CDN, DNS, WAF, Zero Trust gateway.
Cloudflare announced measures on October 27, 2026, against serious PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. The company shipped client updates, deployed WAF mitigations, and launched a limited-time PHP Capture the Flag security challenge to test bypasses. WAF protections are available across all Cloudflare plans, including Free.
Security researchers disclosed an attack chain targeting Cloudflare's Image Transformations service that combines XML serialization flaws in svg-hush sanitizer, Chromium cache behavior, and redirect bypasses to achieve same-origin XSS. The vulnerability bypasses both SVG sanitization and Content Security Policy, enabling malicious JavaScript execution on affected websites. Exploitation requires specific service configurations and browser navigation conditions. No active exploitation in the wild confirmed; no CVE assigned yet.
Cloudflare released emergency WAF rules on October 25, 2026, to protect against CVE-2026-111497, a critical Node.js Brotli vulnerability. Two new managed rules detect requests with Brotli encoding and traffic to Next.js image optimization endpoints, defaulting to logging rather than blocking to avoid false positives. Organizations should review rule actions and matching traffic before enabling enforcement.
Threat actors have abused over 20,000 Cloudflare Pages domains since April 2026 to host a tech support scam campaign. The operation, linked to the Hotejka affiliate program, displays fake Microsoft security alerts and directs victims to call scam centers, with the goal of obtaining remote access via legitimate remote desktop tools. Infoblox research attributes the infrastructure to multiple affiliates and estimates the campaign dates back to at least 2017, with approximately 300 new domains announced daily via Telegram.
Hackers compromised over 100 websites and deployed malicious JavaScript that displays fake Cloudflare verification pages to distribute LUNEXSTEALER malware. The campaign, tracked by CERT-UA as UAC-0277 and identified in September 2026, exploits users' trust in Cloudflare security checks. The malware steals browser passwords, authentication tokens, cryptocurrency wallet data, and system information, and supports remote command execution. Attackers abused the legitimate Cloudflare brand to increase effectiveness of social engineering.
Cloudflare patched a vulnerability in its Containers and Sandboxes platforms that could allow one customer to recover residual disk data from another tenant on the same physical host. The flaw stemmed from the skip_block_zeroing option in dm-thin provisioning failing to clear physical blocks before recycling them for new workloads. Cloudflare found no evidence of malicious exploitation and remediated the issue by disabling the problematic setting, retiring existing container disks, and clearing image caches.
External security researchers at Accomplish identified a cross-tenant data exposure vulnerability in Cloudflare Containers that could allow residual disk data from previous workloads to be exposed to subsequent container instances. Cloudflare has addressed and remediated the issue.
Threat actors in the TerminalFix campaign are using fake Cloudflare verification prompts to trick users into executing malicious payloads. The campaign deploys Python-based reverse tunnels via Dynamic Link Library (DLL) sideloading, granting attackers persistent proxy access into internal networks. This represents a malicious campaign targeting organizations by impersonating Cloudflare's identity and verification systems.
Cloudflare published research on August 19, 2026 demonstrating a Spectre-class side-channel attack against Cloudflare Workers capable of stealing JWT authentication tokens at 12 bits per second—360 times faster than prior techniques. The attack exploits speculative execution in V8 JavaScript engine and uses WebSocket keep-alive messages within Durable Objects to evade behavioral detection. Cloudflare confirmed no evidence of real-world exploitation and stated that three layers of mitigation are already deployed across production infrastructure.
Security researchers disclosed 'GhostJacking,' a novel attack class exploiting Cloudflare's WAF logs to manipulate AI agents. Attackers inject malicious instructions into blocked-request logs that agents misinterpret as operational guidance. Testing showed 9 of 10 successful attempts to convince agents to alter DNS settings under Cloudflare-recommended configurations. The attack leverages legitimate agent permissions and approved tools, bypassing traditional endpoint and WAF detection.
Cloudflare's repositories were among 300+ high-impact open-source projects identified as vulnerable to Cordyceps, a CI/CD attack pattern disclosed in June 2026 by Novee Security. The weakness allows attackers with a free GitHub account to exploit malicious pull requests targeting pull_request_target and workflow_run triggers, potentially achieving code execution and access to repository secrets. Affected projects include those by Microsoft, Google, Apache, and the Python Software Foundation; all pipelines passed security checks despite exposure.
An HTTP/2 vulnerability dubbed 'HTTP/2 Bomb' affects Cloudflare and other server platforms including NGINX, Apache, IIS, and Envoy. The flaw exploits HPACK header compression and HTTP/2 flow control mechanisms, allowing a single client to consume up to 32GB of server memory in approximately 20 seconds, causing denial-of-service conditions and server outages.
Cloudflare disclosed results from Project Glasswing, an internal exercise in which its security team ran Anthropic's unreleased Claude Mythos Preview model against more than fifty of its production repositories, including runtimes, edge data paths and protocol stacks. The reported findings include 595 crashes and ten documented working control-flow hijacks, with the model chaining low-severity primitives into functional exploit chains and surfacing memory-safety and command-injection issues in Cloudflare code. Anthropic rated Mythos at or near its ASL-3 cyber-capability threshold and is keeping the model under restricted release. Cloudflare's CISO framed the exercise as evidence that AI-assisted vulnerability discovery is now operationally relevant against critical infrastructure code, and warned that the same capabilities will be available to attackers. No active exploitation has been reported, and Cloudflare has not published specific CVEs tied to the findings.
Cloudflare published a response detailing how it assessed and mitigated the 'Copy Fail' Linux kernel local privilege escalation vulnerability (CVE-2026-31431), publicly disclosed on April 29, 2026. Cloudflare's Security and Engineering teams reviewed the exploit technique, evaluated exposure across its infrastructure, and validated that existing behavioral detections could identify the exploit pattern. The post describes mitigations applied to protect Cloudflare's fleet from local privilege escalation via the kernel flaw. No active exploitation against Cloudflare was reported, and the issue is a kernel-level LPE rather than a remote-facing service vulnerability. Other items in the source set concern unrelated vendors (Ivanti EPMM, Palo Alto PAN-OS) and are not relevant to Cloudflare.