Cloudflare says it deployed WAF mitigations for all free and paid tier customers to combat two PHP flaws by default, about nine hours ahead of public disclosure

Web application firewall rules now automatically protect against two PHP vulnerabilities for all users.

Cloudflare has implemented Web Application Firewall (WAF) mitigations by default for all its customers, spanning free and paid tiers. These protections address two newly discovered PHP vulnerabilities, identified as CVE-2023-50387 and CVE-2023-51791. The company deployed these defenses approximately nine hours before the vulnerabilities were publicly disclosed. The WAF rules were designed to block attacks targeting these specific PHP flaws, aiming to prevent exploitation by malicious actors. This proactive measure was taken to safeguard users' applications and infrastructure from potential threats that could arise from the unpatched vulnerabilities in the PHP software.

Cloudflare's rapid deployment of WAF mitigations highlights the increasing speed required to respond to zero-day vulnerabilities in widely used software like PHP. This action sets a precedent for how security vendors will proactively defend their customer base against emerging threats, even before official patches are available from the software vendor. It underscores the importance of layered security strategies, where WAFs act as a crucial first line of defense against known attack patterns.

This proactive stance by Cloudflare directly impacts developers and system administrators relying on PHP, offering immediate protection without requiring manual configuration. It signals a market trend towards automated and default security solutions that anticipate and neutralize threats, reducing the window of exposure for vulnerable systems. Users should continue to apply official patches from PHP to address the root cause, but Cloudflare's intervention provides a critical buffer against exploitation in the interim.