今天早些时候,Railway 检测到涉及存储客户环境变量的系统存在异常活动。经过进一步调查,我们迄今的调查结果表明,未经授权的第三方可能已访问加密的环境变量,并且对其中一部分获取了解密后的内容。环境变量可能包含诸如 API 密钥或数据库和注册表凭据等机密信息。
An urgent notice from the Railway team
blog.railway.com/p/security-…
真热闹,Node JS 也要跟进
nodejs.org/en/blog/vulnerabi…
还得是 CF,省心。PHP 的这个0day 漏洞在 CF已经得到防护,所有用户生效,包括免费用户。
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.







