• secure.phabricator.com does not support export-grade (weak) ciphers, and is safe from the brunt of this attack.
• nlb*.phacility.com is terminated by the notification server, which does not support export-grade (weak) ciphers, and is safe from the brunt of this attack.
• *.phacility.com is terminated by ELBs, which do not support weak ciphers as configured, but do use a common 1024-bit DH group. This means connections could theoretically be compromised by state-level actors. I think we can't address this directly (we can configure cipher suites, but not the DH group). I haven't found AWS issuing any guidance on it yet. I would expect them to remedy the issue or provide guidance on it in the next few days; if not, we can evaluate running software loadbalancers instead of ELBs (this is a fair amount of work, but we already run software LBs on the vault tier and terminate our own SSL on the nlb tier).

AWS has released a new LB policy (it looks like my understanding about the relationship between ciphersuites and DH groups above wasn't quite accurate):

https://forums.aws.amazon.com/ann.jspa?annID=3061

I'll switch our ELBs to use this policy when I perform maintenance this weekend.