head of experience & design @cloudflare | founder @outerbase (acquired)
Joined January 2011
- Tweets3.3K
- Following742
- Followers12K
- Likes17.6K
overwhelmed by the php vulns and not sure how or where to get started?
we've added a copyable prompt to the cloudflare blog that you can feed your agent
blog.cloudflare.com/php-vuln…
brandon retweeted
The new capability that we built to help defend php2shell is live.
The @Cloudflare WAF now has full transaction detection that evaluates the request and the origin response together, and response rules block a match before it reaches the requester.
Example from the post: unauthenticated hit on /admin that comes back 200 text/html. Block it. Auth failures and redirects can then pass through untouched.
blog.cloudflare.com/full-tra…
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
it's kind of wild to work at a company that can basically flip a switch and protect 20% of the internet from critical vulns
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
make sure you have it enabled:
xitter.cf/BraydenWilmoth/status/…
One-click mitigation for php2shell vulnerability:
If you have Cloudflare in front of your PHP website, please login to the dashboard and click this button to make sure you are protected.
dash.cloudflare.com/?to=/:ac…
This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.
brandon retweeted
Kicking off Cloudflare Connect 2026 and for the first time, we are hosting it in San Francisco. I am so excited for the next two days with an incredible group of customers, developers, partners, analysts, journalists, Board Members, artists, speakers and fellow teammates.
brandon retweeted
a brand new model paradigm! introducing 𝚌𝚕𝚊𝚒𝚛𝚒𝚌: a system one model for extracting, computing, estimating, and predicting values from unstructured inputs.
blog.cloudflare.com/clairic-…
cloudflare mentioned 👀
however thanks to distributed compute, your tesla and ai gf are going to be just fine
the enemy cannot push a button, if you have to find it in the aws console
cloudflare is the most exciting place to be in the most exciting era of compute
Cloudflare is an infrastructure company. In 2026 that means the best place to run code and the best tools to build and ship it. Agents are writing more of the code every month. Someone still has to make it build and run.
This has been a big year of investment to make us even better.
We added @evanyou wrote Vue and Vite and @rough__sea wrote Node.js, then Deno.
Helping to make “Deploy to Region: Earth.” the agent default.
brandon retweeted
very excited to have the @deno_land team and @rough__sea join cloudflare! 🧡
workers and deno have been on a parallel journey over the past (nearly) decade or so in improving the fate of javascript on the server side. we have so so much respect for what the deno team has built and have drawn much inspiration from each other over the years!)
one of the big gaps and criticisms of workers over the years has been that it's a platform that locks you in. many people still don't realize that workerd (the workers runtime) is open-source, but that's likely because realistically self hosting it, especially with durable objects has remained cumbersome
that's what's been exciting to us about celld!
thrilled to welcome the team and get started on making self-hosting workers apps a first-class experience!
blog.cloudflare.com/deno-joi…
cloudflare + coffee?
*insert bad single origin joke*
for real though come through and hang out
Join us for coffee at SOHN on Thursday, Oct 15 before Cloudflare Connect for the hallway track before the hallway track
👉 luma.com/k72rpi3a
fun fact we built our birthday week site to be agent friendly
so if you're like me and can't keep up with all of the constant launches point your clanker of choice at it and ask it what to ship next
cloudflare.com/birthday-week…
