Some stats on #php2shell#. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server. tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible. The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra#. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this. The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell#. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed. @Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged. For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free. Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem. If you’re interested in learning more, you can read our blogs: Vulnerable roots: PHP vulnerabilities:

Amused that AWS just unilaterally cancelled Cloudflare's Reinvent booth. There are always signs when someone finally realizes they're losing. Guess we'll just attend and throw the most fun side events without paying Amazon! Reply if you want an invite.

Two medal plates and lots of screws to fix my right humerus, which I shattered in a bike accident in Europe earlier this week. Thanks to the amazing team at @HSpecialSurgery for patching me up better than new. And, yes, I’m insisting @zatlyn call me Iron Man.

!!!ACTION REQUIRED!!! if you are building something weird and ambitious on cloudflare, I would VERY much like you to come defend your life choices in front of me on stage. it's going to be dope, please sign up TODAY.

founders! pitch your startup in a Shark Tank-style competition live on stage at Connect - win a billboard in SF, $350K in @Cloudflare credits, access to the VIP speakers dinner - judged by @eastdakota, @zatlyn, @dok2001 - hosted by @threepointone details + how to apply ↓

you can now give any teammate or agent access to just one Worker we’re starting by bringing granular authz to Workers and are are working on supporting the same for D1, KV, and the rest of dev plat! here are 4 new roles that you can set to grant the right level of access 👇

You can now scope access to individual Workers and assign narrower Developer Platform roles, so teammates, CI tokens, and agents get only the access they need to debug, deploy, or monitor safely.