Cloudflare reports forged certificates using eMudhra’s weak keys, but no evidence of intercepted connections. Its probes suggest many clients, including 30–40% of Android WebView traffic, still accept the compromised chain; bot-heavy traffic limits certainty.
Cloudflare’s Q3 2026 report records 18.2 million mitigated network-layer DDoS attacks. Short attacks surged, attacks over 1 Tbps fell, and attackers shifted from CLDAP toward DNS amplification and other UDP floods.
Cloudflare says PHP CTF submissions helped strengthen its php2shell WAF protections and add detections. The challenge, focused on two PHP vulnerabilities, remains open for materially distinct, reproducible bypass submissions.
Cloudflare disclosed a confirmed cross-tenant data exposure in GLM-5.3 Workers AI: 155 responses to prompts over 681,280 tokens included data from other customers’ requests. A KV-pool mismatch and SGLang bug caused it; fixes are deployed, with no deliberate exploitation
Cloudflare says it obtained South Korea’s ISMS certification after a KISA-appointed audit. It describes localized consent requirements, audited data flows and access controls, and a service-boundary approach to defining certificate coverage.
Cloudflare says its WAF can now correlate HTTP requests with origin responses to detect possible exploit success, then block matching responses before they reach requesters. The capabilities are generally available across plans.
Cloudflare says its WAF protections for CVE-2026-109618 and CVE-2026-109619 are deployed across plans. Its new full transaction detection analyzes request and response signals; customers should still patch PHP.
Cloudflare says keys for eight eMudhra intermediate certificates were compromised, enabling forged certificates and server impersonation. It patched services, updated WARP and cloudflared, and advises customers to update software and review trust stores.
Cloudflare recommends patching NetScaler gateways and layering access policies, WAF inspection, and origin restrictions to limit exposure to CVE-2026-88771 and CVE-2026-88772. It cautions that DTLS-enabled listeners need separate review.
Cloudflare says it is evaluating whether Verified Bots honor website preferences, including robots.txt rules and requests to slow down after HTTP 429 responses. The system is in internal use, with broader customer access planned.
Cloudflare says its Managed Defense beta uses deterministic data collection and specialized AI agents to correlate alerts and produce evidence-cited recommendations, while keeping analysts responsible for decisions and mitigations.
Cloudflare adds an optional `--allowed-mail` flag to Quick Tunnels, letting developers restrict access through email verification without an account. The allowlist stays on the developer’s machine, and protected tunnels do not fall back to public access.
Cloudflare introduced an Early Access dashboard that uses hashed account identifiers and login/signup history to help teams investigate suspicious activity, including credential stuffing, and decide on responses such as account recovery or WAF challenges.
Cloudflare says EuroLLM and Apertus are coming to Workers AI and is launching workshops for government and critical-infrastructure teams to build model-agnostic AI defenses, including a multi-model harness for vulnerability hunting, verification and prioritization.
Cloudflare is extending learned request-schema validation to web applications. Profiles flag requests that differ from observed structures; customers can review violations and create rules to block them. The feature is available to API Security customers and invited
Cloudflare added TLS 1.3 post-quantum key-exchange visibility to HTTP Traffic Analytics, Logpush and Log Explorer, giving customers domain-level and per-connection telemetry to assess adoption and identify migration gaps.
Cloudflare launched Threat Signals for all accounts, using agentic skills to summarize selected RSS reporting, extract and contextualize indicators, and store linked threat events in a private dataset for investigation and WAF use.
Cloudflare plans MTC issuance through its new CA, targeting Chrome’s Quantum-resistant Root Store in early 2027. A Chrome Beta experiment served billions of MTCs and found landmark-relative certificates 9% faster at median, using classical signatures.
Cloudflare plans to become a public certificate authority, has applied to major root programs, and agreed to acquire a trusted GlobalSign root. It plans to issue Merkle Tree Certificates in early 2027 but is not issuing certificates yet.
Cloudflare describes CryptoLabe, an internal AI tool that maps cryptography across repositories to guide its post-quantum migration. The article details its scan workflow, limitations, hard-case detection, and advice for prioritizing systems.
