alt Hacker NewsThis is extremely damning for Cloudflare. I had a bunch of clients telling me Cloudflare is all they need to prevent this, and they want to get that on their site instead of upgrading PHP.
I have not seen confirmation Cloudflare is doing anything except playing whack a mole with certain request patterns. PHP Core Devs have been clear you need to upgrade. If this is true, it's disgustingly opportunistic that Cloudflare is using this critical security time to lie to people that they are safe.
Anyone from Cloudflare want to speak to this?
Replies
When log4j came out CF helped a lot. The rules are called stopgap. A TEMPORARY fix. CF added some for this exploit.
The old way of doing things like putting old unpatched stuff behind firewalls is pretty much a dead pattern today.
I'm not from Cloudflare, or particularly a fan of theirs, but they are doing a few things about this, including a new WAF capability: https://blog.cloudflare.com/full-transaction-waf/ and automatic protection for all customers https://blog.cloudflare.com/php-vulnerabilities-waf-protecti...
These were rolled out before the exploit became public.
I would wouldn't describe that as damning.