Virtual Patch Rules

	CVE ID	Name / Description	Severity	Tags	Source	Actions

WafX fetches ModSecurity/Coraza-compatible rule files from these sources and merges them into your CVE rule catalog. Custom rules from external sources are tagged with the source ID. Only rules with valid SecRule directives are imported.

Auto-Sync CVE rules periodically

Sync interval (hours)

Rules file path (Coraza/ModSecurity include) This file is written on Apply. Include it in your Coraza config with: Include /etc/nginx/wafx/vpatch.rules

⚠ The rules path is not detected in your Coraza/ModSecurity configuration. Add an Include directive to /etc/nginx/coraza/coraza.conf (or your active modsecurity.conf) pointing to this file so rules are actually enforced.

Suggested Coraza include (add to modsecurity.conf)

# modsecurity.conf or WafX coraza config
Include /etc/nginx/wafx/vpatch.rules

Reload & Sync History

No history yet.

Deploy

Graceful Reload sends nginx -s reload (SIGUSR1) — active connections are not interrupted. New workers pick up the updated rules while old workers finish their requests.

How It Works

WafX ships built-in rules for critical CVEs (Log4Shell, Spring4Shell, Confluence OGNL, etc.)
Enable/disable individual CVEs or pull the latest rules from external sources with one click
Click Write Rules File to generate a Coraza-compatible .rules file
Click Graceful Reload — nginx reloads without dropping connections
Enable Auto-Sync to automatically fetch new CVE rules every N hours

Rule Preview

Rules File Preview

# Enable plugin and click Write Rules File to preview