Re:Cloudflare Zero-Day: Accessing Any Host Globally
by cowsandmilk on Tuesday January 20, 2026 @06:32PM
(#46699146)
All their examples rely on having poorly configured origins. At least the PHP and Tomcat ones might be blocked by a WAF, but the Next.js one would rely on the WAF blocking responses that included secrets (which I’m not sure they do).
[ Parent
| on HN ]
Re:Cloudflare Zero-Day: Accessing Any Host Globally
by nightpool on Tuesday January 20, 2026 @06:38PM
(#46699200)
I think the idea for the NextJS example was that there might be some configuration variables that are not sensitive for internal / staff users, but would be problematic if exposed externally—basically, relying on Cloudflare's WAF as a "zero trust" endpoint solution, like Google IAP.
I'm not sure how realistic this is in practice. Does anyone actually configure Cloudflare WAF this way? (As opposed to, e.g., Cloudflare's dedicated zero-trust networking product, which I think works completely differently?)