Cloudflare CTO has confirmed there are WAF rules deployed as a stop gap for the RCE.
https://developers.cloudflare.com/changelog/post/2026-10-21-emergency-waf-release-cfmr/
Cloudflare DocsWAF Release - 2026-10-21 - Emergency - Cloudflare Managed RulesetCloudflare Managed Ruleset 2026-10-21 emergency release
commit 46e6f58