blog.cloudflare.com resources

blog.cloudflare.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-09-25.

RCE 2 AI 1 API Sec 1 AuthN 1 AuthZ 1 Fuzzing 1

Date Added	Resource	Excerpt
2026-09-25 2026	How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers API Sec AuthZ	Writeup detailing a cross-tenant data exposure vulnerability in Cloudflare Containers and Sandboxes, where a researcher leveraged a `skip_block_zeroing` misconfiguration in Linux device mapper thin provisioning. This allowed a customer to potentially recover residual disk blocks from previous containers on the same host, exposing filesystem metadata and application data, though without targeting specific victims or accessing active disks. Cloudflare remediated the issue by removing the problematic configuration and retiring affected disks and cached image snapshots.
2026-09-14 2026	A revisit of remote Spectre attacks on Cloudflare Workers RCE	Analysis of Spectre attacks against Cloudflare Workers, revisiting techniques discovered in 2021 and building an updated proof-of-concept on the production environment. This research uncovered a limitation in Cloudflare's Dynamic Process Isolation (DyPrIs) defense, successfully demonstrating a remote Spectre attack that leaked up to 12 bit/s with 99% accuracy. The attack leveraged speculative type confusion and out-of-bounds memory accesses to infer cache states. Improvements to DyPrIs, integration of the V8 Sandbox, and an in-process isolation mechanism have since been implemented to mitigate these memory disclosure risks.
2026-04-11 2026	Cloudflare FIDO2 + Zero Trust AuthN	Library detailing Cloudflare's migration from a "castle and moat" VPN architecture to a Zero Trust model, replacing TOTP with FIDO2/WebAuthn hardware security keys like YubiKeys. The library explains how FIDO2's phishing-resistant, challenge-response mechanism, which cryptographically binds authentication to specific domains, underpins this transition. It highlights the use of Cloudflare Access for selective enforcement and role-based access control, ultimately leading to the complete phasing out of TOTP and SMS-based MFA in favor of a unified, phishing-proof authentication standard.
2026-04-10 2026	A Gentle Introduction to Linux Kernel Fuzzing Fuzzing	Tutorial on Linux kernel fuzzing using AFL and KCOV, detailing coverage-guided techniques to discover bugs in the kernel's netlink machinery. It explains how to configure a custom Linux kernel with KCOV enabled and integrate kernel code coverage reporting into AFL, a popular fuzzer by Michał Zalewski, for effective memory corruption bug detection. The tutorial also references prior work with tools like syzkaller.
2026-04-10 2026	React2Shell and RSC Vulnerabilities: Exploitation Threat Brief RCE	Library rules protecting against React2Shell (CVE-2025-55182), CVE-2025-55183, and CVE-2025-55184 offer protection for React Server Components. Exploitation attempts, including those by Asian-nexus threat groups, were observed shortly after public disclosure, utilizing vulnerability scanners like Nuclei and Burp Suite. Threat actors employed Internet-wide scanning, asset discovery platforms, and metadata analysis, including SSL certificate details, to identify vulnerable deployments, with targeted efforts observed against geopolitical intelligence priorities, government entities, and critical infrastructure.
2026-04-02 2026	AI Security for Apps is now generally available AI	Library for securing AI-powered applications, generally available, offering discovery of AI endpoints, detection of prompt injection and PII exposure, and mitigation via WAF rules. New features include custom topic detection and free AI endpoint discovery for all Cloudflare customers, with expanded integrations with IBM and Wiz for unified security posture management. It addresses risks cataloged in the OWASP Top 10 for LLM Applications, such as prompt injection and sensitive data leakage, by analyzing prompt and output behavior rather than fixed operations.