Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities

What it is

Zero Wire is a public vulnerability briefing feed in the security section of Cloudflare Radar. It covers critical CVEs in Internet-facing software: web applications, the runtimes and libraries they depend on, and exposed services. It is not a catalog of every CVE and is meant to sit alongside vendor advisories and vulnerability databases. The page gives no CVE identifiers and no commands.

How to read a briefing

The homepage splits entries into "Needs attention" (known exploitation or developing guidance) and "Reference" (guidance has stabilized). A move to "Reference" does not mean every affected system is patched. Each card shows a status and a last-checked date. Known exploitation, an ongoing investigation and an available vendor fix are separate facts, and the page says to read them against the evidence, not as a verdict on your own environment. Searching works by CVE or issue name, and one briefing can group several related CVEs. An update chronology records new advisories and changes to guidance.

The php2shell example

The page describes php2shell as flaws in the PHP runtime. For sites running WordPress or Magento, updating application code or a plugin does not fix the runtime. The suggested questions are:

• Which PHP runtime is actually running?
• Has the vendor's fix been applied?
• Who owns the update?

Hosting providers may need to confirm versions. Applicability and remediation details are in the linked PHP security guidance.

What the evidence does and does not show

The php2shell chart plots HTTP requests matching Cloudflare WAF managed rules over time. Cloudflare says this shows threat actor interest, not a count of compromised systems or successful exploits. Equally, no observed attempts on Cloudflare's network does not show exploitation is absent elsewhere. Vendor advisories establish affected versions and fixes. Exploitation sources such as the CISA Known Exploited Vulnerabilities catalog establish attacker activity.

Caveats

• The AI agent prompt requests a read-only assessment of deployed software, vendor fixes, exposure and compensating controls, with per-asset evidence and unknowns. Copying it does not scan or change anything. The page does not reproduce the prompt text.
• Where a WAF rule exists, the briefing links to dashboard configuration for paid and free plans. The link does not enable a rule or verify deployment.
• A WAF rule is a compensating control for the traffic it covers. It cannot undo actions already taken at the origin and does not replace the vendor fix.
• A Cloudflare protection is not required for an issue to be included.