Is the WAF Obsolete?

No. But the version of the WAF most organizations are running — a signature-matching appliance at the perimeter — is being bypassed in real time by actors who no longer need to be creative. They need to be persistent, and they need an API key.

This post looks at what “obsolete” actually means in 2026, using four specific incidents from the last five months and one academic paper that quantifies the problem.

A one-character bypass

In September 2026, Google’s Threat Intelligence Group and Mandiant reported that ShinyHunters (tracked as UNC6240) had resumed mass exploitation of CVE-2026-35273, a CVSS 9.8 remote code execution vulnerability in Oracle PeopleSoft.

The bypass was a single character. The WAF rule blocked requests to /PSEMHUB/hub. The attacker sent /%50SEMHUB/hub instead. %50 is the URL-encoded form of the letter P. The WAF matched the raw path, found no match, and let the request through. The WebLogic server behind the WAF decoded the path and routed the request to the vulnerable servlet as normal.

This is not a sophisticated attack. It is a string-matching failure. But it illustrates the core problem: a WAF rule is a pattern, and the attacker only needs to find one representation of the same request that doesn’t match the pattern. When the attacker has an LLM that can enumerate encoding variants at machine speed, the search space is no longer bounded by human creativity.

The vendor tested itself

In September 2026, Cloudflare published the results of an internal experiment: they used frontier LLMs as attackers against their own WAF.

The setup: a Python harness that managed HTTP requests, maintained scenario state, and collected responses. One model call proposed the next mutation; another reviewed the resulting response. The models had no access to Cloudflare’s WAF rules, source code, or internal security signals. They could only see selected HTTP response data.

The results across 45 scenarios and six attack categories (XSS, SQLi, command injection, SSRF, LFI, Log4j):

Metric	Value
Recorded mutation attempts	1,107
Blocked by WAF	558
WAF-relevant findings after human triage	49
Findings in CMDi / SSRF categories	48 of 49

XSS, LFI, SQLi, and Log4j had near-full coverage. The gaps concentrated in command injection and SSRF. One illustrative case: the model repeatedly changed the representation of a cloud metadata IP address (decimal, octal, trailing-dot). The WAF blocked all but one — a trailing-dot form that resulted in a redirect rather than a block. That single finding led to a new detection rule: SSRF - Obfuscated Host.

The important detail: this was Cloudflare testing its own WAF, with their own rules, at their own paranoia level, on their own infrastructure. And they still found 49 gaps. A vendor with full knowledge of its own detection logic, testing against its own product, found that a frontier LLM could find bypasses in under a day.

What this means for the average organization’s WAF — with default rules, lower paranoia levels, and no internal red-team — is not a question worth asking.

The academic version

BWAFSQLi (ACM TOSEM, January 2026) provides the quantitative backing. The paper describes a framework for generating adversarial SQL injection payloads that are semantically equivalent to known attacks but structurally different enough to evade detection.

Tested against 11 WAFs (3 gray-box, 8 black-box), the framework increased false-negative rates by up to 93.39% on gray-box WAFs and 58.49% on black-box WAFs, while substantially reducing the number of HTTP requests needed compared to prior state-of-the-art methods.

The paper also proposes seven payload preprocessing defense strategies that reduce the false-negative increase by 74.59% on average across the black-box WAFs. This is important: the defense is not “use a different WAF.” It is “normalize the input before matching.” Which is, in practice, what the ML/behavioral WAFs we covered in our previous post are doing — they are not matching strings, they are scoring deviations from a learned baseline.

The $25 breach

In September 2026, Gambit Security and Abstract Security published a joint analysis of a campaign that is, at this point, the clearest demonstration of AI-driven WAF bypass in the wild.

The operator recovered a staging server showing three open-source AI harnesses running almost the entire attack chain autonomously:

Strix — vulnerability search
Cairn — autonomous penetration testing
Hermes — orchestration

The underlying models were accessed via OpenRouter, a gateway for LLM APIs. A human operator typed short instructions in Chinese; the agents did the rest.

The numbers:

Metric	Value
Attack projects launched (Sept 10–15 alone)	105
Companies compromised	27+
Unexpired credit card records stolen	600,000+ (from two companies)
Sites with confirmed skimmers	100+
Estimated cost per target	~$25
Total campaign cost (4 weeks)	$12,000–$18,000

The campaign has been running since July 2026 and is still active. Targets include a Fortune 500 hospitality company, a major US airline, and a large private industrial supplies distributor. In most instances, access was gained in less than a day; in some, in a few hours.

The WAFs in front of these organizations were not “broken” in any dramatic sense. They were bypassed by an agent that could generate encoding variants, try alternative paths, and iterate based on HTTP responses — the same loop Cloudflare used to test its own product, but pointed at production targets.

The AI is on both sides

The attacker side is now accessible to anyone with an LLM API key and an open-source harness. The defender side is catching up, but it is not a free lunch.

Google’s Threat Intelligence Group confirmed in May 2026 the first AI-generated zero-day exploit in the wild: a Python script that bypassed two-factor authentication on an open-source web administration tool. GTIG identified it as LLM-generated based on educational docstrings, a hallucinated CVSS score, and textbook Pythonic formatting — fingerprints of model output, not human authorship. Google worked with the vendor to patch before the threat actor could launch a planned mass exploitation campaign.

On the defense side, the vendors we covered in our previous post — F5, Check Point, Akamai, and Cloudflare — are all racing to put ML on the detection side. But the asymmetry is real: an attacker needs to find one bypass. A defender needs to close all of them.

So what is obsolete?

The WAF as a detection function is not obsolete. HTTP traffic still needs to be inspected, scored, and blocked or allowed. That layer is not going away.

What is obsolete:

The standalone appliance. A hardware box in the DMZ with a ruleset you update quarterly. The attack surface has moved to APIs, websockets, and cloud-native services that a perimeter appliance cannot see.
Signature-only detection. A WAF that only matches known patterns is, as the BWAFSQLi paper demonstrates, bypassable with a 93% false-negative increase under adversarial conditions. As a sole control, it is no longer sufficient.
The assumption that the attacker is human-speed. The Gambit campaign ran 105 attack projects in five days at $25 each. The ShinyHunters bypass required one encoding variant. These are not attacks that require a team of security researchers. They require an API key and a prompt.

What is not obsolete:

The WAF as a component of a WAAP platform. The detection function lives on, but it is one layer in a stack that includes DDoS mitigation, bot management, API security, and behavioral analytics.
ML/behavioral detection as the primary engine. The vendors that have moved to per-application baselining and risk scoring (F5, Check Point) are in the best position to handle the “polymorphic payload” problem, because they are not matching strings — they are scoring deviations.
Human review. Cloudflare’s own AI red-team test found 49 gaps, but every single one required human triage before it became an actionable fix. The AI generates candidates; a human decides what is real. This is not going to change in the near term.

The practical takeaway

If you are running a signature-only WAF in 2026, you are running a system that can be bypassed in under a day by a motivated actor with a public LLM API key and an open-source harness. The cost to the attacker is roughly $25.

The question is not “WAF or not.” The question is:

Is your WAF adaptive (per-application baselining, continuous retraining, risk scoring) or static (signature matching, manual tuning)?
Is it a standalone product or a component of a WAAP platform that also handles the other attack vectors (DDoS, bots, API abuse)?
Has anyone independent verified that your specific configuration detects the attack classes you care about?

The WAF is not obsolete. The WAF you are running might be.

Sources

Google GTIG / Mandiant (Sept 26, 2026).
Cloudflare blog, “We tested our own WAF with frontier AI models” (Sept 29, 2026).
BWAFSQLi (ACM TOSEM, Jan 2026).
Gambit Security / Abstract Security joint report (Sept 22, 2026).
Google GTIG AI Threat Tracker (May 11, 2026).