Cloud Armor release notes

This page contains release notes for features and updates to Google Cloud Armor.

You can see the latest product updates for all of Cloud de Confiance by S3NS on the Cloud de Confiance page, browse and filter all release notes in the Cloud de Confiance console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

March 31, 2026

Feature

Cloud Armor supports a visual Match Condition Builder that allows you to create complex expressions in Common Expression Language (CEL) without writing raw code. For more information, see Use the Match Condition Builder.

March 06, 2026

Security

Security fixes and enhancements to Cloud Armor preconfigured WAF canary rulesets for v3.0. For more information, see Tuning Google Cloud Armor WAF rules.

The following rulesets have been updated:

  • sqli-canary
  • xss-canary
  • lfi-canary
  • rfi-canary
  • rce-canary
  • methodenforcement-canary
  • scannerdetection-canary
  • protocolattack-canary
  • php-canary
  • sessionfixation-canary

February 18, 2026

Change

Cloud Armor preconfigured WAF rules support for inspection up to the first 64 kB (either 8 kB, 16 kB, 32 kB, 48 kB, or 64 kB) of the request body content is Generally Available.

February 13, 2026

Security

Security fixes and enhancements to Cloud Armor preconfigured WAF v33-canary rulesets. For more information, see Tuning Google Cloud Armor WAF rules.

The following rulesets have been updated:

  • sqli-v33-canary
  • xss-v33-canary
  • lfi-v33-canary
  • rfi-v33-canary
  • rce-v33-canary
  • methodenforcement-v33-canary
  • scannerdetection-v33-canary
  • protocolattack-v33-canary
  • php-v33-canary
  • sessionfixation-v33-canary
  • java-v33-canary
  • nodejs-v33-canary

December 06, 2025

Security

The Cloud Armor cve-canary rules include the google-mrs-v202512-id000002-rce signature to help detect and mitigate CVE-2025-55182. For more information, see Cloud Armor preconfigured WAF rules overview.

December 03, 2025

Security

The Cloud Armor cve-canary rules include the google-mrs-v202512-id000001-rce signature to help detect and mitigate CVE-2025-55182. For more information, see Cloud Armor preconfigured WAF rules overview.

July 08, 2025

Change

Cloud Armor preconfigured WAF rules can now inspect up to the first 64 kB (either 8 kB, 16 kB, 32 kB, 48 kB, or 64 kB) of the request body content in Preview.

October 09, 2024

Feature

Cloud Armor support for IP address groups is Generally Available.

Feature

Cloud Armor support for regional internal Application Load Balancers is Generally Available. You can use the regional backend security policy type with this load balancer. For more information, see types of security policies.

July 17, 2024

Feature

Granular models for Cloud Armor Adaptive Protection are now Generally Available. For more information, see the Adaptive Protection overview.