blog.cloudflare.com resources

blog.cloudflare.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-09-14.

RCE 2 AI 1 AuthN 1 Fuzzing 1

Date Added	Resource	Excerpt
2026-09-14 2026	A revisit of remote Spectre attacks on Cloudflare Workers RCE	Researchers have revisited remote Spectre attacks targeting Cloudflare Workers. These attacks exploit speculative execution vulnerabilities to potentially leak sensitive data from isolated cloud environments. The revisit confirms the feasibility of such attacks, demonstrating that despite mitigation efforts, side-channel attacks like Spectre remain a significant threat to cloud security. The findings highlight the ongoing need for robust defenses against these sophisticated exploit techniques, particularly in serverless computing platforms where resource isolation is critical. No specific payout amount was mentioned.
2026-04-11 2026	Cloudflare FIDO2 + Zero Trust AuthN	Library detailing Cloudflare's migration from a "castle and moat" VPN architecture to a Zero Trust model, replacing TOTP with FIDO2/WebAuthn hardware security keys like YubiKeys. The library explains how FIDO2's phishing-resistant, challenge-response mechanism, which cryptographically binds authentication to specific domains, underpins this transition. It highlights the use of Cloudflare Access for selective enforcement and role-based access control, ultimately leading to the complete phasing out of TOTP and SMS-based MFA in favor of a unified, phishing-proof authentication standard.
2026-04-10 2026	A Gentle Introduction to Linux Kernel Fuzzing Fuzzing	Tutorial on Linux kernel fuzzing using AFL and KCOV, detailing coverage-guided techniques to discover bugs in the kernel's netlink machinery. It explains how to configure a custom Linux kernel with KCOV enabled and integrate kernel code coverage reporting into AFL, a popular fuzzer by Michał Zalewski, for effective memory corruption bug detection. The tutorial also references prior work with tools like syzkaller.
2026-04-10 2026	React2Shell and RSC Vulnerabilities: Exploitation Threat Brief RCE	Library rules protecting against React2Shell (CVE-2025-55182), CVE-2025-55183, and CVE-2025-55184 offer protection for React Server Components. Exploitation attempts, including those by Asian-nexus threat groups, were observed shortly after public disclosure, utilizing vulnerability scanners like Nuclei and Burp Suite. Threat actors employed Internet-wide scanning, asset discovery platforms, and metadata analysis, including SSL certificate details, to identify vulnerable deployments, with targeted efforts observed against geopolitical intelligence priorities, government entities, and critical infrastructure.
2026-04-02 2026	AI Security for Apps is now generally available AI	Library for securing AI-powered applications, generally available, offering discovery of AI endpoints, detection of prompt injection and PII exposure, and mitigation via WAF rules. New features include custom topic detection and free AI endpoint discovery for all Cloudflare customers, with expanded integrations with IBM and Wiz for unified security posture management. It addresses risks cataloged in the OWASP Top 10 for LLM Applications, such as prompt injection and sensitive data leakage, by analyzing prompt and output behavior rather than fixed operations.