Cloudflare announced that it has deployed edge protections to defend against the php2shell vulnerability impacting PHP-based applications. The response consists of managed WAF rules and signatures activated across Cloudflare’s network to identify and block common exploit patterns targeting the php2shell flaw. Protections focus on malicious payloads delivered via request URIs, headers and bodies, attempts to write or execute web shells, and characteristic obfuscation techniques used by attackers. Any site proxied through Cloudflare receives these virtual patches immediately, and customers can further tune protections with custom firewall rules and managed rule settings.
Alongside the rule rollout, Cloudflare recommends that operators update and patch vulnerable PHP installations, review logs for indicators of compromise, and enable logging or alerting to spot any exploitation attempts. The deployment was driven by observed scanning and attack activity; Cloudflare says it will iterate on signatures as researchers publish more indicators and as exploit techniques evolve. For immediate mitigation, enabling Cloudflare’s managed security rules provides an effective block while owners apply permanent fixes to their server software.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.