Solutions Engineer @cloudflare. Immich contributor. Tweets are my own. PhD in quantum cryptography
Jönköping, Sweden
Joined January 2014
- Tweets12.4K
- Following1.9K
- Followers1.8K
- Likes69K
We're at Cyber Security Nordic 🇫🇮 this week! I'm talking post-quantum cryptography 🔐⚛️ at 1000 Wednesday on the gold stage.
Then come to the Cloudflare 🟧☁️ booth at 1b25
Spend management is do important in order to remove the pitfall of costs rushing. Happy to see this coming to Cloudflare, starting with workers and durable objects!
Hard spend limits are finally becoming available for Workers & Durable Objects – the rest of the platform coming soon!
Maybe the most requested feature ever.
DM @SidChatterjee for early access.
Jonathan Jogenfors retweeted
SHA-256 is not broken, but its security margin lost 1 more round this year:
Last week I found a collision attack on reduced 39-round that improves prior art by over 30 bits and the first differential attack on that round better than generic search on @yukonresearch Hashsmash board.
The attack rests on the same method as prior art ePrint 2026/1120 with new insights that first 2 state words could remain free, allowing a critical condition at step 16 rebuilt as a claw-search problem rather than a probabilistic filter. Took days of watching SAT logs, burning cores and arguing with Claude on what's possible to get a result close to generic search.
Since my initial submission, other hashsmash participants sraiw, @cyberaxe, @privacymage, @lamb356_ and @geeknik pushed it down by over 6.5 bits, currently estimated at 118.15 bits. The tree of submissions is hard to follow, so I put the construction, insights and numbers into a blog and am working on detailed technical report.
It's fascinating to see an initial structural observation develop into an improvement in the reduced-round collision frontier within days. AI is now a real aid in cryptanalysis and open collaboration speeds it up.
Immich version 3.3.5 patches CVE-2026-111497. Consider all versions below that vulnerable, please update ASAP.
eMudhra fix also included.
github.com/immich-app/immich…
Jonathan Jogenfors retweeted
A trusted contact who has a working exploit tells me reliable exploitation is still possible against PHP 8.2.35 and 8.5.12, despite the security updates.
According to their testing, setting
session.upload_progress.enabled = Off
blocks that exploit path.
I haven’t reproduced this myself. Whether this is an incomplete fix for the disclosed CVEs or a separate issue still needs clarification.
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
Unvalidated AI output (author admits in replies: omp with glm5.3 + ds4), not a lab result. Its screenshot says both CVEs are fixed; the 'surviving paths' need unserialize() of attacker data or an app LFI. Patch per php.net: php.net/archive/2026.p…
Jonathan Jogenfors retweeted
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure."
thephp.foundation/blog/2026/…
Jonathan Jogenfors retweeted
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
With the poc already leaked I call on PHP to release the vuln early. The official timeline still says three hours
Jonathan Jogenfors retweeted
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
Yes!
Cloudflare is taking ownership of tsrs, a port of TypeScript to Rust. It's 8x faster and uses 70% less memory than TypeScript 7.0.
We are not forking TypeScript – we are working with the TypeScript team and as a result 7.1 is already ~2.5x faster, too.
blog.cloudflare.com/typescri…
