Key points
- Full transaction detection is now generally available to all Cloudflare customers, including those on Free plans.
- The feature correlates HTTP requests with server responses to identify evidence of exploitation and sensitive data exposure.
- Initial managed protections using this capability address the recently disclosed php2shell vulnerability in common software components.
Cloudflare has expanded its web application firewall capabilities to include full transaction detection, allowing the platform to evaluate HTTP requests alongside their corresponding server responses. This update aims to help security teams identify successful exploits, data exposure, and risky misconfigurations that traditional request-only inspection methods often miss.
The new feature generally answers whether a request looks malicious and what happened when the application handled it. By correlating the incoming traffic with the origin’s response, Cloudflare can provide clearer evidence of exploitation. This helps defenders distinguish between blocked attempts and successful breaches that might otherwise go unnoticed in standard logs.
Context for the update
Traditional web application firewalls primarily inspect incoming requests to stop recognizable attacks before they reach the application origin. While effective for known threats, this approach can struggle with ambiguous traffic or complex exploits that do not trigger immediate block rules.
Cloudflare notes that treating every suspicious request as a confirmed exploit creates difficult trade-offs for defenders. Broad request signatures may catch more potential attacks but can also generate false positives that disrupt legitimate application traffic. Conversely, deploying only strict rules reduces false alarms but may leave gaps for ambiguous traffic to reach the server.
Who is affected
All Cloudflare customers are now eligible for these new capabilities, including users on Free plans. This broad availability extends the company’s always-on application security framework to a wider audience.
Teams can use Cloudflare-managed protections or build their own policies combining request and response properties. Detection results are available in Security Analytics to support investigation. The first managed protections using this capability specifically address the recently disclosed php2shell vulnerability.
Our take on the response
The shift towards full transaction detection reflects a broader industry trend toward more nuanced threat analysis. By examining the outcome of an HTTP transaction rather than just the input, defenders gain stronger evidence of sensitive data exposure.
This approach is particularly relevant as AI agents become more persistent in scanning for vulnerabilities. These agents can adapt payloads using feedback and chain vulnerabilities, credentials, and permissions. An application’s response can reveal whether an attempt worked, giving attackers information to go deeper.
What affected people can do
Security teams should review their current web application firewall rules to determine if they can benefit from response-based detection. Check whether sensitive data is being exposed in server responses to suspicious requests. Monitor Security Analytics for new detection results that correlate requests with responses. Be wary of follow-up scams that may reference this update or the php2shell vulnerability, as attackers often exploit news of new security features or vulnerabilities to trick users into installing malware or revealing credentials. Verify all communications through official channels.
What to do and how to stay safe: Cloudflare
- Review your web application firewall logs to identify any suspicious requests that may have resulted in sensitive data exposure.
- Check if your applications are vulnerable to the php2shell flaw and apply any available patches from software vendors.
- Ensure your Cloudflare WAF policies are updated to leverage full transaction detection capabilities for enhanced security.
- Monitor Security Analytics for new detection results and investigate any anomalies that correlate requests with unexpected responses.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is full transaction detection available for Cloudflare Free plan users?
Yes, Cloudflare is making these new capabilities generally available to all customers, including those on Free plans.
What vulnerability do the initial managed protections address?
The first managed protections using full transaction detection address the recently disclosed php2shell vulnerability.
How does full transaction detection differ from traditional WAF inspection?
Traditional WAFs inspect incoming requests, while full transaction detection evaluates both the HTTP request and the server’s response to identify evidence of exploitation.