Cloudflare has implemented new WAF rules to protect against a Remote Code Execution vulnerability affecting specific React versions and Next.js. All customers are automatically shielded as long as their traffic is routed through Cloudflare, but updating to React 19.2.1 and the latest Next.js versions is still recommended. Cloudflare's security team will monitor for potential attacks and adjust protections as needed.

Cloudflare addressed a flaw in its WAF that let attackers bypass security measures and access origin servers during ACME validation. The issue arose from a logic error that disabled WAF features for certain requests, potentially allowing unauthorized access. The company implemented a fix to ensure that WAF features remain active unless the request matches a valid ACME token.