Hacker News Reader

https://x.com/dok2001/status/2112702593705312467

"We got you covered" - Dane Knecht (Cloudflare CTO)

A little too vague for my comfort.

Now deleted, and replaced with: https://x.com/dok2001/status/2112802620029223193

"Cloudflare has protections in place for known exploit payloads. There will be more variations to come and the only way to fully protect your site is to update php once released."

I think putting my PHP site behind Cloudflare would be the least I would do if I wanted to keep it online before PHP can be patched. The other alternative is trying to block multi-part uploads before they reach PHP.

Make sure to create CF tunnel to your server and to reject all traffic frin other sources, or to accept traffic only from known CF ips. Otherwise, you're still exposed, even if CF WAF works.

CF in front can mess about with L7?

Yes? How did you think Cloudflare and other WAFs worked?

A WAF is primarily working at L7.