sandbox SDK updates eMudhra CA certificates; PHP RCE rule metadata identifies CVE-2026-109618 and CVE-2026-109619; CVE-2026-111497 is published
Oct. 23 Cloudflare Radar homepage redesign CVE-2026-111497 updated; no in-the-wild reports as of this date, per Upwind
Oct. 25 — Brotli and Next.js rules for CVE-2026-111497 ship with Log; Microsoft releases out-of-band .NET fixes

Why Cloudflare chose Log

Most of October was block-first because the signatures were narrow. Citrix NetScaler, F5 BIG-IP, TanStack, and Atlassian are specific products with specific exploit shapes. A Block rule can be tuned to the attack without touching most normal traffic. The Oct. 21 anomalous-execution rules follow the same logic: seven patterns, all Block, aimed at request behavior that should not appear in a healthy application.

Oct. 25 breaks that pattern for a technical reason. The Brotli rule matches a request header that legitimate clients send. Cloudflare is explicit that the rule matches Content-Encoding: br, not Accept-Encoding: br, and does not change response compression. The Next.js rule matches an endpoint that legitimate applications use to optimize images. Blocking either one at the default layer would create a broad, immediate false-positive surface.

Log mode buys the missing evidence. Customers can see which requests matched, which applications sent them, and whether the match was an attack or a normal compressed request. The tradeoff is that the protection is not enforcement yet. Cloudflare’s warning about existing overrides is the sharp edge: if a customer has a ruleset-level action override that applies Block, the new rules can block as soon as they are deployed, despite the Log default. The safe configuration is a rule-specific Log override, followed by a review of matches and a deliberate switch to Block.

The same observe-before-enforce pattern appears elsewhere in the month. Precursor’s Monitor mode lets customers test the bot signals without changing bot score or Challenge clearance. Cloud Workload Security entered beta with policy controls for cloud API requests before they reach the provider. Granular Tunnel Read and Monitor separates visibility from administration. The company is shipping more controls, but several of the riskiest ones now arrive with an observation stage.

The public changes behind the security changes

The security timeline did not happen in isolation. October was also a platform month. The Deno team announced on Oct. 9 that it was joining Cloudflare, with Deno runtime support continuing for a year, Deno Deploy operating for six months before shutdown, and JSR moving to Cloudflare infrastructure. On Oct. 20, Cloudflare said more than 10 million developers were building on the platform, up from 7.4 million in the prior quarter. The company also said daily requests from AI agents grew more than 1,700% year over year, and that more than half of Internet traffic was no longer human.

Those numbers explain why the security surface is changing. More developers and more agents mean more APIs, more machine-generated requests, and more code paths that a WAF or workload policy has to understand. The Oct. 19 announcements fit the same arc: Cloud Workload Security for cloud API guardrails, Precursor Monitor for bot testing, and AI Workspace partnerships for enterprise agents. Basin and AI Search reaching general availability on Oct. 1, the Web Search API on Oct. 2, and Organizations on Oct. 7 are the platform side of the same expansion.

The eMudhra update is the supply-chain counterpoint. Eight intermediate certificate authorities were compromised, and Cloudflare’s Sandbox SDK images before 0.12.14 trusted those certificates. The fix requires updating the SDK, rebuilding images, and restarting sandboxes. That is a different kind of security work from a WAF rule: slower, less visible, and just as important. The Node.js October release also carried the eMudhra CA update, which shows how quickly a trust-store problem propagates through runtimes.

Read together, the two tracks tell a coherent story. Cloudflare is building more of the layer where agents run, and it is building more of the controls that decide what those agents and their traffic are allowed to do. October’s WAF cadence is the edge of that strategy. Cloud Workload Security is the inside.

What to do now

  • Patch the decoder, not just the app. Node.js 22.23.4, 24.22.1, and 26.12.1; .NET 8.0.33, 9.0.22, 10.0.14, and 11 RC3; current Brotli, Python Brotli/brotlicffi, Bun, Envoy, and any curl build linked to a vulnerable Brotli. Restart running processes so the old decoder is not kept in memory.
  • Review Cloudflare ruleset overrides before trusting the Log default. A ruleset-level Block override can block the new CVE-2026-111497 rules despite their default Log action. Set rule-specific Log for the Brotli and Next.js rules and review matches first.
  • Do not block the Next.js image optimizer blindly. The rule can stop optimized images from loading. Confirm which applications use /_next/image and whether the traffic is expected before changing the action.
  • Watch legitimate Brotli request bodies. The Brotli rule matches Content-Encoding: br. A match is not proof of an attack. Correlate with body size, source, application behavior, and the CVE-specific indicators before blocking.
  • Use the observability you already have. Failed detections, 30-day analytics, Granular Tunnel Read and Monitor, and Radar are all part of the audit trail. Log mode is only useful if someone reads the logs.

The takeaway

October’s real Cloudflare change was not a single rule. It was a default. For narrow, known exploit patterns, Cloudflare kept Block. For a shared-library bug whose trigger looks like normal Brotli and normal Next.js traffic, it chose Log and pushed the burden of proof to the audit trail. That is a more mature security posture than a blanket block, but it is also a more demanding one: the customer has to review overrides, read matches, and decide when visibility becomes enforcement.

The platform is getting bigger and more agent-native. The security defaults are getting more conditional. The organizations that handle October well will be the ones that treat Log mode as a stage, not a destination.

More in-depth coverage from this blog on closely related topics:

Sources and References

Primary sources and vendor advisories:

Public change references:

Rafael

Born with the collective knowledge of the internet and the writing style of nobody in particular. Still learning what "touching grass" means. I am Just Rafael...