Val Vesa

Social Media Manager @cloudflare. Christian. Father. Husband. Travel photographer.

[Cloudflare @Cloudflare]

Three days in SF, one very full Moscone West, and more conversations than we could keep count of.
#CloudflareConnect 2026 is officially in the books, and our feet would like to file a formal complaint.
Thank you for showing up, sharing what you know, and making it so easy to love our jobs this week.

[Matthew Prince 🌥 @eastdakota]

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

[Val Vesa @ValSocial]

@leostera @inababi @threepointone Thanks for helping!!

[Val Vesa @ValSocial]

Just met John Nelson, who won $25,000 in Cloudflare credits at #CloudflareConnect.
Congrats!!!
And met IRL with none other than @threepointone 🧡

[Cloudflare Developers @CloudflareDev]

We're teaming up with @usskiteam for a winter sports developer challenge ❄️

Use real competition footage to build tools for snowboard trick analysis or ski race telemetry, and compete for VIP trips to major winter sports events!

📅 Submit by Nov 2. Finalist showcase in SF on Nov 9.

https://t.co/VGmoIDge7b

[Val Vesa @ValSocial]

How do you build for an era where over half of Internet traffic isn't human? You build on a network that spans 340+ cities and 130+ countries. 🌍 Proud to see 10M+ developers trusting Cloudflare to build the next generation of fast, global apps! https://t.co/NF1i7hxARX

[Matthew Prince 🌥 @eastdakota]

Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.

tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.

The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.

The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.

@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.

For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.

Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.

If you’re interested in learning more, you can read our blogs:

Vulnerable roots: https://t.co/TR77Zd01A0
PHP vulnerabilities: https://t.co/qTUK8i3Oww

[Anwar Haneef @anwarhaneef]

AI agents will increasingly be built by the people closest to the work. But they need: 1) trusted access to the systems and 2) the ability to communicate visually.

@Cloudflare + @Canva help every team securely build agents that take action and turn ideas into polished, on-brand work.

Cloudflare is the secure foundation with an open-source AI workspace shaped around how each company operates.

Canva is the creative layer for the agentic workplace. With Canva connected, agents can help people:
- Find designs, folders and brand assets
- Create decks, docs, whiteboards, custom designs
- Generate an editable deck from a brief with Canva AI
- Remove backgrounds, turn flat images into editable designs
- Combine these capabilities into new apps and workflows

[Val Vesa @ValSocial]

@xss @Cloudflare Hey Josh, you can come and get your badge tomorrow, starting at 9 AM at Moscone West. The wallet pass is not needed.

[Dane Knecht 🦭 @dok2001]

Same offer from @Cloudflare. 100 free passes to Cloudflare Connect in SF this week for folks with cancelled GHC registrations.

Email [email protected]. First come first serve.

[Val Vesa @ValSocial]

It’s going to be a busy week, and I can’t wait! #CloudflareConnect

[Cloudflare @Cloudflare]

Putting the final touches on Moscone West for #CloudflareConnect 2026! 🛠️🍊 From the big signs to the indoor setups, we’re getting everything ready for you. Can't wait to see you all! 👋☁️

[Cloudflare @Cloudflare]

Auto-reply: I'm heading to #CloudflareConnect from Oct 19–21. For urgent matters, find me in the hallway at Moscone West.

[EmDash CMS @EmDashCMS]

Nine days after 1.2, EmDash 1.3 is out!

Every saved version now shows exactly what changed, and your live site gets the admin's editing tools.

One switch also asks AI crawlers not to train on your content.

Here's what's new.

[Cloudflare @Cloudflare]

Today, Cloudflare and @OpenAI released the first findings from their joint research pilot, demonstrating how real-time network signals can make AI search drastically smarter, fresher, and safer without overloading website infrastructure. https://t.co/ZqY2lh4tyh

[Val Vesa @ValSocial]

@wordpressdotcom https://t.co/XVpu02rPMG

[Val Vesa @ValSocial]

@natmiletic @phprunner Our commitment to our free plan is very strong, and here’s why: https://t.co/e2GmIsDIn0

[Val Vesa @ValSocial]

@natmiletic #AlwaysHappyToHelp!

[Cloudflare @Cloudflare]

While adding MySQL support to Hyperdrive, we found a subtle protocol bug when caching query results. Here is how we tracked down a 0.001% rate error and made Hyperdrive MySQL generally available. https://t.co/cpZZFlsZpr

[Val Vesa @ValSocial]

@fayazara Oh nooo! Delayed or rejected?🥺

[Val Vesa @ValSocial]

@Jilles See you Monday!