Do Son Cloudflare reveals how an inadvertent policy change in Miami triggered a 25-minute BGP route leak, impacting global IPv6 traffic and exposing network vulnerabilities.
cloudflare
New AsyncRAT campaign abuses free Cloudflare tunnels for stealthy malware delivery. Learn how phishing emails lead to WebDAV attacks & Python injection.
Cloudflare debunks claims that Venezuela's CANTV BGP leak was a US military op, attributing the incident to chronic technical errors and misconfigurations.
With 1.8 million infected Android TVs, Kimwolf issued 1.7 billion commands in 3 days, using Ethereum ENS to become a nearly un-killable cyber threat.
Cloudflare CEO Matthew Prince confirmed the global outage was not a DDoS attack but an internal error: a database permission change corrupted a critical Bot Management config file.
A severe server incident at Cloudflare caused widespread internet disruption, making major sites like X, ChatGPT, Canva, and PayPal inaccessible. A fix is being deployed.
Multiple major online services, including YouTube, X/Twitter, and Steam, suffered simultaneous outages suspected to be caused by a temporary datacenter route failure primarily affecting the U.S. East Coast.
A Chinese APT used fake Cloudflare verification pages and malicious LNK files to inject PlugX via DLL sideloading into a Serbian aviation agency, aiming for long-term espionage.
Cloudflare launched a Content Signals Policy to update robots.txt, giving creators machine-readable controls to specify if their content can be used for AI training or search summarization.
A high-severity flaw (CVE-2025-58179) in Astro's Cloudflare adapter allows attackers to bypass domain restrictions, leading to SSRF and XSS attacks.
Cloudflare’s 1.1.1.1 was hit by 12 unauthorized certificates from Fina CA, raising PKI concerns and spotlighting Microsoft’s continued trust.
Three anomalous TLS certificates were improperly issued for Cloudflare’s 1.1.1.1 DNS. The certificates were trusted by Microsoft and went undetected for months.
Cloudflare confirms it was hit by the Salesforce supply chain attack, exposing customer support data. The company is urging users to rotate credentials.
Cloudflare has successfully mitigated the largest DDoS attack on record, peaking at an unprecedented 11.5 Tbps and highlighting a new era of cyber threats.
The free DDNS service DuckDNS has gone offline, leaving users unable to access their home servers. Users are urged to migrate to an alternative service.
Cloudflare accuses Perplexity AI of ignoring robots.txt files and impersonating a browser to evade detection, and has removed it from its list of verified bots.
SentinelLABS and Beazley expose PXA Stealer, a Python-based infostealer campaign targeting 62 countries with stealthy DLL sideloading, decoy files, and Telegram-based data exfiltration.
Cloudflare exposes a phishing campaign that abuses link wrapping services like Proofpoint and Intermedia, making malicious URLs appear legitimate to bypass security and trick users.
Cloudflare's 1.1.1.1 public DNS resolver experienced a global outage on July 14, 2025, confirmed as an internal configuration error, not a cyberattack or BGP hijack.
Google's AI Overview is impacting publisher traffic with no opt-out. Cloudflare is pushing for a separate AI crawler to protect content creators.
Cloudflare launches "Pay Per Crawl," allowing websites to charge AI companies for content scraping. Publishers can set prices, aiming for a new economic model for the web.
Cloudflare launched an AI Crawler Leaderboard ranking AI company web crawlers. ByteDance is last for ignoring robots.txt and lack of IP transparency, prompting new blocking defaults.