Comment by anthonyeden
18 hours ago
From what I can tell, Cloudflare has mitigated this via their WAF [0] (free and paid).
The Alpine GitLab[1] indicates the PHP versions to be released 21-10-2026 14:00:00 UTC are:
8.5.12 8.4.27 8.3.36 8.2.35
[0] https://developers.cloudflare.com/waf/change-log/changelog/
[1] https://gitlab.alpinelinux.org/groups/alpine/-/work_items?sh...
Release notes draft filenames (but not contents) are published to the mailing list: https://news-web.php.net/php.webmaster/34116
Wow, it's the first time that I see the Cloudflare-equivalent error page of Bunny.net.
That got nuked by the looks of it.
Guess the site runs on PHP..
We observed this update ourselves and suspected it to be a mitigation when it was rolled, but I can't find any definitive record that these rules are about the PHP vulnerability. Do you have more info?
https://x.com/dok2001/status/2112802620029223193
Let's be clear here: they provided a waf rule. You need to actually have it enabled to be protected.
On the free Cloudflare tier its enabled and you cannot disable it. On Paid you can disable it.
They enable this kind of rules by default and for free.
It looks like bunny have added their waf rule too for mitigation.
https://x.com/BunnyCDN/status/2112867273333485634
I have sites behind Fastly and Akamai, and I would dearly love to hear from either of them.
https://www.fastly.com/blog/fastlys-proactive-protection-cri...
I have one site on WPEngine and they haven't said anything [that I've seen]
I heard back from their technical team:
> WP Engine Security and Engineering have enabled WAF rules for all customers using GES and AN. Mitigations are currently being deployed across the rest of our infrastructure, and official patches will be applied as soon as they become available.
where is patch for alpine?
finally released