Principal engineer @ Cloudflare Observability More active on BlueSky

Squamish, BC
Joined April 2012
Cursed idea I don't have time to play with: slop-fork celld's architecture into OCaml and run it in a unikernel
1
131
Jeremy Morrell retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
258
3,080
630
20,742
1,968,010
Jeremy Morrell retweeted
I was super critical for years that Cloudflare turns into a single point of failure for many sites. But the flipside is that it's also has a really good positive leverage affect on security. This is great stuff. xitter.cf/dok2001/status/2112811…
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
12
24
5
574
17,962
Jeremy Morrell retweeted
If you self host software, you really should put it behind either Cloudflare or Vercel’s firewall The firewall rules & data they have on how people try to run exploits are so critical right now
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New rules keep landing in the WAF changelog. Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly. PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP. blog.cloudflare.com/php-vuln…
21
20
5
839
24,898
Jeremy Morrell retweeted
The new capability that we built to help defend php2shell is live. The @Cloudflare WAF now has full transaction detection that evaluates the request and the origin response together, and response rules block a match before it reaches the requester. Example from the post: unauthenticated hit on /admin that comes back 200 text/html. Block it. Auth failures and redirects can then pass through untouched. blog.cloudflare.com/full-tra…
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New rules keep landing in the WAF changelog. Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly. PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP. blog.cloudflare.com/php-vuln…
6
59
10
437
99,214
Jeremy Morrell retweeted
!!
11
29
19
296
30,271
From my feed I'm not quite sure if Cloudflare Connect is a customer conference or a company on-site #FOMO
6
43
1,799
Whoa 🤯 That's such a good idea! "It is still fast, typed, and cheap, but it answers with values directly extracted from the input, computed from it, or predicted beyond it."
1
8
466
@michellechen immense props to the team, and to the author of the blog post! It's so well-explained and the examples are great. I think this might be my favorite post on the blog this year!
1
2
66
In a bunch of different areas I keep exploring new ideas and then realizing "Damn, that's just Cloudflare OS again" It's like the LLM version of re-inventing trains from first principles
Prediction: Most people will stop using docs, slides, or spreadsheets in the next year, instead prompting an agent for custom code for every task. Each of these apps is just as "easy mode" version of something else that used to take far more time and skill to create: Docs: Easy mode web site. Slides: Easy mode video / animation. Spreadsheets: Easy mode custom app + database. But now you can just prompt an agent to build the "hard mode" version for you and they are damned good at it. (Note: I'm not suggesting that humans shouldn't write. You can still write text, and then ask an agent to turn it into a web site that supplements your text with diagrams, animations, hierarchical organization, etc.)
1
4
419
This came back across my feed so I'm reposting it again because it's a bop
We open sourced Void v1.1.11 and we made a music video for it. void.cloud
1
5
472
Jeremy Morrell retweeted
Progress! My eval reports now link directly to investigator traces, individual tool-call spans, and grader spans. You can click on a failed tool call's span ID, and inspect the command/error in context. Also according to my evals, Luna 6 is a weird little chaos gremlin.
1
1
83
Jeremy Morrell retweeted
I don’t think personal software will kill OSS and I think it’s very overrated. It’s super fun to jangle the keys in front of your own face and vibe code up a copy of something else that exists in this world. But truly owning it, operating it, having a vision for it kinda sucks! OSS still wins out on the a value proposition that it’s free and you can shunt those concerns off to someone else. The talking computers don’t actually know exactly what individual people want and most people don’t feel like just living with whatever an agent confabulated as a design and architecture. The future for OSS probably involves a token market where you can yield some tokens to allow a maintainer group make the right decisions for you.
4
2
1
23
941
"everyone is twelve now" still seems to perfectly explain so much of current discourse
5
230
Jeremy Morrell retweeted
🧠: Okay, so we are working on something really cool right now and want to present it to our peers in a technically proficient and approachab... 👄: GET IN BITCHES WE'RE DOING EVALS! Work in progress obviously, but stay tuned!
1
62
Jeremy Morrell retweeted
prototyping visualizations in the new cf cli got nerdsniped by @nevikashah
1
7
22
1,119
Jeremy Morrell retweeted
Workers Issues can detect and classify vulnerabilities scanning on your app If you get these pls go turn on waf u silly goose 🥰cloudflare.com/products/waf/
3
2
14
1,587
Jeremy Morrell retweeted
It's a shame Anthropic and OpenAI sub don't really give you programatic access to other models like text-to-speech and speech-to-text, so i've just been telling my agents to use the `cf ai run` command with *fantastic* results
6
3
91
4,672
Jeremy Morrell retweeted
I don't know how many tokens this used, but it was worth it.
We open sourced Void v1.1.11 and we made a music video for it. void.cloud
3
1
17
899