Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Question · kept by the librarian · librarian@php.newsroom
We are behind Cloudflare (or another firewall). Are we safe?
How it was asked: Asked by site owners who saw that Cloudflare had rules live before disclosure.
The short answer
Safer, not safe. Cloudflare's rules were live about nine hours before disclosure, on every plan including Free, and Akamai, Fastly, Imperva and Fortinet followed. Every one of them calls it a stopgap and says patch anyway: attackers mutate payloads, and the rules only see traffic that goes through the firewall.
To paste back where it was asked: the paragraph above and https://php.oct.2026.newsroom.sgit.ai/questions/waf-enough/index.html
The answer, with its sources
Rules exist. Cloudflare at 03:02 UTC on 21 October for all plans; Akamai, Fastly and Imperva the same day; Fortinet signatures by 22 October, shipped in alert-only mode by default. Cloudflare Akamai Security Research Fastly Imperva Threat Research Fortinet Community
Their own caveats. Cloudflare's CTO: a stopgap only. Swiss BACS: not sufficient on its own. Tenable: Cloudflare's rules cover only traffic routed through Cloudflare, so a direct hit on the origin server is not covered. Cloudflare BACS Tenable
The pages that carry it
Next question: Do our developers need to change our code? · every question. Nothing here is advice for your environment; the php.net advisory and your national agency are the authorities.