Cloudforce One R.E.A.C.T. @Cloudflare Thoughts are my own. Prior; Founder @SoteriaSecurity, @Alienvault, @Apple, @NSAgov, @USArmy
The Carolinas, USA
Joined July 2012
- Tweets3K
- Following3.8K
- Followers1.4K
- Likes12.8K
Chris O'Rourke retweeted
We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer. cfl.re/4iqHaQ1
Come Join in on the Fun!
Always have enjoyed CTFs. So I Asked the team to build one for the php2shell CVEs.
Stock PHP 8.5.11 behind our WAF with default rules. Find a way around and read /flag and report to earn bounty.
REMINDER - WAF buys you time. It isn't bulletproof. Upgrade your PHP.
blog.cloudflare.com/php-ctf
Chris O'Rourke retweeted
attn founders: get access to up to $100,000 in cloudflare credits on @stripe atlas
New perks for Atlas founders:
@supabase: up to $500 in platform credits
@elevenlabs: 12 months of free access
@cloudflare: $100,000 USD in product credits
@meetgranola: 12 months of Granola Business for up to 30 seats
@joinellis: 30-min consult + $2,000 off an O-1 or $1,000 off any other visa petition
@squarespace: 20% off your Squarespace website for the first year
@customerio: 1 year of Customer.io Startup plan and 50% the following year
Chris O'Rourke retweeted
Cloudflare previous CTO sent this into our bug bounty. We are investigating.
According to the staff at the Apple Store in World Trade Center, no sense standing in line because they only got 2 Duos lol.
Chris O'Rourke retweeted
One-click mitigation for php2shell vulnerability:
If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected.
dash.cloudflare.com/?to=/:ac…
This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
Chris O'Rourke retweeted
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
Get out there and update your apps and tools.
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next. cfl.re/487DNbG
First leg of trip down, goodbye Singapore, next stop San Francisco to talk about, Ai, DFIR, and red teaming @Cloudflare connect.
I’ve got a couple of variants, these always look great!
Preorder a new batch retro.cool/products/dreamcas…
Got’em
How abliterated models can get you pwned 👾
We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.
Galactic Racer is awesome.
If you have Amazon prime it’s free to play on LUNa 👀 if you don’t want to spend the cash. Worth it though. Bought the upgrade to deluxe to support devs. ❤️
Chris O'Rourke retweeted
ollama pull clef
open models for all. start building with @ollama and @cloudflare clef decision models today
.@Cloudflare's decision models are available on Ollama!
Decision models allow you to classify an image, label a bug report or route a support ticket to the right team.
Clef (27B):
ollama pull clef
Clef Flash (9B):
ollama pull clef-flash
My @thsottiaux @OpenAI reset hit, but with 27% already used? May be a glitch here. Also it apparently auto burned through my credits last night (🫥 that one is on me ). Renews in 2 days, probably won't hit my Sol use limits by then, more a message for awareness.
Bought it on two systems. Love it. Glad to see it’s free for anyone interested in giving it a shot.
Do you know the origin of SHODAN??
One of the free Epic Games this week is the 25th anniversary remaster of System Shock 2: store.epicgames.com/p/system…
