Stopping Drupal’s SA-CORE-2019-003 Vulnerability

What this post added

This post details Cloudflare's rapid response to the Drupal SA-CORE-2019-003 vulnerability. It describes the process of analyzing the Drupal patch to identify the deserialization exploit, developing WAF rules to mitigate it, and deploying these rules in simulate and then drop modes. The post highlights the speed of detection and mitigation, blocking attacks within 48 hours of the vulnerability announcement, and showcases specific exploit payloads and their impact.