- Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities
Zero Wire is a public vulnerability intelligence feed in the security section of Cloudflare Radar. Each briefing covers one critical CVE in Internet-facing software: who should investigate, what to do, evidence links such as the CISA Known Exploited Vulnerabilities catalog, and WAF context. Briefings include a prompt for an AI agent to run a read-only exposure assessment; the first example covers php2shell.
blog.cloudflare.comarticlePublished and added 3 Nov 2026🛡️ Security 
In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data LeakSecurityWeek's weekly roundup of 30 October 2026 covers CVE-2026-97631, a 16-year-old buffer overflow in TianoCore EDK II that affects PXE network boot on most servers. It also covers a Cloudflare Workers AI cross-tenant leak caused by an SGLang bug, Anthropic's dispute with Cathedral over a bug bounty intrusion, and fake AI bots probing for secrets. Other items include AI-assisted ransomware (Gold Ogre, Aur0ra), the NIK C2 framework, and North Korean IT worker sanctions.
securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security
Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giantsCloudflare DDoS Threat Report 2026 Q3 covers July to September 2026, with 18.2 million network-layer attacks and 14.4 trillion HTTP DDoS requests mitigated. Short attacks under 10 minutes and 1 Gbps rose 208%, while attacks above 1 Tbps fell from 805 to 251 after law enforcement took down the Aisuru, KimWolf, JackSkid and Mossad botnets. CLDAP floods collapsed 99.5% as DNS amplification rose 215%. The United States became the most-attacked country again.
blog.cloudflare.comarticlePublished and added 29 Oct 2026🛡️ Security
What took the Internet offline in Q3 2026Cloudflare's Q3 2026 review of the 49 Internet disruptions seen by Cloudflare Radar between July and September 2026. Government-directed shutdowns led with 19 (18 exam shutdowns in Iraq), followed by 14 power outages and 5 natural disasters. It gives traffic-drop figures and durations for Cuba, Honduras, Ukraine, Guam, Colombia, Ethiopia's Tigray region and others, including a Honduran interconnection facility power failure that cut HTTP traffic 63%.
blog.cloudflare.comarticleAdded 29 Oct 2026, published 27 Oct 2026🛡️ Security
Introducing the Cloudflare PHP Capture the Flag challengeThe Cloudflare PHP Capture the Flag challenge is a HackerOne bug bounty CTF. Researchers must bypass Cloudflare WAF rules protecting CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) on stock PHP 8.5.11 with Apache mod_php in a Cloudflare Container, get RCE, and read /flag. The post lists scope (POST to /php/* only), report requirements and duplicate rules, which count only materially distinct WAF bypasses.
blog.cloudflare.comarticleAdded 29 Oct 2026, published 27 Oct 2026🛡️ Security
Keystone to destroy almost 19,000 wallets after device key leakKeystone confirmed a breach of Shopify customer records (about 26,000 plus 13,000 incomplete orders), in which the attacker also took the WebAuth key used to verify device authenticity. It will destroy almost 19,000 unshipped wallets and issue a new key. Foundation Passport phishing emails (over 20,000) came from compromised Cloudflare API keys, and old WooCommerce database copies kept personal data past the stated 60-day deletion.
protos.comarticlePublished and added 26 Oct 2026🛡️ Security
953 Online Stores Infected in Long-Lasting Malware CampaignA SecurityWeek report on a JavaScript loader campaign, tracked by Sansec since July 2025, that has infected 953 online stores, mostly Magento. The actor rotated through five loader domains, the latest being deepveindrilling.com (October 2026) behind Cloudflare, with visitor fingerprinting to hide the payload. Entry points include PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236), and a fully patched store was also infected. Sansec lists cleanup steps.
securityweek.comarticlePublished and added 26 Oct 2026🛡️ Security
Weekly Research Brief: PHP Vulnerability; Objections to OKX-ICE’s Stock Tokenization; Solana Alpenglow ShipsGalaxy Research's weekly brief includes a section on PHP2Shell, two decade-old PHP remote code execution bugs affecting versions back to 5.4, patched in an emergency release. It reports an Amazon honeypot exploit attempt four days before disclosure, thousands of attempts in the 10 hours before the patch per Cloudflare's Matthew Prince, and NSA and FBI offline advice. The author argues the bugs were found with GPT-5.6 Sol and that defence must become agentic. It also lists the week's other incidents, including a CVSS 10.0 GitLab bug and eMudhra's guessable private keys.
galaxy.comarticleAdded 24 Oct 2026🛡️ Security
Bringing post-quantum cryptography to geographically fenced key managementCloudflare's post-quantum GeoKey Manager, in closed beta for the Data Localization Suite, wraps customer private keys so only edge servers in an allowed region can unwrap them. It uses regional 256-bit root keys, derived application-specific HPKE key pairs (RFC 9180) with hybrid ML-KEM-768 and X25519, TPM-backed server authorization, kernel keyring storage, fail-closed checks, and soft and hard rotation. General availability is planned for Q1 2027.
blog.cloudflare.comarticleAdded 29 Oct 2026, published 23 Oct 2026🛡️ Security
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016Prince of Persia (Infy), an Iranian state-sponsored APT active for nearly 20 years, hosted a Tornado second-stage C&C server in the US in July 2026, the first US hosting since 2016, according to Semperis researcher Tomer Bar. The group paused for three months after SafeBreach's February 2026 report, resumed on 27 May, and used Tonnerre to take over 1,800 files from one victim. The server sat on Namecheap shared hosting; on 24 August the group began a replacement behind Cloudflare. Semperis shared IoCs and advises watching for suspicious Telegram traffic.
securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security
Localizing compliance at scale: achieving South Korea’s ISMS certificationCloudflare's account of obtaining South Korea's ISMS-P certification after a ten-day KISA audit of 80 controls and a preparation period of about a year and a half. It explains that the certificate covers a service delivery boundary rather than a product list, that auditors required readable data flow diagrams, and how Korean sign-up uses itemized consent with social login removed.
blog.cloudflare.comarticleAdded 29 Oct 2026, published 22 Oct 2026🛡️ Security
PHP2Shell Exploitation Started Days Before PatchesPHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical PHP remote code execution flaws. Amazon saw the first exploitation on 17 October 2026, four days before patches on 21 October, and Cloudflare logged millions of attempts after disclosure. Censys, VulnCheck and VirusTotal counted over 1 million unpatched PHP hosts, and CISA urged updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
securityweek.comarticlePublished and added 22 Oct 2026🛡️ Security- [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
This AINews issue (20 to 21 October 2026) leads with PHP2Shell, two PHP-engine memory-corruption bugs (CVE-2026-109618 and CVE-2026-109619). Calif researchers found them with GPT-5.6 Sol under OpenAI's Patch the Planet, and Wiz reportedly found them independently with Gemini 4 Argon. It reconstructs the two-month coordinated response, Cloudflare WAF stopgaps and NSA guidance, and the dispute over vetted researcher access to models. Only the first 40,000 of 114,281 characters were reviewed.
latent.spacearticleAdded 23 Oct 2026, published 22 Oct 2026🧠 AI 
[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 monthsAINews issue of 20-21 October 2026 whose top story reconstructs PHP2Shell (CVE-2026-109618, CVE-2026-109619), two PHP-engine memory-corruption bugs with reported pre-auth RCE against WordPress, Drupal and Joomla. It covers the two-month coordinated disclosure, independent discovery by Calif/OpenAI (GPT-5.6 Sol) and Wiz, Cloudflare WAF stopgaps and NSA guidance. It flags missing primary sources: fixed versions, CVSS and leak details.
latent.spacearticlePublished and added 22 Oct 2026🛡️ Security
[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 monthsAINews issue of 20-21 October 2026 whose top story reconstructs PHP2Shell, two PHP-engine memory-corruption flaws (CVE-2026-109618 and CVE-2026-109619) with reported pre-auth RCE against WordPress, Drupal and Joomla. It covers the two-month coordinated response, separate discovery by Calif/OpenAI (GPT-5.6 Sol) and Wiz (Gemini 4 Argon), Cloudflare's WAF stopgap and NSA guidance. It lists open gaps: fixed versions, leak details, exploitation versus scanning.
latent.spacearticleAdded 23 Oct 2026, published 22 Oct 2026🛡️ Security
PHP critical vulnerabilities rated 9.2 as attacks emerge and sites go offlineReport on two critical PHP remote code execution vulnerabilities, rated 9.2 out of 10, disclosed on 20 October 2026 and patched on 21 October. Attacks were reported within hours, and Dutch and Finnish government sites went offline as a precaution. The EU CERT and the UK NCSC advise patching or isolating systems. Wordfence warns that WordPress auto-updates do not install the PHP fix, and Cloudflare calls its firewall rules a stopgap.
en.cryptonomist.charticlePublished and added 21 Oct 2026🛡️ Security
Remotely exploitable PHP bug found on 70% of world’s websitesPHP2Shell is a pair of unauthenticated remote code execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, found by Calif using OpenAI's GPT-5.6 Sol during an OpenAI-funded audit. Fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backports for 7.4-8.1 rolling out, while PHP 7 and 5 sites stay unpatched. Wiz confirmed the flaws; Cloudflare applied a stopgap and Finnish and Dutch government sites went offline.
protos.comarticlePublished and added 21 Oct 2026🛡️ Security
PHP2Shell Patches Land as First Exploitation Attempts Hit SensorsPHP2Shell is a pair of critical PHP core flaws, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), both CVSS 9.2 and giving unauthenticated RCE, confirmed on Apache with mod_php. Fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backports for 7.4 to 8.1. Exploitation attempts were reported by watchTowr, Hadrian, Patchstack, Cloudflare and Vega after a leak moved disclosure up from 22 October 2026 to one day earlier.
securityweek.comarticlePublished and added 21 Oct 2026🛡️ Security
PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking OutDecrypt reports on CVE-2026-109618 and CVE-2026-109619, two PHP flaws rated CVSSv4 9.2 that allow unauthenticated remote code execution. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped on 21 October 2026 after an early leak and Cloudflare-observed attacks. The article covers the memory-handling root causes, mod_php and upload-progress exposure, government site shutdowns, affected version range (PHP 5.4 and later per Sansec), and patch guidance.
decrypt.coarticlePublished and added 21 Oct 2026🛡️ Security
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites OfflinePHP2Shell is a pair of memory-safety flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Unauthenticated requests can reach code execution, most readily through Apache mod_php, and Cloudflare reports active attack traffic. The post covers W3Techs data showing about 48.5% of PHP sites on end-of-life branches, the leak timeline, and the need to patch the runtime itself.
socket.devarticlePublished and added 21 Oct 2026🛡️ Security
Cloudflare deploys protections against php2shell vulnerabilityCloudflare describes its WAF protections for php2shell (CVE-2026-109618 and CVE-2026-109619), two PHP runtime memory-handling flaws affecting PHP 5.4 and later that can cause denial of service, remote code execution and data exposure. Rules shipped 21 October 2026, about 9 hours before disclosure, using a new "full transaction detection" that matches request and origin response together. It lists ruleset IDs and says patching PHP is still required.
blog.cloudflare.comarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security
Introducing full transaction detection for Cloudflare WAFCloudflare announces full transaction detection and response-phase rules for its WAF. Detections evaluate an HTTP request together with the origin's response, so exploitation can be confirmed (for example, path traversal returning a config file) and the response replaced with a 403 block page. Covers managed and custom rules, the limit of three custom response rules, no response-body matching yet, and a first managed rule for php2shell. Available on all plans, including Free.
blog.cloudflare.comarticleAdded 29 Oct 2026, published 21 Oct 2026🛡️ Security
How Commerce.com and Cloudflare are getting storefronts ready for AI agentsCloudflare and Commerce.com describe enabling WebMCP, Google's proposed browser standard for exposing structured tools to AI agents, across almost 100,000 storefronts. Cloudflare injects a bridge script at the edge that proxies tools from Commerce.com's backend MCP server. Per-merchant opt-out uses Configuration Rules and custom hostname metadata, and a configurable MCP URL (/api/mcp) was added.
blog.cloudflare.comarticleAdded 29 Oct 2026, published 21 Oct 2026🧠 AI
Mastercard’s agent payments enter early access after nine-payment demoMastercard's Agent Pay for Machines lets AI agents buy digital services with signed payment vouchers inside a business-set task, permission and budget. On 20 October 2026 it opened Early Access with buyer and seller APIs, a toolkit, sandbox and docs. In the Hype demo at Cloudflare Connect, an agent made nine payments to two providers over the x402 protocol. The system is still at pilot stage.
en.cryptonomist.charticlePublished and added 20 Oct 2026🧠 AI- Mastercard opens early access to AI agent payments following pilots with Coinbase, Base and Cloudflare
Mastercard Agent Pay for Machines is a set of buyer- and seller-side APIs, a toolkit and a sandbox, opened to early-access developers in October 2026. Pilots involved Cloudflare, Ant International, BVNK, AIsa, Base and Coinbase. In a Cloudflare Connect demo, an AI agent made nine payments over x402, settled onchain on Base, with BVNK as agent wallet. It is not yet commercially available.
theblock.coarticlePublished and added 20 Oct 2026🧠 AI 
Introducing Clairic, a new System One class of extraction modelsClairic is Cloudflare's preview System One extraction model, hosted on Workers AI as @cf/cloudflare/clairic, with open weights planned. It reads text or images in one forward pass and returns typed values with spans, confidence, p_null, 80% intervals for estimates and forecasts. A claim-handling cascade with Clef and GLM-5.3 ran in 19.3 seconds against 61.7 for an all-LLM version.
blog.cloudflare.comarticleAdded 29 Oct 2026, published 19 Oct 2026🧠 AI
Beyond the patch: Protecting your NetScaler gateway against future vulnerabilitiesCloudflare's guidance on protecting Citrix NetScaler Gateway after the actively exploited CVE-2026-88771 (unauthenticated command execution) and CVE-2026-88772 (DTLS). It recommends putting Zero Trust access policies in front of the login page, locking the origin down with Tunnel, dedicated egress IPs, authenticated origin pulls or Access JWT validation, and adding WAF inspection. It ends with a four-step test list to confirm the boundary holds.
blog.cloudflare.comarticleAdded 29 Oct 2026, published 19 Oct 2026🛡️ Security
Proving HumanityGalaxy research report arguing that CAPTCHAs and behavioral bot detection (reCAPTCHAv3, Cloudflare Turnstile) are failing as AI agents reproduce human conduct, for example ChatGPT Agent clicking through Turnstile's checkbox. It shows that Web Bot Auth signatures and Google's AP2 mandates identify the platform or account key but not a distinct person. It proposes reframing "proving humanity" as ensuring every agent traces to one person counted once, covering Sybil, one-person-one-share, accountability and public-count harms. It lays out requirements for a proof-of-personhood credential: strong, private, portable, delegable and accessible. It deliberately does not evaluate specific projects.
galaxy.comarticleAdded 16 Oct 2026🛡️ Security- Proving Humanity
Galaxy Research essay arguing that as AI agents become the main way people use the web, the key question shifts from "is this a machine?" to "is a distinct real person behind it, counted once?". It traces CAPTCHA history (distorted text, image puzzles, reCAPTCHAv3 and Turnstile behavioral scoring) and notes ChatGPT Agent passing Cloudflare's checkbox. It reviews Web Bot Auth signatures and Google's AP2 payment mandates, showing both stop at the platform or key and never establish a person. It then covers harms (one-person-one-share abuse, no one to answer for an agent, distorted public counts, collapsing confidence, scaled deception, broken ad economics) and lists the properties a privacy-preserving proof-of-personhood credential needs: strong, private, portable, delegable, accessible.
galaxy.comarticleAdded 16 Oct 2026🧠 AI 
A fully programmable secure web gatewayCloudflare announces a programmable secure web gateway: a Forward action (public beta) that routes matched HTTP traffic to a Worker acting as inline middleware, and Custom Functions that return typed values used as policy selectors. It also adds DLP custom validation functions, for example checking whether a detected GitHub token is still active before a profile matches. Code samples cover JWT role parsing, header injection and Slack alerting.
blog.cloudflare.comarticleAdded 29 Oct 2026, published 15 Oct 2026🛡️ Security
Showing 30 of 58
Show more