Principal engineer @ Cloudflare Observability More active on BlueSky
Squamish, BC
Joined April 2012
- Tweets17.5K
- Following834
- Followers2.7K
- Likes108K
Cursed idea I don't have time to play with: slop-fork celld's architecture into OCaml and run it in a unikernel
Jeremy Morrell retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Jeremy Morrell retweeted
I was super critical for years that Cloudflare turns into a single point of failure for many sites. But the flipside is that it's also has a really good positive leverage affect on security. This is great stuff. xitter.cf/dok2001/status/2112811…
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
Jeremy Morrell retweeted
If you self host software, you really should put it behind either Cloudflare or Vercel’s firewall
The firewall rules & data they have on how people try to run exploits are so critical right now
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
Jeremy Morrell retweeted
The new capability that we built to help defend php2shell is live.
The @Cloudflare WAF now has full transaction detection that evaluates the request and the origin response together, and response rules block a match before it reaches the requester.
Example from the post: unauthenticated hit on /admin that comes back 200 text/html. Block it. Auth failures and redirects can then pass through untouched.
blog.cloudflare.com/full-tra…
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
From my feed I'm not quite sure if Cloudflare Connect is a customer conference or a company on-site #FOMO
Jeremy Morrell retweeted
we shipped a new type of model: an extraction model!
pass it unstructured data, and get a list of the details and probability back. try it out and let us know what you think!
blog.cloudflare.com/clairic-…
@michellechen immense props to the team, and to the author of the blog post! It's so well-explained and the examples are great. I think this might be my favorite post on the blog this year!
Whoa 🤯 That's such a good idea!
"It is still fast, typed, and cheap, but it answers with values directly extracted from the input, computed from it, or predicted beyond it."
a brand new model paradigm! introducing 𝚌𝚕𝚊𝚒𝚛𝚒𝚌: a system one model for extracting, computing, estimating, and predicting values from unstructured inputs.
blog.cloudflare.com/clairic-…