Cloudforce One R.E.A.C.T. @Cloudflare Thoughts are my own. Prior; Founder @SoteriaSecurity, @Alienvault, @Apple, @NSAgov, @USArmy
The Carolinas, USA
Joined July 2012
- Tweets3K
- Following3.9K
- Followers1.4K
- Likes12.9K
Just ordered a bunch of Equipment from @crowd_supply and @hackerwarehouse . Most of it's backordered from Dec - Feb :(
New Haasoscope Pro's, Thunderscopes, USB Analyzers, SDR Equipment.. etc.
Now the waiting begins.
Chris O'Rourke retweeted
We're hiring a model operations lead in AI Gateway.
We run a veritable model zoo on AIG and it's only going to get more complex. Your job is to wrangle the model stock, automate the farm, and supercharge a set of humans responsible for the models experience.
If...
- you have an ops-ish background
- you're a generative/yes-and person
- you love to reduce toil
- you have a deep and abiding love for automation
- you love developers
...then this is your jam.
job-boards.greenhouse.io/clo…
This is Beyond cool! @JohnHultquist is doing great things here. Reach out!
If you're a threat Intel pro that's been laid off and you want to come to @CYBERWARCON I have a ticket for you. Hit me up.
Chris O'Rourke retweeted
We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer. cfl.re/4iqHaQ1
Come Join in on the Fun!
Always have enjoyed CTFs. So I Asked the team to build one for the php2shell CVEs.
Stock PHP 8.5.11 behind our WAF with default rules. Find a way around and read /flag and report to earn bounty.
REMINDER - WAF buys you time. It isn't bulletproof. Upgrade your PHP.
blog.cloudflare.com/php-ctf
Chris O'Rourke retweeted
attn founders: get access to up to $100,000 in cloudflare credits on @stripe atlas
New perks for Atlas founders:
@supabase: up to $500 in platform credits
@elevenlabs: 12 months of free access
@cloudflare: $100,000 USD in product credits
@meetgranola: 12 months of Granola Business for up to 30 seats
@joinellis: 30-min consult + $2,000 off an O-1 or $1,000 off any other visa petition
@squarespace: 20% off your Squarespace website for the first year
@customerio: 1 year of Customer.io Startup plan and 50% the following year
Chris O'Rourke retweeted
Cloudflare previous CTO sent this into our bug bounty. We are investigating.
According to the staff at the Apple Store in World Trade Center, no sense standing in line because they only got 2 Duos lol.
Chris O'Rourke retweeted
One-click mitigation for php2shell vulnerability:
If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected.
dash.cloudflare.com/?to=/:ac…
This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
Chris O'Rourke retweeted
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
Get out there and update your apps and tools.
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next. cfl.re/487DNbG
First leg of trip down, goodbye Singapore, next stop San Francisco to talk about, Ai, DFIR, and red teaming @Cloudflare connect.
I’ve got a couple of variants, these always look great!
Preorder a new batch retro.cool/products/dreamcas…
Got’em
How abliterated models can get you pwned 👾
We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.