GoKawiil
Tech News
Cloudflare's status page indicated multiple active incidents affecting its services. Shortly after, the page was updated to show no known service issues, with Cloudflare saying it would post further updates if conditions change.
Tangled has released a code forge that combines Git with the AT Protocol, letting developers self-host any combination of components—Git hosting, CI runners, API servers, or the UI—while still collaborating with users on other instances. The project also ships custom extension options, including third-party 'knots' and 'spindles' built by outside developers on platforms like Cloudflare Workers.
Developer Tom Anthony built YourOwnWeigh, an open-source project that reroutes data from Withings smart scales away from Withings' servers to a user-controlled server instead. The tool patches scale firmware via Bluetooth and can run on a free Cloudflare account, letting users sync weigh-in data to apps like Apple Health without paying for Withings Plus.
A developer has released cfsolve, an open-source Rust library and CLI tool that solves Cloudflare Turnstile widgets and challenge pages by impersonating real browsers using recorded response profiles, rather than running a headless browser. It outputs either a Turnstile token or a cf_clearance cookie, and currently ships with a Safari-on-iOS profile, with Chrome also supported in principle.
A technical write-up describes a telemetry pipeline that uses two alternating Cloudflare Queues, switched via modulo arithmetic on UTC timestamps, to continuously capture events without interrupting ingestion. An hourly consumer task drains the inactive queue, compresses the batched events, and writes them to Cloudflare R2 using a partitioning scheme based on time.
Matthew Prince told Reuters that Cloudflare has identified several other severe vulnerabilities in widely used critical software, beyond the recent PHP flaws that knocked government sites, GOG, and other websites offline. He said AI tools are making it far easier for both researchers and attackers to find and exploit such bugs in core internet infrastructure.
Security researchers at Calif, OpenAI, and Wiz used AI tools to independently uncover practical exploits for long-known but previously unexploitable PHP vulnerabilities, collectively named PHP2Shell. Within hours of public disclosure, Cloudflare recorded millions of exploitation attempts, though the PHP Foundation says no successful breaches have been confirmed and many circulating exploits appear ineffective.
Security researchers report that organizations are patching newly disclosed PHP vulnerabilities, dubbed PHP2Shell, much slower than attackers are exploiting them. Cloudflare's CEO said exploitation attempts rose from thousands to millions within hours of disclosure, while Check Point found 10% of organizations worldwide had already seen exploitation attempts. Ox Security and Flare separately found that over 97% of scanned instances had not advertised patched versions a day after fixes were released, and roughly half may never be patched, according to Cisco Talos.
PHP disclosed two critical vulnerabilities affecting versions from PHP 5 onward and urged operators to patch immediately. In response, government websites in Europe and elsewhere temporarily shut down on Wednesday while administrators applied fixes. Cloudflare CTO Dane Knecht said the company observed early attacks and was updating firewall rules as a temporary stopgap while awaiting the official patch.
PHP's maintaining agency disclosed two critical vulnerabilities on Tuesday, with fixes scheduled for release Wednesday at 10 a.m. ET. The flaws, rated 9.2 out of 10 in severity, could let attackers compromise websites built on PHP, which the Wall Street Journal estimates powers 70% of the internet. Agencies including the NSA and UK's NCSC urged administrators to patch immediately or take sites offline, while Cloudflare said it had deployed a firewall fix and security firm watchTowr reported early signs of exploitation attempts.
Security researchers at Calif.io, Wiz, OpenAI and Quarkslab disclosed two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, dubbed php2shell, affecting all web servers running PHP 5.4 or later. Cloudflare says it deployed WAF protections for free and paid customers by October 21 at 3:02 am UTC, roughly nine hours before the public disclosure, after coordinating with the PHP Foundation, OpenAI and Wiz.
A benchmarking study retested five bot-detection systems—Proof of Human, Google reCAPTCHA v3, hCaptcha, Cloudflare Turnstile, and Cloudflare Bot Management—against conventional automation, stealth browsers, and AI-powered browsing agents completing a five-question survey. Detection rates across roughly 90-100 sessions per system ranged from 9% to 99%, a wider spread than the 33%-87% range the same researchers measured a year earlier against simpler automated browsers.