Celso Martinho

👶 From when Mosaic took over Gopher
🏢 VP of Engineering @cloudflare
🇵🇹 Lisbon, Portugal

[Celso Martinho @celso]

One more to keep track of 📈

https://t.co/hj47fdaxPZ

[Matthew Prince 🌥 @eastdakota]

Pick your cofounders carefully and everything else is so much more fun!

[Matthew Prince 🌥 @eastdakota]

Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.

tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.

The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.

The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.

@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.

For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.

Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.

If you’re interested in learning more, you can read our blogs:

Vulnerable roots: https://t.co/TR77Zd01A0
PHP vulnerabilities: https://t.co/qTUK8i3Oww

[michelle @michellechen]

one thing that made this click for me — with decision models, you have to define categories and it returns probabilities that the input matches those categories.

but so much of the data we interact with is completely new to us. how can you define categories for something you've never read?

with clairic, you can extract values directly from the inputs, without any premeditated categories. the pipeline becomes clairic to extract values → clef to make decisions with those values → LLMs to take actions on those decisions. all of these models run on Workers AI.

[Cloudflare Radar @CloudflareRadar]

🚨 Google Cloud's europe-west2 (London) region has seen a sharp rise in connection failures since 06:00 UTC on Oct 20. #Internet

Follow the latest on Cloudflare Radar: https://t.co/RfdnS8yObY

[Cloudflare @Cloudflare]

Putting the final touches on Moscone West for #CloudflareConnect 2026! 🛠️🍊 From the big signs to the indoor setups, we’re getting everything ready for you. Can't wait to see you all! 👋☁️

[Celso Martinho @celso]

@elithrar I'm about the pull the trigger too, but I'm undecided between the M5 Pro and M6, what did you go for?

[Flix Muller @felix_muller_ai]

@CFchangelog Multilingual search support is a big step forward. Making AI search work naturally across more languages opens the door to a much wider range of users.

[Cloudflare Changelog @CFchangelog]

AI Search keyword search now supports Japanese, Chinese, and Korean queries via the trigram tokenizer. Set keyword_tokenizer to trigram for full natural language search support.

https://t.co/J5iLIfxPKB

[Celso Martinho @celso]

It doesn’t matter how good your 3D printer is, it will eventually require maintenance and it will be tedious.

[WorkOS @WorkOS]

Kitesurf is a browser that runs inside a @Cloudflare Worker. No Chromium, no container. @mattzcarey demoed an agent driving it live at init().

[Celso Martinho @celso]

Yes, 65 fps.

[Cloudflare @Cloudflare]

Introducing Void: an open-source SDK, CLI, and self-hosted platform for building full-stack Vite apps and deploying them to Cloudflare. https://t.co/Nb5dELuRIq

[Matthew Prince 🌥 @eastdakota]

This is a big deal to define a path toward making the future agentic Internet sustainable.

[Celso Martinho @celso]

@elithrar Take a look at https://t.co/BWLfSFyIrn

[Brendan Irvine-Broque @irvinebroque]

new tools in the cloudflare agents sdk

web_search
powered by the new Cloudflare Web Search API - use exa, linkup, or ceramic via AI Gateway
https://t.co/oQWX3nqWIp

web_fetch
with automatic markdown conversion
https://t.co/wtxRZbUJJM

works with pi-durable or any other harness

npm i agents

[Cloudflare Radar @CloudflareRadar]

The third Yandex data center hit by drones since Oct 7. Traffic from YANDEX (AS13238) was already ~35% lower after the Sasovo strike, then fell 99% vs. last week at ~00:30 UTC Oct 11, as its Vladimir site shut down, per the company.
Follow along:
https://t.co/0rbYydRfID

[michelle @michellechen]

been refreshing this page all weekend and clef just surpassed openai for 2nd place in decision model market share, so i had to document it. feel incredibly grateful and proud to be in the arena.

[Celso Martinho @celso]

@davidslv Haha, essa era épica, e foi a primeira, mas não. Esta já é outra, mais maneirinha.

[Celso Martinho @celso]

Time for some upgrades

[Cloudflare Developers @CloudflareDev]

Build the next GitHub.
Build a new way for hundreds of thousands of agents to work on changes concurrently.

Submit your project now into the competition!

https://t.co/AMRSU0D1Xx