CyberWatch Newsroom Live Intel

Moderate Cloudflare Security

2026-10-26 Cloudflare Security

Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang

On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic , to a tenant isolation issue affecting the GLM-5.3 Workers AI model ( @cf/zai-org/glm-5.3 ) starting on August 27, 2026. We have remediated the issue, and we restored the model on September 9. We have confirmed that no other model hosted on Workers AI was affected. Betwe…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-10-22 Cloudflare Security

Localizing compliance at scale: achieving South Korea’s ISMS certification

For ten days, auditors appointed by the Korea Internet & Security Agency (KISA) sat together with us and worked through 80 controls. That is what it took for a company headquartered in the United States, operating a global network serving Korean users, to be certified in South Korea. Cloudflare has now obtained South Korea's Information Security Management S…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-10-21 Cloudflare Security

Introducing full transaction detection for Cloudflare WAF

Today, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules. Full transaction detections evaluate each HTTP request alongside its response to identify evidence of exploitation. It helps answer both "Does this request look malicious?" and "What happened when the application handled …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Critical CVE-2026-115560 Cloudflare Security

2026-10-21 Cloudflare Security

Cloudflare deploys protections against php2shell vulnerability

Update - On October 23, the PHP project published an informational advisory for a related vulnerability, CVE-2026-115560, in PHP's session upload progress feature. It affects fully patched PHP releases, including 8.5.12, and will be fixed in PHP's next regular release. All Cloudflare WAF customers are protected against known exploit attempts if their site us…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-10-20 Cloudflare Security

8 eMudhra certificates are compromised. Here's what you need to know

On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers, operating systems, and also within Cloudflare. Because the keys themselves are weak, an attacker can create a forged certificate for any domain…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Critical CVE-2026-88771 Cloudflare Security

2026-10-19 Cloudflare Security

Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities

The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. Indeed, the disclosures included an actively exploited flaw that allowed attackers to execute commands on affected gateways without signing in. As with any em…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-10-16 Cloudflare Security

Continuous accountability for Verified bots

A driver’s license tells you who someone is and that they passed a driving test, not whether they’ll drive responsibly in the future. The same is true for bots: verifying who operates it creates accountability, but trust depends on what it does next. A known bot can still ignore website preferences, overwhelm origins, or evade controls. It’s not always malic…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-10-07 Cloudflare Security

Building an evidence-grounded agentic security operations harness on Cloudflare

Security alerts rarely arrive one at a time. A single alert can cause a spike across the environment, requiring a human analyst to decide which alerts are related and what they mean. When multiple arrive at the same time, it can quickly overwhelm even a seasoned security analyst. Enter the alert paradox. Now, our built-in, multi-AI-agent security operations …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-10-02 Cloudflare Security

Follow the thread: a new dashboard to investigate account abuse

Traditionally, preventing online fraud relied on point-in-time proof of identity: enter the correct password, complete a biometric verification, or pass a liveness check, and gain access. To defeat these controls, fraudsters had to steal credentials and other identity evidence from a real user, which was difficult to execute and scale. Today, widespread acce…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-10-02 Cloudflare Security

Protected Quick Tunnels: simple accountless authentication for your next dev project

We launched Quick Tunnels in 2021 to give developers an easy way to share their latest service, application, or project running in their local development environment. A lot has changed since then, but the core use case remains the same. Your coding agent has just finished the feature. The dev server is up on localhost:5173 , and before you ask, the agent of…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-10-01 Cloudflare Security

One year later: Sovereign AI and the fight for choice

It's Birthday Week, when we traditionally ship presents to the Internet. This year, two of them come from Europe: EuroLLM, which covers all 24 official EU languages, and Apertus, Switzerland's fully open model, trained on more than 1,500 languages. Both were built by public universities and research institutions. Both are coming to Workers AI, and you can re…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-09-29 Cloudflare Security

Using AI to chart a course for our post-quantum migration

As laboratories around the world race to build out a cryptographically relevant quantum computer , we at Cloudflare are racing towards a 2029 target deadline for full post-quantum readiness . While we’ve already transitioned many of our products to post-quantum encryption, we still have work to do to support post-quantum authentication and achieve full post-…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-09-29 Cloudflare Security

Building a certificate authority for the whole Internet

Twelve years ago, during Birthday Week 2014, we turned on Universal SSL and nearly doubled the number of encrypted sites on the web overnight, giving free TLS to every site behind Cloudflare, including the ones that never paid us a cent. Encryption stopped being an expensive, time-intensive undertaking and instead became the default. For Birthday Week this y…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Critical Cloudflare Security

2026-09-29 Cloudflare Security

Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account

Organizations can now scale threat intelligence expertise the way they scale infrastructure. Threat intelligence analysts and network defenders have long automated the ingestion of structured threat feeds to help enrich their SIEM or WAF. The harder work has always been unstructured reporting: turning a research post into indicators your tools can use, witho…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Critical Cloudflare Security

2026-09-29 Cloudflare Security

Building a post-quantum certificate authority with Merkle Tree Certificates

When you type in an address into a browser, how do you know you’re connecting to the right website? The Web Public Key Infrastructure (Web PKI) is the complex and distributed ecosystem of policies, protocols, and infrastructure operators that helps you trust that you’re not being misdirected to an incorrect or malicious website. In the past few decades, this…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Critical Cloudflare Security

2026-09-29 Cloudflare Security

Enforce positive security with Cloudflare Application Profiles

Today, we are launching Application Profiles, a seamless way to enforce a positive security policy. By analyzing the structure and format of HTTP requests and identifying deviations, Cloudflare can help you significantly reduce the attack surface area. Every customer we speak to wants to know how we can protect them from attacks that use frontier AI models. …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-09-29 Cloudflare Security

Is your domain using post-quantum encryption? Now you can see for yourself

Today, we are introducing additional post-quantum (PQ) cryptography visibility tools into Cloudflare's Application Security and Logs products. You can now inspect and graph the adoption of post-quantum TLS 1.3 encryption for live traffic from directly within Logpush , Log Explorer , and the HTTP Traffic Analytics dashboard. By surfacing the key exchange algo…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-09-25 Cloudflare Security

Agents can now set up your website’s security with Turnstile Spin

In 2023, Cloudflare declared itself free from CAPTCHAs with the launch of Turnstile, our privacy-first client-side challenge. Turnstile is free to use, works on any site (no need to proxy traffic through Cloudflare), and never asks a visitor to solve a puzzle. Now, we are launching Turnstile Spin, an agent-mediated end-to-end implementation of Turnstile. Ini…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Important Cloudflare Security

2026-09-24 Cloudflare Security

How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

On September 4, 2026, Oren Yomtov, a security researcher from Accomplish , responsibly reported a vulnerability affecting Cloudflare Containers and Cloudflare Sandboxes (which is built on Containers), through Cloudflare’s bug bounty program . Cloudflare has fully remediated the vulnerability, and we have no evidence that customer data has been compromised. T…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-09-15 Cloudflare Security

Give every teammate and agent the right level of access to your Workers

As more teams — and now agents — build applications on Cloudflare's Developer Platform, having the right access controls is crucial to allow you to ship safely. After all, the last thing you want is for an agent to make a change in production, just because it was granted more access than it needs. Now, you can give a teammate or agent access to a specific Wo…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Moderate Cloudflare Security

2026-09-15 Cloudflare Security

Have it both ways: stay discoverable in search while disallowing AI training

Without proper controls, website owners have long faced a difficult tradeoff: allow your content to be used for AI training, or risk losing discoverability in search. That tradeoff exists because some of the largest organizations on the Internet use mixed-use crawlers: a single crawler serving both search and AI training. Refuse one, and you refuse the other…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory