Hacker News Reader

Hacker News

Comment by anthonyeden | Hacker News Reader

Full thread

anthonyeden

From what I can tell, Cloudflare has mitigated this via their WAF [0] (free and paid).

The Alpine GitLab[1] indicates the PHP versions to be released 21-10-2026 14:00:00 UTC are:

8.5.12 8.4.27 8.3.36 8.2.35

[0] https://developers.cloudflare.com/waf/change-log/changelog/

[1] https://gitlab.alpinelinux.org/groups/alpine/-/work_items?sh...

View on HN

Release notes draft filenames (but not contents) are published to the mailing list: https://news-web.php.net/php.webmaster/34116

That got nuked by the looks of it.

Guess the site runs on PHP..

Wow, it's the first time that I see the Cloudflare-equivalent error page of Bunny.net.

We observed this update ourselves and suspected it to be a mitigation when it was rolled, but I can't find any definitive record that these rules are about the PHP vulnerability. Do you have more info?

https://x.com/dok2001/status/2112802620029223193

Let's be clear here: they provided a waf rule. You need to actually have it enabled to be protected.

On the free Cloudflare tier its enabled and you cannot disable it. On Paid you can disable it.

They enable this kind of rules by default and for free.

I have sites behind Fastly and Akamai, and I would dearly love to hear from either of them.

I have one site on WPEngine and they haven't said anything [that I've seen]

I heard back from their technical team:

> WP Engine Security and Engineering have enabled WAF rules for all customers using GES and AN. Mitigations are currently being deployed across the rest of our infrastructure, and official patches will be applied as soon as they become available.

https://www.fastly.com/blog/fastlys-proactive-protection-cri...

It looks like bunny have added their waf rule too for mitigation.

https://x.com/BunnyCDN/status/2112867273333485634

where is patch for alpine?

finally released

Reply on news.ycombinator.com