Skip to content

Commit 900f56a

Browse files
ranbelranbel
authored
Merge branch 'production' into ranbel/load-balancing-with-zt
2 parents 981941f + d3be8da commit 900f56a

File tree

148 files changed

+7223
-6452
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

148 files changed

+7223
-6452
lines changed

‎public/__redirects‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -653,8 +653,8 @@
653653
/fundamentals/reference/the-internet/ /fundamentals/concepts/the-internet/ 301
654654
/fundamentals/reference/http-request-headers/ /fundamentals/reference/http-headers/ 301
655655
/fundamentals/security/browser-integrity-check/ /waf/tools/browser-integrity-check/ 301
656-
/fundamentals/signed-exchanges/ /speed/optimization/other/signed-exchanges/ 301
657-
/fundamentals/signed-exchanges/amp-real-ulr/reference/ /speed/optimization/other/amp-real-url/reference/ 301
656+
/fundamentals/signed-exchanges/ /speed/optimization/ 301
657+
/fundamentals/signed-exchanges/amp-real-ulr/reference/ /speed/optimization/ 301
658658
/fundamentals/speed/aim/ /speed/aim/ 301
659659
/fundamentals/speed/optimization/ /speed/optimization/ 301
660660
/fundamentals/speed/prefetch-urls/ /speed/optimization/content/prefetch-urls/ 301
@@ -1343,19 +1343,19 @@
13431343
/fundamentals/network/0-rtt-connection-resumption/ /speed/optimization/protocol/0-rtt-connection-resumption/ 301
13441344
/support/speed/essentials/will-cloudflares-image-optimization-features-help-if-im-already-optimizing-images/ /speed/optimization/images/troubleshooting/multiple-optimizations/ 301
13451345
/support/speed/optimization-delivery/configuring-cloudflare-mirage/ /speed/optimization/images/mirage/ 301
1346-
/support/speed/optimization-mobile/understanding-cloudflare-mobile-redirect/ /speed/optimization/other/mobile-redirect/ 301
1346+
/support/speed/optimization-mobile/understanding-cloudflare-mobile-redirect/ /rules/url-forwarding/examples/perform-mobile-redirects/ 301
13471347
/support/speed/optimization-file-size/using-cloudflare-auto-minify/ /speed/optimization/content/ 301
13481348
/support/speed/optimization-file-size/what-will-cloudflare-compress/ /speed/optimization/content/compression/ 301
13491349
/speed/optimization/content/brotli/ /speed/optimization/content/compression/ 301
13501350
/speed/optimization/content/brotli/enable/ /speed/optimization/content/compression/ 301
13511351
/speed/optimization/content/brotli/content-compression/ /speed/optimization/content/compression/ 301
13521352
/support/speed/optimization-file-size/why-isnt-auto-minify-working/ /speed/optimization/content/troubleshooting/ 301
1353-
/support/speed/optimization-mobile/why-is-the-mobile-redirect-i-set-up-through-cloudflare-redirecting-my-static-assets/ /speed/optimization/other/troubleshooting/mobile-redirect-affect-static-assets/ 301
1354-
/speed/optimization/other/amp-real-ulr/ /speed/optimization/other/amp-real-url/ 301
1355-
/speed/optimization/other/amp-real-ulr/reference/ /speed/optimization/other/amp-real-url/reference/ 301
1353+
/support/speed/optimization-mobile/why-is-the-mobile-redirect-i-set-up-through-cloudflare-redirecting-my-static-assets/ /rules/url-forwarding/examples/perform-mobile-redirects/ 301
1354+
/speed/optimization/other/amp-real-ulr/ /speed/optimization/ 301
1355+
/speed/optimization/other/amp-real-ulr/reference/ /speed/optimization/ 301
13561356
/speed/optimization/other/mobile-redirect/ /rules/url-forwarding/examples/perform-mobile-redirects/ 301
1357-
/speed/optimization/other/troubleshooting/mobile-redirect-affect-static-assets/ /speed/optimization/other/ 301
1358-
/speed/optimization/other/troubleshooting/ /speed/optimization/other/ 301
1357+
/speed/optimization/other/troubleshooting/mobile-redirect-affect-static-assets/ /speed/optimization/ 301
1358+
/speed/optimization/other/troubleshooting/ /speed/optimization/ 301
13591359
/speed/optimization/content/auto-minify/ /speed/optimization/content/ 301
13601360
/speed/optimization/content/troubleshooting/auto-minify-not-working/ /speed/optimization/content/troubleshooting/ 301
13611361
/speed/optimization/content/speculation/ /speed/optimization/content/speed-brain/ 301
@@ -2327,9 +2327,9 @@
23272327
/fundamentals/get-started/setup/troubleshooting/* /fundamentals/setup/account-setup/add-site/ 301
23282328
/fundamentals/get-started/basic-tasks/account-security/* /fundamentals/account-and-billing/account-security/:splat 301
23292329
/fundamentals/get-started/setup/account-setup/* /fundamentals/account-and-billing/account-setup/:splat 301
2330-
/fundamentals/speed/amp-real-ulr/* /speed/optimization/other/amp-real-ulr/:splat 301
2330+
/fundamentals/speed/amp-real-ulr/* /speed/optimization/:splat 301
23312331
/fundamentals/speed/rocket-loader/* /speed/optimization/content/rocket-loader/:splat 301
2332-
/fundamentals/speed/signed-exchanges/* /speed/optimization/other/signed-exchanges/:splat 301
2332+
/fundamentals/speed/signed-exchanges/* /speed/optimization/:splat 301
23332333
/fundamentals/speed/speed-test/* /speed/observatory/:splat 301
23342334
/speed/speed-test/* /speed/observatory/:splat 301
23352335
/http-applications/* /version-management/:splat 301
@@ -2349,6 +2349,7 @@
23492349
/fundamentals/setup/manage-members/* /fundamentals/manage-members/:splat 301
23502350
/logs/get-started/enable-destinations/* /logs/logpush/logpush-job/enable-destinations/:splat 301
23512351
/logs/reference/log-fields/* /logs/logpush/logpush-job/datasets/:splat 301
2352+
/speed/optimization/other/* /speed/optimization/ 301
23522353

23532354
# AI Crawl Control
23542355
/ai-audit/* /ai-crawl-control/:splat 301

‎src/assets/images/changelog/security-center/2025-10-17-application-security-report-mock-data.png‎

752 KB
Loading

‎src/assets/images/changelog/security-center/2025-10-17-report-feedback-survey.png‎

63 KB
Loading

‎src/content/changelog/load-balancing/2025-08-15-monitor-groups-for-load-balancing.mdx‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
title: Monitor Groups for Advanced Health Checking With Load Balancing
3+
description: Group multiple health monitors to create sophisticated, multi-service health assessments for your pools.
4+
date: 2025-10-16
5+
---
6+
7+
Cloudflare Load Balancing now supports Monitor Groups, a powerful new way to combine multiple health monitors into a single, logical group. This allows you to create sophisticated health checks that more accurately reflect the true availability of your applications by assessing multiple services at once.
8+
9+
With Monitor Groups, you can ensure that all critical components of an application are healthy before sending traffic to an origin pool, enabling smarter failover decisions and greater resilience. This feature is now available via the API for customers with an Enterprise Load Balancing subscription.
10+
11+
### What you can do:
12+
13+
- **Combine Multiple Monitors**: Group different health monitors (for example, HTTP, TCP) that check various application components, like a primary API gateway and a specific `/login` service.
14+
- **Isolate Monitors for Observation**: Mark a monitor as "monitoring only" to receive alerts and data without it affecting a pool's health status or traffic steering. This is perfect for testing new checks or observing non-critical dependencies.
15+
- **Improve Steering Intelligence**: Latency for Dynamic Steering is automatically averaged across all active monitors in a group, providing a more holistic view of an origin's performance.
16+
17+
This enhancement is ideal for complex, multi-service applications where the health of one component depends on another. By aggregating health signals, Monitor Groups provide a more accurate and comprehensive assessment of your application's true status.
18+
19+
For detailed information and API configuration guides, please visit our [developer documentation](/load-balancing/monitors/monitor-groups) for Monitor Groups.

‎src/content/changelog/security-center/2025-10-17-app-sec-reports.mdx‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
title: New Application Security reports (Closed Beta)
3+
description: A monthly recap of your cyber security insights and trends your Cloudflare account.
4+
date: 2025-10-17
5+
---
6+
7+
import { DashButton } from "~/components";
8+
9+
Cloudflare's new **Application Security report**, currently in Closed Beta, is now available in the dashboard.
10+
11+
<DashButton url="/?to=/:account/security-center/reports" />
12+
13+
The reports are generated monthly and provide cyber security insights trends for all of the Enterprise zones in your Cloudflare account.
14+
15+
The reports also include an industry benchmark, comparing your cyber security landscape to peers in your industry.
16+
17+
![Application Security report mock data](~/assets/images/changelog/security-center/2025-10-17-application-security-report-mock-data.png)
18+
19+
Learn more about the reports by referring to the [Security Reports documentation](/security-center/app-security-reports/).
20+
21+
Use the feedback survey link at the top of the page to help us improve the reports.
22+
23+
![Application Security report survey](~/assets/images/changelog/security-center/2025-10-17-report-feedback-survey.png)

‎src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx‎

Lines changed: 229 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,229 @@
1+
---
2+
title: New detections released for WAF managed rulesets
3+
description: New Cloudflare WAF managed rulesets release to improve protection against attacker-controlled payloads
4+
date: 2025-10-17
5+
---
6+
7+
import { RuleID } from "~/components";
8+
9+
This week we introduced several new detections across Cloudflare Managed Rulesets, expanding coverage for high-impact vulnerability classes such as SSRF, SQLi, SSTI, Reverse Shell attempts, and Prototype Pollution. These rules aim to improve protection against attacker-controlled payloads that exploit misconfigurations or unvalidated input in web applications.
10+
11+
**Key Findings**
12+
13+
New detections added for multiple exploit categories:
14+
15+
SSRF (Server-Side Request Forgery) — new rules targeting both local and cloud metadata abuse patterns (Beta).
16+
17+
SQL Injection (SQLi) — rules for common patterns, sleep/time-based injections, and string/wait function exploitation across headers and URIs.
18+
19+
SSTI (Server-Side Template Injection) — arithmetic-based probe detections introduced across URI, header, and body fields.
20+
21+
Reverse Shell and XXE payloads — enhanced heuristics for command execution and XML external entity misuse.
22+
23+
Prototype Pollution — new Beta rule identifying common JSON payload structures used in object prototype poisoning.
24+
25+
PHP Wrapper Injection and HTTP Parameter Pollution detections — to catch path traversal and multi-parameter manipulation attempts.
26+
27+
Anomaly Header Checks — detecting CRLF injection attempts in header names.
28+
29+
**Impact**
30+
31+
These updates help detect multi-vector payloads that blend SSRF + RCE or SQLi + SSTI attacks, especially in cloud-hosted applications with exposed metadata endpoints or unsafe template rendering.
32+
33+
Prototype Pollution and HTTP parameter pollution rules address emerging JavaScript supply-chain exploitation patterns increasingly seen in real-world incidents.
34+
35+
<table style="width: 100%">
36+
<thead>
37+
<tr>
38+
<th>Ruleset</th>
39+
<th>Rule ID</th>
40+
<th>Legacy Rule ID</th>
41+
<th>Description</th>
42+
<th>Previous Action</th>
43+
<th>New Action</th>
44+
<th>Comments</th>
45+
</tr>
46+
</thead>
47+
<tbody>
48+
<tr>
49+
<td>Cloudflare Managed Ruleset</td>
50+
<td><RuleID id="72f0ff933fb0492eb71cda50589f2a1d" /></td>
51+
<td>N/A</td>
52+
<td>Anomaly:Header - name - CR, LF</td>
53+
<td>N/A</td>
54+
<td>Disabled</td>
55+
<td>This is a New Detection</td>
56+
</tr>
57+
<tr>
58+
<td>Cloudflare Managed Ruleset</td>
59+
<td><RuleID id="5d0377e4435f467488614170132fab7e" /></td>
60+
<td>N/A</td>
61+
<td>Generic Rules - Reverse Shell - Body</td>
62+
<td>N/A</td>
63+
<td>Disabled</td>
64+
<td>This is a New Detection</td>
65+
</tr>
66+
<tr>
67+
<td>Cloudflare Managed Ruleset</td>
68+
<td><RuleID id="54e32f7f802c4a699182e8921a027008" /></td>
69+
<td>N/A</td>
70+
<td>Generic Rules - Reverse Shell - Header</td>
71+
<td>N/A</td>
72+
<td>Disabled</td>
73+
<td>This is a New Detection</td>
74+
</tr>
75+
<tr>
76+
<td>Cloudflare Managed Ruleset</td>
77+
<td><RuleID id="7cbda8dbafbc465d9b64a8f2958d0486" /></td>
78+
<td>N/A</td>
79+
<td>Generic Rules - Reverse Shell - URI</td>
80+
<td>N/A</td>
81+
<td>Disabled</td>
82+
<td>This is a New Detection</td>
83+
</tr>
84+
<tr>
85+
<td>Cloudflare Managed Ruleset</td>
86+
<td><RuleID id="b9f3420674cf481da32333dc8e0cf7ad" /></td>
87+
<td>N/A</td>
88+
<td>Generic Rules - XXE - Body</td>
89+
<td>N/A</td>
90+
<td>Disabled</td>
91+
<td>This is a New Detection</td>
92+
</tr>
93+
<tr>
94+
<td>Cloudflare Managed Ruleset</td>
95+
<td><RuleID id="ad55483512f0440b81426acdbf8aab5e" /></td>
96+
<td>N/A</td>
97+
<td>Generic Rules - SQLi - Common Patterns - Header URI</td>
98+
<td>N/A</td>
99+
<td>Disabled</td>
100+
<td>This is a New Detection</td>
101+
</tr>
102+
<tr>
103+
<td>Cloudflare Managed Ruleset</td>
104+
<td><RuleID id="849c0618d1674f1c92ba6f9b2e466337" /></td>
105+
<td>N/A</td>
106+
<td>Generic Rules - SQLi - Sleep Function - Header URI</td>
107+
<td>N/A</td>
108+
<td>Disabled</td>
109+
<td>This is a New Detection</td>
110+
</tr>
111+
<tr>
112+
<td>Cloudflare Managed Ruleset</td>
113+
<td><RuleID id="1b4db4c4bd0649c095c27c6cb686ab47" /></td>
114+
<td>N/A</td>
115+
<td>Generic Rules - SQLi - String Function - Header URI</td>
116+
<td>N/A</td>
117+
<td>Disabled</td>
118+
<td>This is a New Detection</td>
119+
</tr>
120+
<tr>
121+
<td>Cloudflare Managed Ruleset</td>
122+
<td><RuleID id="fa2055b84af94ba4b925f834b0633709" /></td>
123+
<td>N/A</td>
124+
<td>Generic Rules - SQLi - WaitFor Function - Header URI</td>
125+
<td>N/A</td>
126+
<td>Disabled</td>
127+
<td>This is a New Detection</td>
128+
</tr>
129+
<tr>
130+
<td>Cloudflare Managed Ruleset</td>
131+
<td><RuleID id="158177dec2504acdba1f2da201a076eb" /></td>
132+
<td>N/A</td>
133+
<td>SSRF - Local - Beta</td>
134+
<td>N/A</td>
135+
<td>Disabled</td>
136+
<td>This is a New Detection</td>
137+
</tr>
138+
<tr>
139+
<td>Cloudflare Managed Ruleset</td>
140+
<td><RuleID id="98bfd6bb46074d5b8d1c4b39743a63ec" /></td>
141+
<td>N/A</td>
142+
<td>SSRF - Local - 2 - Beta</td>
143+
<td>N/A</td>
144+
<td>Disabled</td>
145+
<td>This is a New Detection</td>
146+
</tr>
147+
<tr>
148+
<td>Cloudflare Managed Ruleset</td>
149+
<td><RuleID id="54e1733b10da4a599e06c6fbc2e84e2d" /></td>
150+
<td>N/A</td>
151+
<td>SSRF - Cloud - Beta</td>
152+
<td>N/A</td>
153+
<td>Disabled</td>
154+
<td>This is a New Detection</td>
155+
</tr>
156+
<tr>
157+
<td>Cloudflare Managed Ruleset</td>
158+
<td><RuleID id="ecd26d61a75e46f6a4449a06ab8af26f" /></td>
159+
<td>N/A</td>
160+
<td>SSRF - Cloud - 2 - Beta</td>
161+
<td>N/A</td>
162+
<td>Disabled</td>
163+
<td>This is a New Detection</td>
164+
</tr>
165+
<tr>
166+
<td>Cloudflare Managed Ruleset</td>
167+
<td><RuleID id="c16f4e133c4541f293142d02e6e8dc5b" /></td>
168+
<td>N/A</td>
169+
<td>SSTI - Arithmetic Probe - URI</td>
170+
<td>N/A</td>
171+
<td>Disabled</td>
172+
<td>This is a New Detection</td>
173+
</tr>
174+
<tr>
175+
<td>Cloudflare Managed Ruleset</td>
176+
<td><RuleID id="f4fd9904e7624666b8c49cd62550d794" /></td>
177+
<td>N/A</td>
178+
<td>SSTI - Arithmetic Probe - Header</td>
179+
<td>N/A</td>
180+
<td>Disabled</td>
181+
<td>This is a New Detection</td>
182+
</tr>
183+
<tr>
184+
<td>Cloudflare Managed Ruleset</td>
185+
<td><RuleID id="5c0875604f774c36a4f9b69c659d12a6" /></td>
186+
<td>N/A</td>
187+
<td>SSTI - Arithmetic Probe - Body</td>
188+
<td>N/A</td>
189+
<td>Disabled</td>
190+
<td>This is a New Detection</td>
191+
</tr>
192+
<tr>
193+
<td>Cloudflare Managed Ruleset</td>
194+
<td><RuleID id="fae6fa37ae9249d58628e54b1a3e521e" /></td>
195+
<td>N/A</td>
196+
<td>PHP Wrapper Injection</td>
197+
<td>N/A</td>
198+
<td>Disabled</td>
199+
<td>This is a New Detection</td>
200+
</tr>
201+
<tr>
202+
<td>Cloudflare Managed Ruleset</td>
203+
<td><RuleID id="9c02e585db34440da620eb668f76bd74" /></td>
204+
<td>N/A</td>
205+
<td>PHP Wrapper Injection</td>
206+
<td>N/A</td>
207+
<td>Disabled</td>
208+
<td>This is a New Detection</td>
209+
</tr>
210+
<tr>
211+
<td>Cloudflare Managed Ruleset</td>
212+
<td><RuleID id="cb67fe56a84747b8b64277dc091e296d" /></td>
213+
<td>N/A</td>
214+
<td>HTTP parameter pollution</td>
215+
<td>N/A</td>
216+
<td>Disabled</td>
217+
<td>This is a New Detection</td>
218+
</tr>
219+
<tr>
220+
<td>Cloudflare Managed Ruleset</td>
221+
<td><RuleID id="443b54d984944cd69043805ee34214ef" /></td>
222+
<td>N/A</td>
223+
<td>Prototype Pollution - Common Payloads - Beta</td>
224+
<td>N/A</td>
225+
<td>Disabled</td>
226+
<td>This is a New Detection</td>
227+
</tr>
228+
</tbody>
229+
</table>

‎src/content/docs/cloudflare-one/applications/non-http/self-hosted-private-app.mdx‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ This feature replaces the legacy [private network app type](/cloudflare-one/appl
1818

1919
- Private IPs and hostnames are reachable over Cloudflare WARP, Magic WAN or Browser Isolation. For more details, refer to [Connect a private network](/cloudflare-one/connections/connect-networks/private-net/).
2020
- Private hostnames route to your custom DNS resolver through [Local Domain Fallback](/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/local-domains/) or [Gateway resolver policies](/cloudflare-one/policies/gateway/resolver-policies/).
21+
- Public IPs and hostnames can be used to define a private application, however the IP or hostname must route through Cloudflare via [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/private-net/cloudflared/), [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/), or [Magic WAN](/magic-wan/configuration/manually/how-to/configure-routes/).
2122
- (Optional) Turn on [Gateway TLS decryption](/cloudflare-one/policies/gateway/http-policies/tls-decryption/) if you want to use Access JWTs to manage [HTTPS application sessions](#https-applications).
2223

2324
## Add your application to Access
@@ -83,4 +84,4 @@ The WARP client manages sessions for all non-HTTPS applications. Users will rece
8384

8485
### Private hostname vs private IP
8586

86-
An Access application defined by a private hostname takes precedence over an Access application defined by a private IP. For example, assume App-1 points to `wiki.internal.local` and App-2 points to `10.0.0.1`, but `wiki.internal.local` resolves to `10.0.0.1`. Users who go to `wiki.internal.local` will never match App-2; they will be allowed or blocked strictly based on App-1 Access policies (and [Gateway policies](#access-vs-gateway-policies)).
87+
An Access application defined by a private hostname takes precedence over an Access application defined by a private IP. For example, assume App-1 points to `wiki.internal.local` and App-2 points to `10.0.0.1`, but `wiki.internal.local` resolves to `10.0.0.1`. Users who go to `wiki.internal.local` will never match App-2; they will be allowed or blocked strictly based on App-1 Access policies (and [Gateway policies](#access-vs-gateway-policies)).

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/configure-warp/route-traffic/index.mdx‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,19 +38,23 @@ flowchart TD
3838
ST -- Resolver IP included in WARP Tunnel per Split Tunnel configuration --> QW["Query sent via WARP Tunnel to be resolved"]
3939
ST -- Resolver IP not included in WARP Tunnel per Split Tunnel configuration --> QO["Query sent to resolver IP outside WARP Tunnel"]
4040
41+
%% Gateway evaluation after query via WARP
4142
QW -- Allowed by Gateway --> OR["Evaluated by Cloudflare on-ramp routes"]
43+
QW -- Blocked by Gateway Network or HTTP Policy --> BLK["Traffic blocked by Cloudflare"]
44+
4245
OR -- Onramp routes do not include resolver IP --> GP["Gateway proxies query to resolver IP via normal WARP egress route"]
43-
OR -- Onramp routes include, resolver IP --> ADV["Cloudflare onramps advertises route that includes Resolver IP"]
46+
OR -- Onramp routes include resolver IP --> ADV["Cloudflare onramps advertise route that includes Resolver IP"]
4447
ADV --> PR["Private resolver returns IP address to WARP client"]
4548
4649
%% Right branch (no LDF match)
4750
C -- Domain does not exist in Local Domain Fallback policies --> GWR["Gateway checks Resolver Policies (Enterprise only)"]
4851
4952
GWR -- Resolver policy is not matched --> C1111a["1.1.1.1"]
5053
51-
GWR -- Resolver policy is matched --> IDNS["Internal DNS"]
52-
GWR -- Resolver policy is matched --> C1111b["1.1.1.1"]
53-
GWR -- Resolver policy is matched --> CUST["Custom resolver"]
54+
GWR -- Resolver policy is matched --> MATCH((Resolver policy directs query to one of the following))
55+
MATCH --> IDNS["Internal DNS"]
56+
MATCH --> C1111b["1.1.1.1"]
57+
MATCH --> CUST["Custom resolver"]
5458
CUST --> PNS["Private network services<br>(Cloudflare Tunnel, Magic WAN, WARP Connector)"]
5559
```
5660
#### Terms mentioned

0 commit comments

Comments
 (0)