Cloudflare Access
“Cloudflare Access is a fast, reliable Zero Trust Network Access solution that secures employees and contractors. Simplify ZTNA with Cloudflare.”
Zero trust access to internal applications without a VPN.
Product pageCloudflare
United States4 products listed
Welcome to Cloudflare: Powering the next generation of applications
Our summaryNetwork and security company running a global edge network for DDoS protection, web security and zero trust services.
- Products listed
- 4
- Research stories
- 21
- Incidents and advisories
- 18
- Indicators
- 20
Cloudflare in our news, month by month
ResearchIncidents and advisories
8
Jun
1
Jul
1
3
Aug
3
Sept
15
1
Oct
1
Nov
Products and the controls they provide
Cloudflare Gateway
“Protect employees' Internet browsing from threats with Cloudflare Gateway, a cloud-native Secure Web Gateway (SWG) that inspects browser traffic without disrupting work.”
DNS filtering and secure web gateway.
Product pageCloudflare WAF and DDoS protection
“Protect your applications without sacrificing performance. Edge-based WAF with zero-day protection, low false positives, and automatic security updates.”
Web application firewall and unmetered DDoS mitigation for websites and APIs.
Product pageCloudflare Email Security
“Email Security from Cloudflare protects inboxes against phishing, malware, and ransomware.”
Email filtering for phishing and business email compromise.
Product pageExternal reviews
Independent tests, peer reviews and articles about Cloudflare. We link to them; we did not write or commission them, and nobody pays to appear here.
Research by Cloudflare
Stories in our coverage based on what researchers at Cloudflare found or reported: 21 in total.
- 4 Nov 2026Cloudflare Launches Zero Wire to Track Critical CVEs, Active Exploits, and Security Fixes
Cloudflare launches Zero Wire to track critical CVEs, active exploits, and security fixes.
- 31 Oct 2026Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Cloudflare reports 18.2M network-layer DDoS attacks in Q3, a 38% increase.
- 29 Oct 2026Hackers Launch 8,200 DDoS Attacks Every Hour, Cloudflare’s Latest Report Reveals
Cloudflare reports 8,200+ DDoS attacks hourly in Q3 2026, with attackers favoring short bursts.
- 27 Oct 2026U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
CISA adds PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog.
- 26 Oct 2026How to patch PHP2Shell with free Aikido Images
Aikido releases free patched PHP container images for PHP2Shell RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619.
- 26 Oct 2026Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability
Cloudflare releases emergency WAF rules for Brotli vulnerability CVE-2026-111497.
- 26 Oct 2026PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts
North Korean campaign targets 216 PHP hosts with critical vulnerabilities
- 24 Oct 2026The PHP Meltdown Shows How AI Makes Bugs More Exploitable
AI tools help researchers uncover and exploit previously unaddressed PHP vulnerabilities, dubbed PHP2Shell.
- 23 Oct 2026PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet
Millions of PHP2Shell attacks observed targeting critical CVEs, with exploit development ongoing.
- 22 Oct 2026Tech and Security Companies Respond to PHP2Shell Vulnerabilities
PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) allow remote code execution; patches released.
Incidents and advisories
Stories where a Cloudflare product had a vulnerability or was attacked, or Cloudflare itself was: 18 in total. Useful if you run its products.
- 28 Oct 2026Researchers Chain Cloudflare Security Flaws to Bypass CSP and Execute Malicious JavaScript
Researchers chained Cloudflare security flaws to bypass CSP and execute malicious JavaScript.
- 27 Sept 2026Cloudflare fixes Containers cross-tenant flaw exposing customer data
Cloudflare fixes Containers cross-tenant flaw exposing customer data
- 3 Sept 2026Coder's registry infrastructure compromised to push malicious modules
Attackers compromised Coder's infrastructure to distribute malicious Terraform modules.
- 20 Aug 2026CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
CDN Tsunami attacks exploit HTTP/3 to HTTP/1.1 translation for DoS amplification.
- 19 Aug 2026Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
Spectre attack leaks JWT from Cloudflare Worker at 12 bits/sec.
- 10 Aug 2026‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad
Ghostjacking attack uses poisoned logs to turn AI agents rogue.
- 24 Jun 2026Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Cordyceps CI/CD flaws allow unauthenticated users to hijack workflows and compromise over 300 GitHub repositories.
- 24 Jun 2026Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking
CI/CD vulnerabilities allow unauthenticated attackers to hijack developer workflows and control millions of
- 23 Jun 2026'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows
Malicious pull requests targeting open-source projects exploit CI/CD workflow weaknesses.
- 6 Jun 2026RT @DarkWebInformer: 🚨 A threat actor known as welcometonightbrother is sharing source code that...
Threat actor 'welcometonightbrother' shares source code for Cloudflare Turnstile bypass.
Indicators from these stories20 indicators · show· hide
Vendor Watch
Run Cloudflare?
Get an email when a new story names Cloudflare, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
From Cloudflare
Is this your company, or did we get something wrong?
Tell us what to fix on this page: a product, a description, a link or a review. We check every suggestion before changing anything, and listing stays free and editorial.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.