All news with #cloudflare tag

🛡️ Cloudflare demonstrates an automated method to reverse-engineer classic BPF socket filters and generate the exact “magic” packets that trigger stealthy Linux backdoors. By combining symbolic execution with the Z3 theorem prover and translating the resulting constraints into concrete byte values, the approach reduces manual analysis of complex BPF bytecode from hours or days to seconds. The team uses scapy to assemble crafted packets and has open-sourced the filterforge tool to accelerate threat research and detection.

🔒 Cloudflare is accelerating its post-quantum roadmap and now targets 2029 to achieve full post-quantum security, explicitly including post-quantum authentication. The company already enabled post-quantum encryption for the majority of human traffic to mitigate harvest-now/decrypt-later risks, but new algorithmic and hardware advances (notably Google’s reported speedups and Oratomic’s neutral-atom estimates) make authentication the urgent priority. Cloudflare will enable PQ defaults for customers at no extra cost.

🔒 Cloudflare has introduced Organizations in public beta to help enterprise customers manage multiple Cloudflare Accounts centrally. The feature creates an organization layer for account grouping, introduces an Org Super Administrator role, and provides aggregated analytics and shared policy sets. Initial rollout targets enterprise plans with staged expansion to other customers and partners. There is no additional fee for Organizations during beta.

🛡️ Cloudflare introduced EmDash, presented as a modern, more secure alternative to WordPress. The MIT-licensed, open-source CMS aims to reduce plugin-driven vulnerabilities by isolating execution and enforcing least-privilege principles. EmDash uses a different content model and targets developer-first and AI-driven site workflows. While attractive for new projects, enterprises face nontrivial migration and ecosystem challenges.

🤖 Cloudflare describes how increasing AI crawler traffic—used by retrieval-augmented generation, real-time summarization, and large-scale dataset collection—fundamentally alters CDN cache dynamics. AI agents request high volumes of unique, long‑tail URLs, often in parallel and without shared sessions, producing low reuse and high cache churn that raises misses and origin load. Cloudflare proposes AI-aware caching, traffic filtering, and a dedicated AI cache tier to preserve low-latency human-facing performance while serving diverse AI workloads.

🛡️ EmDash is a new, open-source CMS from Cloudflare, written in TypeScript and available as a v0.1.0 preview that aims to be the spiritual successor to WordPress. It runs plugins in isolated Dynamic Workers and enforces capability-based manifests so extensions can only perform explicitly declared actions, substantially reducing plugin attack surface. EmDash is serverless-first, uses Astro for themes, includes built-in x402 payment support and passkey authentication, and provides CLI and MCP tooling to enable AI-driven management and migrations.

🔒 An independent Big 4 accounting firm has completed a fresh privacy examination of Cloudflare's 1.1.1.1 public DNS resolver and confirmed that its core privacy commitments remain in force. The report reaffirms that Cloudflare does not sell or share resolver users’ personal data or use it for advertising, and that source IP addresses are anonymized and deleted within 25 hours. The review also notes that up to 0.05% of randomly sampled packets may be inspected solely for network troubleshooting and attack mitigation, and clarifies that the examination scope focused exclusively on privacy assurances.

🛡️Programmable Flow Protection lets Magic Transit customers author and deploy custom eBPF programs across Cloudflare’s global edge to define what constitutes legitimate UDP traffic. Programs run in a verified userspace BPF VM and can pass, drop, or challenge packets using helper functions for state, cryptographic validation, and challenge emission. In beta for Magic Transit Enterprise customers, the feature enables stateful, protocol-aware DDoS mitigation that distinguishes legitimate clients from scripted or replay attacks.

🔒 Cloudflare is making advanced client-side protections self-serve and offering domain-based threat intelligence free across all Client-Side Security customers. The Client-Side Security Advanced bundle brings machine learning and an LLM-backed second opinion to detect malicious JavaScript and drastically reduce false positives. It relies on browser reporting like CSP and requires only that traffic be proxied through Cloudflare, so there is zero latency impact to applications. These tools are intended to help organizations of all sizes detect skimming, supply-chain compromises, and sophisticated browser-side attacks.

🔍 Cloudflare has added complete visual diagrams to the Cloudflare Workflows dashboard so developers can better inspect and debug code-first workflows. Because Workflows are dynamic code — with Promises, await, loops and nested functions — Cloudflare parses the bundled script at deploy time into an AST, using oxc-parser and a Rust Worker compiled to WebAssembly to translate nodes into a graph. The renderer maps step and function relationships, tracks parallelism and ordering with starts and resolves indices, and exposes a concise set of node types to support debugging and future real-time tracing features.

🔒 Push Security warns of an adversary-in-the-middle (AitM) phishing campaign that seizes control of TikTok for Business accounts by presenting victims with malicious credential-capture pages after a Cloudflare Turnstile check. Lures include lookalike TikTok for Business and fake Google Careers pages, sometimes offering scheduled calls to gain trust. The attackers host pages on multiple domains and use the Turnstile challenge to evade automated scanners. Separately, WatchGuard reported SVG attachments used to deliver a Go-based malware artifact linked to BianLian-style activity.

🔒 Threat actors are targeting TikTok for Business accounts with Cloudflare-hosted phishing pages that evade bot detection by using Google Storage redirects and a Cloudflare Turnstile check. Victims first see fake forms that request business-email validation and are then shown a reverse-proxy login page that captures credentials and session cookies, allowing account takeover even with 2FA enabled. Push Security links the activity to a campaign that previously targeted Google Ad Manager and notes multiple NiceNIC-registered domains hosted in the same Google Storage bucket. Users should verify domains, treat unsolicited invites cautiously, and prefer passkeys for high-value accounts.

🚀 Cloudflare's Dynamic Worker Loader API enables Workers to instantiate isolated JavaScript sandboxes at runtime, letting LLM-generated code run securely and on-demand. Using lightweight V8 isolates rather than containers, Dynamic Workers start in milliseconds, are far more memory efficient, and scale across Cloudflare's edge. The feature supports TypeScript RPC interfaces, credential injection for outbound HTTP, and helper libraries for bundling, virtual filesystems, and Code Mode integration.

🔧 Cloudflare’s Gen 13 platform pairs its Rust-based FL2 software rewrite with a redesigned server built around the 192-core AMD EPYC 9965, 768 GB DDR5-6400, PCIe 5.0 NVMe storage, and dual 100 GbE networking. The new configuration targets up to 2x throughput versus Gen 12 while improving performance-per-watt by up to 50% and increasing per-rack throughput. Gen 13 also adds PCIe encryption, expanded NVMe capacity and front-bay U.2 options, and support for two double-width PCIe accelerators to future-proof deployments.

🚀Cloudflare announces Gen 13 servers based on AMD EPYC™ 5th Gen Turin and the new Rust-based FL2 request layer. Turin delivers up to 192 cores and improved IPC but reduces per-core L3 cache; FL1's cache-heavy design produced unacceptable latency at high utilization. By rewriting the serving stack, Cloudflare unlocks up to 2x throughput over Gen 12 and up to 50% better performance-per-watt while keeping latency within SLAs.

🔒 The U.S. Department of Justice announced a court-authorized operation that disrupted command-and-control infrastructure used by multiple IoT Mirai variants, including AISURU, Kimwolf, JackSkid, and Mossad. Authorities from Canada and Germany, assisted by major vendors such as AWS, Cloudflare, and Akamai, helped dismantle networks that collectively enslaved roughly 3 million devices and enabled record-breaking DDoS attacks exceeding 30 Tbps. The action seeks to curb a cybercrime-as-a-service market that sold access to compromised DVRs, webcams, routers, and off-brand Android TVs.

🤖 Cloudflare’s Workers AI now hosts frontier open-source models, beginning with Kimi K2.5, a 256k-context model that supports multi-turn tool calling, vision inputs, and structured outputs. The release enables organizations to run full agent lifecycles on Cloudflare’s Developer Platform, leveraging primitives like Durable Objects and Workflows. Cloudflare emphasizes improved price-performance, prefix caching, a session-affinity header, and a redesigned asynchronous API to lower latency and inference costs for agentic workloads.

🔒 Cloudflare expands Regional Services with Custom Regions, enabling customers to define precise geographic boundaries for TLS termination and Layer 7 processing. The update also adds Cloudflare-managed regions for Turkey, the UAE, IRAP (Australia) and ISMAP (Japan). Custom Regions use expressions like country_code to build membership sets, enabling localized AI inference, targeted campaigns, government deployments, and corporate-aligned governance while retaining global L3/L4 DDoS protection.

🛡️ Cloudflare is contesting Italy’s Piracy Shield, a regulator-run portal that requires rapid blocking of sites nominated by unnamed media companies, after refusing to register and being fined €14 million. The company says the system lacks due process, transparency, and judicial oversight, routinely causes overblocking, and conflicts with the Digital Services Act. Cloudflare has appealed the fine, sought disclosure of enforcement records, and is pursuing remedies in Italian courts and with EU authorities. It warns the scheme endangers global Internet infrastructure and user rights.

🔁 Cloudflare and CDW present a pragmatic, phased approach to migrate from legacy VPNs to a SASE-based Zero Trust architecture, prioritizing coexistence over disruptive cutovers. Their methodology uses a risk-aware, tiered application classification and Cloudflare Access wrapping to add SSO, MFA, and outbound-only tunnels without rewriting legacy code. The approach couples a pre-migration audit with staged pilots and dual-client rollouts to preserve service continuity and provide rollback paths.