Oracle is expanding its web application firewall (WAF) capabilities, adding WAF features to its load balancer so as to protect so-called internal or private apps.