Cloudforce One R.E.A.C.T. @Cloudflare Thoughts are my own. Prior; Founder @SoteriaSecurity, @Alienvault, @Apple, @NSAgov, @USArmy
The Carolinas, USA
Joined July 2012
- Tweets3K
- Following3.8K
- Followers1.4K
- Likes12.7K
Chris O'Rourke retweeted
One-click mitigation for php2shell vulnerability:
If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected.
dash.cloudflare.com/?to=/:ac…
This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
Chris O'Rourke retweeted
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
Get out there and update your apps and tools.
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next. cfl.re/487DNbG
First leg of trip down, goodbye Singapore, next stop San Francisco to talk about, Ai, DFIR, and red teaming @Cloudflare connect.
I’ve got a couple of variants, these always look great!
Preorder a new batch retro.cool/products/dreamcas…
Got’em
How abliterated models can get you pwned 👾
We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.
Galactic Racer is awesome.
If you have Amazon prime it’s free to play on LUNa 👀 if you don’t want to spend the cash. Worth it though. Bought the upgrade to deluxe to support devs. ❤️
Chris O'Rourke retweeted
ollama pull clef
open models for all. start building with @ollama and @cloudflare clef decision models today
.@Cloudflare's decision models are available on Ollama!
Decision models allow you to classify an image, label a bug report or route a support ticket to the right team.
Clef (27B):
ollama pull clef
Clef Flash (9B):
ollama pull clef-flash
My @thsottiaux @OpenAI reset hit, but with 27% already used? May be a glitch here. Also it apparently auto burned through my credits last night (🫥 that one is on me ). Renews in 2 days, probably won't hit my Sol use limits by then, more a message for awareness.
Bought it on two systems. Love it. Glad to see it’s free for anyone interested in giving it a shot.
Do you know the origin of SHODAN??
One of the free Epic Games this week is the 25th anniversary remaster of System Shock 2: store.epicgames.com/p/system…
Makes for an Eye Catching piece in the office too!
128 VRAM. 4x RTX 5090. One box serves a whole team.
This is what "Build your own AI Datacenter" looks like in real life.
autonomous.ai/computer-4
Own your compute. Own your intelligence.
Chris O'Rourke retweeted
We are expanding access to Cloudforce One's Threat Events Platform to every Cloudflare account and introducing Threat Signals. Threat Signals automatically parses open-source threat reporting, extracts structured indicators, and connects threat context directly to your WAF rules. cfl.re/4hkBxU8 #BirthdayWeek
Today for Birthday week @Cloudflare the @Cloudforce_One team launched Threat Signals; agentic skills for open-source threat intelligence, free for every Cloudflare account.
blog.cloudflare.com/threat-s…
Shifting from all the AI news.
DEFCON (not the hacker conference) has had a Major 20th Anniversary Update!
GO WAGE THERMONUCLEAR WAR!!!!! it's under $5 and less than 150mb installed :D
store.steampowered.com/app/1…
Welp looks like it’s that time of year again @Rivian . Still bummed you haven’t made a proper fix here.
