Freelance and contract work: websites, web apps, Next.js, technical SEO and performance.
Hi Tarun! You're right - trusting the first X-Forwarded-For value without verifying how the proxy handles it can make the rate limit spoofable. The correct approach is to use the hosting platform's trusted client-IP header or derive the IP from a properly configured trusted proxy chain. Pairing IP-based limits with account or email-based limits for OTP routes adds another layer of protection. I'll clarify this in the example.
Hi Damiano Good observation! AWS reported a PHP2Shell exploitation attempt as early as October 17, four days before public disclosure. So at least some exploitation attempts were already underway before the leak. What we can't establish yet is whether the leak accelerated subsequent attacks or expanded the number of attackers involved. Cloudflare did observe attackers modifying payloads to bypass its protections, but that alone doesn't prove the leak caused the change. It highlights an important challenge with coordinated disclosure: even when the process is carefully planned, defenders can't assume the vulnerability will remain secret until patches are available.
