> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap/protection/settings/web-application-firewall-policies/waf-policies-changelog.md). # WAF Policies Changelog Rule testing allows you to monitor the real-time behavior of newly added or updated rule(s). For more information on rule testing, see [Rule Testing for New or Updated Rule(s)](/web-application-and-api-protection-waap/protection/settings/web-application-firewall-policies/rule-testing-for-new-or-updated-rule-s.md). The following section highlights the threat types and rules that Traceable has added, updated, or removed, along with their severity:
28th July 2026 This update expands attack coverage and strengthens protection through new detection rules and refined signatures. The following are some enhancements: * Introduces new detection rules targeting PHP Injection, Remote Command Execution, and SQL Injection attacks. * Strengthens protection through updated signatures across Java RCE (Spring4Shell, Log4j), Windows/Unix Command Execution, Server-Side Template Injection (SSTI), PHP Injection, Path Traversal, and SQL/NoSQL Injection detections. * Updates target variables for certain rules to better align with the detection signature and reduce false positives. #### Added threat rules | Threat Rule | Threat Type | Is Aggressive | Severity | | ------------------------------------------------------------ | --------------------- | ------------- | -------- | | PHP Injection Attack: Configuration Directive | PHP Attacks | No | High | | Conditional SQL injection attempts (`T231`) | SQL Injection | Yes | High | | Remote Command Execution: Windows Command Injection (`T110`) | Remote Code Execution | Yes | Medium | | Remote Command Execution: Unix Command Injection (`T200`) | Remote Code Execution | Yes | High | | PHP Injection Attack: High-Risk PHP Function Name | PHP Attacks | No | High | #### Updated threat rules | Threat Rule | Threat Type | Is Aggressive | Severity | | ---------------------------------------------------------------- | ------------------------ | ------------- | -------- | | Java Spring Core: RCE (`CVE-2022-22965`) | Java Application Attacks | No | Critical | | Java Log4j: RCE DoS Exploitation (`CVE-2021-45105`) (`T910`) | Java Application Attacks | No | High | | Remote Command Execution: Unix Command Injection (100) | Remote Code Execution | Yes | Medium | | Remote Command Execution: Unix Command Injection (`T105`) | Remote Code Execution | No | High | | Remote Command Execution: Windows Command Injection (110) | Remote Code Execution | Yes | Medium | | Remote Command Execution: Direct Unix Command Execution (`T155`) | Remote Code Execution | No | High | | Server Side Template Injection (SSTI) Attempt | Remote Code Execution | No | High | | Path Traversal Attack (100) | Local File Inclusion | No | Medium | | Path Traversal Attack (110) | Local File Inclusion | No | Medium | | DB code execution and information gathering attempts | SQL Injection | No | High | | Conditional SQL injection attempts (`T230`) | SQL Injection | Yes | High | | Basic MongoDB SQL injection attempts (Nested JSON) | SQL Injection | No | High | | Concatenated basic SQL injection and SQLLFI attempts (`T360`) | SQL Injection | No | High | | PHP Injection Attack: High-Risk PHP Function Call | PHP Attacks | No | High |
29th April 2026 This update enhances overall detection accuracy, expands attack coverage, and strengthens protection through refined rule logic and improved signature enforcement. The following are some enhancements: * Improves detection precision and expands attack coverage by refining how request data is analyzed and decoded. * Strengthens protection by updating signatures across key attack vectors, including LDAP Injection, SSTI, PHP Injection, XSS, SQL Injection, File Access, and obfuscation techniques. * Enforces stricter SQL Injection rules in *block* mode to improve defense against high-confidence threats. * Improves overall consistency and reliability across detection categories with refined rule logic. #### Updated threat rules | Threat Rule | Threat Type | Is Aggressive | Severity | | ------------------------------------------------------- | -------------------------- | ------------- | -------- | | LDAP Injection Attack | HTTP Protocol Attacks | No | High | | PHP Injection Attack: High-Risk PHP Function Call | PHP Attacks | No | High | | Server Side Template Injection (SSTI) Attempt | Remote Code Execution | No | High | | OS File Access Attempt (120) | Local File Inclusion | Yes | Medium | | Blind SQLI Tests using sleep or benchmark | SQL Injection | No | Medium | | Concatenated SQL Injection and SQLLFI Attempts (`T360`) | SQL Injection | No | High | | XSS InjectionChecker: HTML Injection | Cross-Site Scripting (XSS) | No | High | | NoScript XSS InjectionChecker: HTML Injection | Cross-Site Scripting (XSS) | Yes | Medium | | JSFuck / Hieroglyphy Obfuscation | Cross-Site Scripting (XSS) | No | Low |
2nd February 2026 This update expands attack coverage, improves detection accuracy, and reduces inaccuracies. The following are some enhancements: * Introduces new WAF detection rules to target PHP vulnerabilities and expand coverage for previously unprotected attack vectors. * Enhances coverage by refining existing rules with stricter, more accurate signatures to detect and block attacks. * Improves detection of evasive attacks by enhancing signature logic and accuracy to identify attempts to bypass standard protections. * Refines sensitive rules aggressively, controlling over enabling rules that are more likely to result in false positives. #### Added threat rules | Threat Rule | Threat Type | Is Aggressive | Severity | | -------------------------------------------------------- | --------------------- | ------------- | -------- | | NGINX Configuration Code Execution (`CVE-2025-1974`) | Remote Code Execution | No | High | | PHP CGI Argument Injection ( `CVE-2024-4577`) | PHP Attacks | No | High | | PHP Injection Attack: Variable Function Call Found (210) | PHP Attacks | Yes | High | | PHP Injection Attack: High-Risk PHP Function Call | PHP Attacks | No | High | #### Updated threat rules | Threat Rule | Threat Type | Is Aggressive | Severity | | -------------------------------------------------------------------------- | -------------------------- | ------------- | -------- | | DB code execution and information gathering attempts | SQL Injection | No | High | | HTTP Request Smuggling Attack (Content-Length/Transfer-Encoding Confusion) | HTTP Protocol Attacks | No | High | | Java Spring Core: RCE (`CVE-2022-22965`) | Java Application Attacks | No | Critical | | NoScript XSS InjectionChecker: Attribute Injection (`T170`) | Cross-Site Scripting (XSS) | No | High | | Request the argument associated with security scanner | Scanner Detection | No | Low | | User-Agent associated with a security scanner | Scanner Detection | No | Medium | | XSS InjectionChecker: HTML Injection | Cross-Site Scripting (XSS) | No | High | #### **Added threat types** | Threat Type | Threat Rule | | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | PHP Attacks | |
5th December 2025 This update enhances overall protection capabilities. The following are some enhancements: * Introduces new WAF detection rules for `React` and `Next.js` Server Functions targeting (`CVE-2025-55182`). * Enhances coverage to detect and block malicious deserialization attempts within server function execution paths. #### Added threat rules | Threat Rule | Threat Type | Is Aggressive | Severity | | ------------------------------------------------------------------------- | --------------------- | ------------- | -------- | | React and Next.js Server Functions Deserialization RCE (`CVE-2025-55182`) | Remote Code Execution | No | High | | ReactJS Server Functions Deserialization RCE (`CVE-2025-55182`) | Remote Code Execution | No | High |
13th October 2025 This update enhances overall detection accuracy and protection capabilities. The following are some enhancements: * Protects against evasion-based attacks. * Safeguards your systems from known CVEs and code injection threats. * Reduces false positives with improvements from Traceable’s in-house regex assembler. #### Added threat rules | Threat Rule | Threat Type | Is Aggressive | Severity | | -------------------------------------------------------------- | ------------------------------ | ------------- | --------------- | | Authorization Bypass in Next.js Middleware: (`CVE-2025-29927`) | Basic Authentication Violation | No | High | | Concatenated basic SQL injection and SQLLFI attempts (`T360`) | SQL Injection | No |

High

| | Concatenated basic SQL injection and SQLLFI attempts (360) | SQL Injection | Yes | Medium | | Remote Command Execution: Unix Command Injection (`T105`) | Remote Code Execution | No | High | | Remote Command Execution: Unix Command Injection (`T100`) | Remote Code Execution | No | High | | Authorization Bypass in Next.js Middleware: (`CVE-2025-29927`) | Basic Authentication Violation | No | High | #### **Updated threat rules** | Threat Rule | Threat Type | Is Aggressive | Severity | | ---------------------------------------------------------- | ----------------------------------- | ------------- | -------- | | JSFuck / Hieroglyphy Obfuscation | Cross-Site Scripting (XSS) | No | Low | | Mail Injection: Protocol Manipulation | HTTP Protocol Attacks | No | High | | Remote Command Execution: Windows PowerShell Command | Remote Code Execution | Yes | High | | Path Traversal Attack (/../) | Local File Inclusion | No | Medium | | MySQL and PostgreSQL Stored Procedure/Function Injections | SQL Injection | Yes | Medium | | DB Code Execution and Information Gathering Attempts | SQL Injection | No | High | | Suspicious Java Class | Java Application Attacks | No | High | | SQL Code Execution and Information Gathering Attempts | SQL Injection | Yes | Medium | | Restricted File Access Attempt | Local File Inclusion | Yes | Medium | | Request Header Associated with Security Scanner | Scanner Detection | No | Medium | | Conditional SQL Injection Attempts | SQL Injection | Yes | Medium | | Request Filename/Argument Associated with Security Scanner | Scanner Detection | No | Low | | OS File Access Attempt | Local File Inclusion | Yes | Medium | | XML External Entity Injection: Local/Remote Includes | XML External Entity Injection (XXE) | No | High | | NoScript XSS InjectionChecker: HTML Injection | Cross-Site Scripting (XSS) | Yes | Medium | | LDAP Injection Attack | HTTP Protocol Attacks | No | High | | XSS InjectionChecker: HTML Injection | Cross-Site Scripting (XSS) | No | High | | Remote Command Execution: Unix Shell Code | Remote Code Execution | No | High | | GraphQL Introspection Query Detected | GraphQL Attacks | No | Medium | | Java Spring Core: RCE (CVE-2022-22965) | Java Application Attacks | No | Critical | | Server-Side Template Injection (SSTI) Attempt | Remote Code Execution | No | High | | Remote Command Execution: Windows Command Injection | Remote Code Execution | Yes | Medium | | NoScript XSS InjectionChecker: Attribute Injection | Cross-Site Scripting (XSS) | Yes | Medium | | SQL Injection Attack: Common DB Names | SQL Injection | Yes | Low | #### **Added threat types** | Threat Type | Threat Rule | | ------------------------------ | -------------------------------------------------------------- | | Basic Authentication Violation | Authorization Bypass in Next.js Middleware: (`CVE-2025-29927`) |