1 CVEs published in the last four months and 12 stories. Exploited flaws first.
| CVE | CVSS | Severity | Product | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-12523 | 7.5 | high | quiche | Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by | 89d ago |
Cloudflare has introduced new capabilities for its Stream platform, allowing developers to create custom video pipelines using Cloudflare Workers and Durable Objects. This enhancement enables serverless video processing, offering greater flexibility and control over video content workflows.
Cloudflare has confirmed that it was targeted by a nation-state attacker in November 2023, with the incident involving a highly sophisticated attempt to gain persistent access to its systems. The company disclosed that the attacker, identified as a nation-state actor, exploited a zero-day vulnerability in Atlassian Confluence Data Center and Server to breach its self-hosted Atlassian server.…
Cloudflare intends to establish itself as a public certificate authority (CA), an entity responsible for issuing the digital certificates websites utilize for traffic encryption and identity verification. The company has announced plans to issue both conventional certificates and a post-quantum variant known as Merkle Tree Certificates (MTCs), with production MTC issuance anticipated for the…
A supply-chain attack targeting Brevo, a French cloud-based marketing and customer communication platform, led to the injection of malicious code into its own websites and those of over 100,000 customers. The incident, which began on September 10, involved attackers exploiting a vulnerability in Brevo's SAML single sign-on (SSO) system.
Cloudflare has announced a new capability for its Managed Defense service, integrating OpenAI’s Daybreak models to enhance the discovery and remediation of vulnerabilities. This initiative aims to provide context-aware insights into security threats, moving beyond traditional signature-based detection to understand the broader implications of vulnerabilities within a system.
Cloudflare, the internet infrastructure and security company, has confirmed that a recent security incident involved unauthorized access to its internal Atlassian server. The company stated that the compromise was limited to its Confluence wiki, Jira bug-tracking system, and Bitbucket source code management system, which are used for internal documentation, project tracking, and code repositories.
Cloudflare has confirmed a security incident involving an unauthorized third party gaining access to an internal Atlassian server. The company stated that the attacker used stolen credentials to breach the system, which hosted its Confluence wiki, Jira bug-tracking system, and Bitbucket source code management system.
Cloudflare has introduced a new feature designed to synchronize bot preferences for AI traffic management across its network. This initiative aims to streamline how AI-driven bots interact with web services and content delivery, particularly in scenarios involving large language models (LLMs) and other generative AI applications.
Cybersecurity researchers have reportedly demonstrated a refined Spectre attack targeting Cloudflare Workers, successfully exfiltrating a JSON Web Token (JWT) from a co-located Worker. The attack achieved a data leakage rate of 12 bits per second, which is described as a significant improvement in speed over prior iterations of similar attacks.
Cloudflare has confirmed that its Workers serverless computing platform was vulnerable to a variant of the Spectre side-channel attack, specifically CVE-2023-50387, which could have allowed attackers to extract sensitive data from other customers' Workers. The vulnerability, dubbed "Rampage" by the researchers who discovered it, exploited speculative execution features in modern CPUs to leak…
Cloudflare has confirmed that it is actively detecting and mitigating traffic associated with the Model Context Protocol (MCP), a new protocol identified as being used in large-scale distributed denial-of-service (DDoS) attacks. The company's security systems are designed to identify and neutralize these attacks, which leverage a novel method of amplification.
Cloudflare has announced a new initiative to foster its open-source community, introducing a Cloudflare Ambassadors program and a Community Engineers program, alongside an additional $1 million in funding for open-source projects. This new funding brings Cloudflare's total commitment to open-source initiatives to $3.5 million.