Hi all,
We've just landed a patch to the master branch of CentralAuth[0] that helps avoid timing attacks with token comparisons. The Phabricator task is T125290[1].
If you are are using CentralAuth (which is probably not many of you), please update your installations with this patch.
-Chad
[0] https://gerrit.wikimedia.org/r/#/c/284237/ [1] https://phabricator.wikimedia.org/T125290