Rather than taking your site down tonight, if you have cloudflare handling your DNS, orangeclouding your domain, you can use its free security rules to just block all post requests until tomorrow rather than taking your whole site offline. Drop this into a rule: `http.request.method in {"POST" "PUT" "PATCH" "DELETE"}`

Of course you can do this with web server (eg Apache) config as well, but the CF rule is something you can do now on your phone.

I’m not saying I know this works as a mitigation, but it seems like it could at least contribute to a temporary guard until you get patch in place. Everything I’ve seen about the exploits seem to revolve around multipart form submissions.

▲

rgj an hour ago | parent | next [-]

Don’t forget to firewall your webserver so it will only accept traffic that actually went through Cloudflare. This is the most false sense of security one can get.

▲

solyin 5 hours ago | parent | prev [-]

You can also do the apache rule from your phone, via ssh, if you're any good.

	▲	aksss 5 hours ago \| parent [-]
		Haha you’re right, but the skill you need to be good with is probably eye strain tolerance. But must needs and all. :) If you don’t use a WAF of some type, the risk is probably sufficient to warrant firing up the laptop tonight or worst case use the phone.