#cloudflare
-
Key “4”: Cloudflare measures how much of the Internet still trusts eMudhra’s weak keys
Certificate authority eMudhra issued intermediate keys that can be recovered from public certificates almost instantly. Cloudflare explains how it patched its own systems, what it knows about exploitation attempts, and how many clients remain exposed.
-
The web is slamming its doors on AI agents
Tech giants promise autonomous helpers that book dinners, buy shoes, and clean your inbox. But major websites increasingly refuse to let them in.
-
The biggest redesign in decades: example.com now speaks six languages
On 28 September 2026 the reserved domain example.com gained multi-language support for the first time. DebugBear breaks down the update and traces the page's twenty-plus-year history.
-
Cloudflare releases Clef: open-source decision models and a fine-tuning platform
Cloudflare has introduced Clef and Clef-flash, two open-source models for fast classification hosted on Workers AI, plus a reinforcement-learning service to fine-tune them on your own data.
-
Cloudflare sets out to become a certificate authority for the whole Internet
Twelve years after launching Universal SSL, Cloudflare has applied to the major root programs and is building a post-quantum certificate authority for the open web.
-
Cloudflare fixes cross-tenant data exposure in Containers
Accomplish researchers showed how a Workers Paid customer could read residual data from disks previously used by other tenants' containers on the same host.
-
Brevo supply-chain attack: a stolen Cloudflare key infected customer sites
Attackers stole a Cloudflare API key and used an edge worker to inject ClickFix scripts into Brevo's sites and into widgets embedded on customer pages. Up to 100,000 sites may have been affected.
-
Read the Docs Weathered the Largest DDoS Attack in Its History
In June 2026, the documentation host Read the Docs spent nearly ten days fending off a distributed attack that peaked at 5.5 million requests per minute. The team shared what worked and what didn't.
-
Cloudflare and OpenAI: Vulnerability Discovery That Accounts for Real Traffic
Cloudflare is launching an invitation-only Vulnerability Discovery and Remediation service that ties vulnerabilities found in code to production traffic and tells you what to fix first.
-
Coder Infrastructure Breach: Attackers Served Malicious Terraform Modules
Attackers infiltrated Coder's cloud infrastructure and spoofed its registry servers to distribute modules carrying credential-stealing code.
-
Spectre Returns: An Attack on Cloudflare Workers Siphons Off JWTs at 12 Bits per Second
Researchers have demonstrated a remote Spectre attack against Cloudflare Workers, extracting a JSON Web Token from a neighboring Worker in production — 360 times faster than the 2021 demonstration.
-
Cloudflare Silently Injects Its Analytics When You Move Your NS Servers
A Hacker News user discovered that after pointing his domain at Cloudflare's name servers, a web analytics script was added to his site without warning. Turning it off took a convoluted chain of settings.
-
N-able Releases Hotfix 2 for N-central Amid Active Attacks on Managed Systems
Attackers are exploiting an authentication-bypass flaw in the N-central RMM platform to gain administrative access and maintain persistence through Cloudflare tunnels. The company has released a mandatory patch that supplements the previous one.
-
N-central Breach: The First Patch Didn't Close the Hole, Attackers Took Over MSP Servers
N-able reported that attackers exploited an authentication bypass in the N-central platform, gained administrative access to servers, and reached the client systems managed through them. The first fix turned out to be incomplete.
-
Cloudflare Rolls Out WAF Rules to Protect WordPress Against Two Dangerous Vulnerabilities
Cloudflare has released two rules for its web firewall after the WordPress security team reported two high-severity vulnerabilities to it. The company stresses that the protection does not remove the need to update.