I'm not from Cloudflare, or particularly a fan of theirs, but they are doing a few things about this, including a new WAF capability: https://blog.cloudflare.com/full-transaction-waf/ and automatic protection for all customers https://blog.cloudflare.com/php-vulnerabilities-waf-protecti...
replyThese were rolled out before the exploit became public.
I would wouldn't describe that as damning.
It's great they are doing mitigations, but they admit themselves, in fine print, that this will not protect you from the vulnerability
replyWhy is word circulating that you can just sign up for Cloudflare and be 100% protected from this? They are burying the leed and trying to get new customers, and it's working.
deleted
replyWhen log4j came out CF helped a lot. The rules are called stopgap. A TEMPORARY fix. CF added some for this exploit.
replyThe old way of doing things like putting old unpatched stuff behind firewalls is pretty much a dead pattern today.