This is extremely damning for Cloudflare. I had a bunch of clients telling me Cloudflare is all they need to prevent this, and they want to get that on their site instead of upgrading PHP.

I have not seen confirmation Cloudflare is doing anything except playing whack a mole with certain request patterns. PHP Core Devs have been clear you need to upgrade. If this is true, it's disgustingly opportunistic that Cloudflare is using this critical security time to lie to people that they are safe.

Anyone from Cloudflare want to speak to this?

▲

cr3ative 2 hours ago | parent | next [-]

I'm not from Cloudflare, or particularly a fan of theirs, but they are doing a few things about this, including a new WAF capability: https://blog.cloudflare.com/full-transaction-waf/ and automatic protection for all customers https://blog.cloudflare.com/php-vulnerabilities-waf-protecti...

These were rolled out before the exploit became public.

I would wouldn't describe that as damning.

	▲	Capricorn2481 2 hours ago \| parent [-]
		It's great they are doing mitigations, but they admit themselves, in fine print, that this will not protect you from the vulnerability Why is word circulating that you can just sign up for Cloudflare and be 100% protected from this? They are burying the leed and trying to get new customers, and it's working.

▲

2 hours ago | parent | prev | next [-]

[deleted]

▲

AtNightWeCode an hour ago | parent | prev [-]

When log4j came out CF helped a lot. The rules are called stopgap. A TEMPORARY fix. CF added some for this exploit.

The old way of doing things like putting old unpatched stuff behind firewalls is pretty much a dead pattern today.