Your protection rule, before the vendor ships one.
Upgrading means downtime, a reboot, and a change window that is a fortnight away. hotpatch watches GitLab, Jenkins, JumpServer, Terraform and the rest of your self-hosted infrastructure, and when a new critical lands it writes the rule into the WAF you already run — nothing restarts and nothing stops. The vendor patch goes on at the window, and the rule retires itself.
Not a generic signature to be translated later — the native expression for the engine that will run it. This one matches the header the Next.js middleware bypass rides on, not the path it happens to hit.
# Shield candidate — authentication bypass, reachable without credentials. # Emitted in observe. Promotion to block is a separate, human decision. (http.request.uri.path contains "/api/" and http.request.method eq "POST" and any(http.request.headers["x-middleware-subrequest"][*] ne ""))
Severity alone is the wrong gate. Filter the whole CVE feed to critical and roughly 31 a day survive — but in a recent week 88% of those were one vendor's batch disclosure for an enterprise UNIX that no WAF and no EDR agent can reach. So the gate is the software itself: self-hosted, HTTP console, catastrophic when it falls.
A rule that goes straight to block is an outage waiting for the first legitimate request that looks like the exploit. Each stage has to earn the next one, and every step is reversible.
Shadow-evaluated at the edge against live traffic. Nothing is dropped, so a false positive arrives as a data point rather than as an incident.
Narrowed to a slice. The near-miss corpus has to come back clean — a rule that matches a legitimate request does not move forward.
Compiled into your WAF, by a person, after the window. The receipt keeps the pre-image, so one call puts it back.
A virtual patch that quietly does nothing is worse than none, because someone stops chasing the real fix. These get a ticket and a stated reason, never an expression.
A WAF never sees it. The honest output is a livepatch partner ticket — Canonical, KernelCare, Ksplice — or the change window.
The VPN concentrator or the firewall is itself the edge. There is nothing of yours in front of it to carry a rule.
The malicious request is shaped like a legitimate one. Any rule wide enough to catch it is wide enough to break the application.
This is the other half of the claim above. Managed rulesets cover the headline CVEs in mainstream frameworks, free and within hours — we do not race them there, we say so and link theirs. Where we are genuinely first is the software they do not ship rules for at all: JumpServer, KubeSphere, Nacos, Gitea and the rest of the self-hosted estate.
A day with nothing to shield still publishes what was read and why nothing cleared the bar. Over a year that record is worth more than any single rule, and it is the part a competitor cannot copy in a weekend.
// sources: NVD · OSV · GitHub Advisories · vendor advisories