TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Website Security & Threat Management

818 posts · Dec 2010 – Sep 2026

What this trail covers

Cloudflare One's security posture management capabilities have evolved to provide real-time discovery and inventory of assets and documents across SaaS and web applications. This includes continuous asset-aware threat detection and risk assessment, with prioritized remediation suggestions. For SaaS applications, a dynamic and real-time data collection pipeline using Cloudflare Workers, R2, and Queues has replaced batch crawlers to ingest vendor webhook events, providing near real-time insights. The WAF has been enhanced with AI-driven testing to identify and mitigate new attack vectors, including those generated by frontier AI models, leading to the creation of new detections and hardening of existing rules.

All Cloudflare trails
  1. We tested our own WAF with frontier AI models. Here’s what we foundThis post details the development and application of an AI-driven WAF testing system. The system uses LLMs to iterate on known exploits across six attack categories (XSS, SQLi, CMDi, SSRF, LFI, Log4j) in a dynamic application security testing approach. It generated 1,107 attempts, resulting in 49 WAF-relevant findings after human review, primarily in CMDi and SSRF. These findings led to the creation of four sets of candidate rules to harden the WAF, demonstrating the effectiveness of AI in identifying novel attack vectors and improving security posture.
  2. When scanners miss the attack: how Cloudflare Client-Side Security protects storefrontsThis post details the evolution of Cloudflare's Client-Side Security product, specifically the Page Shield ML model, to detect sophisticated JavaScript-based attacks that evade traditional security scanners. The core technical contribution is the application of Graph Neural Networks (GNNs) to analyze JavaScript code as a graph structure, enabling detection of malicious intent based on code behavior rather than signatures. It also describes the integration of a lightweight Large Language Model (LLM) on Workers AI for a second opinion to reduce false positives and the use of a cohort of frontier models ('teachers') as agents for deeper analysis, with their disagreements treated as a signal for further training. The post provides concrete examples of four distinct malicious operations (after-hours affiliate-commission hijacker, clickless affiliate theft, old search saboteur/storefront backdoor, paid-mobile cloaker) and explains their attack chains and how they remained hidden, highlighting the importance of ongoing browser visibility and ML-driven analysis of code structure and behavior. The technical details include the use of MutationObserver for dynamic element interception, localStorage for cooldown mechanisms, and the dual-tab maneuver for affiliate commission hijacking.
  3. Introducing automatic remediation policies with Cloudflare CASBIntroduced automatic remediation policies for Cloudflare CASB, enabling event-driven security actions like revoking file shares and dispatching webhooks. Built on Cloudflare developer platform: findings engine enqueues messages to Cloudflare Queues, Worker consumers match policies, and Cloudflare Workflows handle durable execution and third-party API rate limits. Policies can trigger native CASB remediations (for Microsoft and Google Workspace file/folder findings) or send webhooks to external systems. New log types, Admin Activity logs and Cloud & SaaS Security policies logs, provide audit trails and runtime outcomes.
  4. Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak ModelsThis post introduces Vulnerability Discovery and Remediation (VDR), a new service that leverages OpenAI Daybreak models (GPT-5.6 Cyber) and Cloudflare's existing infrastructure (Web Assets, WAF, Workers Observability) to detect and mitigate vulnerabilities in customer codebases. The core technical contribution is the integration of AI-driven vulnerability analysis with production traffic and security context for evidence-based prioritization and automated mitigation suggestions (code patches and WAF rules). The process involves a 'vulnerability harness' that uses reconnaissance agents to map code paths, hunter agents to find vulnerabilities, and validation stages to check proposed solutions. The system prioritizes vulnerabilities based on production exposure (traffic volume, security events) and provides context-aware WAF rules and code patches for customer review. The AI models run on OpenAI's servers, with prompts and responses processed by Cloudflare's harness, ensuring customer data privacy and control.
  5. Introducing Adaptive Intelligence: undermining the economics of every bot attackIntroduces Adaptive Intelligence, a new bot detection engine that shifts from deterministic rule-based systems to a continuously adapting, non-deterministic approach. Key components include: 1) Continuous ML retraining on live traffic, incorporating new bypass tools and bot frameworks without scheduled releases. 2) Disposable rule generation, where rules are deployed and retired at random intervals to prevent attackers from learning and adapting. 3) Learning from traffic it protects, using customer feedback and internal measurements to tune protection against real-world threats. The engine aggregates signals like JA4 TLS fingerprints, request structures, challenge outcomes, session behavior, network reputation, and client-side telemetry from Turnstile and Precursor. It evaluates traffic over multiple time windows to detect both sudden bursts and slow, distributed attacks. Future components will focus on automatically building new detections from labeled traffic and maintaining a memory of past attacks.
  7. Say it once: introducing Bot Preference SyncIntroduces Bot Preference Sync, a feature that automatically updates a site's robots.txt file based on AI bot configuration preferences (Search, Agent, Training) set in the Cloudflare dashboard. This aims to synchronize stated preferences with enforced rules, providing greater transparency and control over how AI crawlers interact with website content, particularly for training and search indexing purposes. It also details new transparency requirements for mixed-use crawlers.
  8. Unveiling good and bad behaviors on the Agentic InternetThis post details the Web Integrity & Trust team's strategy for managing 'agentic' internet traffic, focusing on a 'Trust' framework over simple risk assessment. It introduces the Precursor system for continuous, session-wide behavioral analysis to detect subtle bot activity and drive up the cost for bot developers. The post also announces updates to BotBase to track all known bots and the upcoming 'Adaptive Intelligence' engine for predictive bot detection. Interactive demos and advanced mitigation strategies like unpredictable responses and AI Labyrinth are discussed.
  9. Cloudflare WAF protects WordPress applications from two high-severity vulnerabilitiesThis post details the deployment of two new Cloudflare WAF rules to protect against CVE-2026-60137 (SQL injection) and CVE-2026-63030 (Unauthenticated RCE) in WordPress. The rules are designed to block malicious requests targeting these vulnerabilities, providing defense-in-depth while users update their WordPress installations. The SQL injection rule targets crafted parameter values, and the RCE rule targets requests to the remote code execution path. Both rules are deployed with a default 'Block' action and are available through the Managed Ruleset for Pro/Business/Enterprise plans and the Free Ruleset for free plans.
  10. Introducing Precursor: detecting agentic behavior with continuous client-side signalsIntroduced Precursor, a new client-side, session-based verification system for bot detection. Precursor injects a lightweight JavaScript bundle to collect behavioral signals (pointer movement, keyboard activity, focus changes, visibility) throughout a user session. These signals are processed on the edge to build a session-level view of activity, feeding into Cloudflare's bot protection systems and improving bot score accuracy. New session-based analytics are available in Security Analytics to visualize full visitor journeys.
  11. Your site, your rules: new AI traffic options for all customersThis post introduces a new taxonomy for classifying AI bots based on their behavior (Search, Agent, Training) and their content use (immediate, reference, full). It also announces new default settings for managing these bot types and the launch of BotBase for enhanced bot visibility for Enterprise customers. The core technical contribution is the classification system and the associated controls within the Cloudflare dashboard.
  12. Unmasking the crawls with Attribution Business InsightsIntroduces the Attribution Business Insights dashboard for Cloudflare Bot Management customers, providing detailed analytics on bot traffic, including AI crawlers. The dashboard offers site-wide and per-bot-operator crawl-to-referral ratios, a breakdown of top bots, and an updated classification taxonomy (Training, Search, Agent) for AI crawlers. It aims to empower website owners with data to make informed decisions about content access and business relationships with AI companies.
  13. Scaling Security Insights: how we achieved a 10x increase in global scanning capacityThis post details how Cloudflare achieved a 10x increase in global scanning capacity for its Security Insights feature. It describes the technical challenges and solutions implemented, including scaling Kafka by introducing batch processing and parallel goroutines, avoiding head-of-line blocking with a 'slow lane' and 'fast lane' approach, optimizing database inserts using a hybrid UNNEST/COPY strategy, resolving API latency issues by switching to an active-passive configuration, and rethinking the scheduler with independent zone scheduling, randomized timing, and adaptive rate limiting to ensure uniform scan distribution and handle increased scanning frequency for all customers.
  14. Defend against frontier cyber models: Cloudflare's architecture as customer zeroThis post details Cloudflare's internal architecture and security practices for defending against advanced AI-driven cyber threats, positioning itself as 'customer zero' for its own security products. It elaborates on how Cloudflare uses its WAF (with ML-based scoring and threat intelligence integration), API Shield (positive security model), Bot Management, Zero Trust Network Access, and IdP Federation to create layered defenses. The post emphasizes the shift from signature-based detection to ML-based scoring for faster response to novel exploits and the architectural principle of containing vulnerabilities to limit attacker lateral movement. It also discusses the speed of threat intelligence dissemination and the importance of visibility across the network.
  15. Turning Cloudflare’s threat indicators into real-time WAF rulesIntroduces new WAF fields (`cf.intel.ip.attacker_names`, `cf.intel.ip.target_industries`, `cf.intel.ip.attacker_countries`, `cf.intel.ip.target_countries`, `cf.intel.ip.datasets`) that allow WAF rules to be written using live threat intelligence data. This enables proactive blocking of known bad actors, targeting specific industries or countries, and filtering by attack type. The feature leverages an 'always-on detection framework' for real-time enrichment of HTTP request analytics with threat metadata. It integrates with WAF custom rules and rate limiting, accessible via API and Terraform, and logs matches in Security Analytics. Threat intelligence datasets are compressed and distributed globally for O(1) lookups, and the engine evaluates multiple signals simultaneously for multi-vector actors.
  16. Project Glasswing: what Mythos showed usThis post details the use of Anthropic's Mythos Preview LLM for security-focused vulnerability discovery and exploit chain construction. It highlights the model's ability to chain attack primitives and generate proofs of concept. The post also discusses challenges with model refusals, the signal-to-noise problem in AI-generated findings (particularly with memory-unsafe languages and model bias), and the limitations of generic coding agents for vulnerability research. It proposes a 'harness' approach for managing AI-assisted security research, emphasizing narrow scope, adversarial review, splitting tasks across agents, and parallel narrow tasks for better coverage and reasoning.
  17. When "idle" isn't idle: how a Linux kernel optimization became a QUIC bugThis post details a bug discovered in Cloudflare's quiche implementation of the CUBIC congestion control algorithm for QUIC. The bug caused the congestion window (cwnd) to become permanently pinned at its minimum after a congestion collapse event, preventing recovery. The post traces the origin of the bug to a Linux kernel optimization for handling idle periods in TCP, which was ported to quiche. It explains how the user-space nature of QUIC and a subtle difference in how idle periods were handled led to the bug, resulting in rapid oscillations between congestion avoidance and recovery states. A fix, derived from a subsequent kernel patch, is presented to resolve the issue.
  18. How Cloudflare responded to the “Copy Fail” Linux vulnerabilityThis post details Cloudflare's rapid response to the "Copy Fail" Linux kernel vulnerability (CVE-2026-31431). It explains the vulnerability's mechanism involving the AF_ALG socket family, scatterlists, and out-of-bounds writes to the page cache, enabling privilege escalation. Cloudflare's response involved assessing fleet exposure, validating that existing behavioral detections flagged the exploit pattern within minutes, conducting threat hunting for pre-disclosure exploitation, and engineering a runtime mitigation (bpf-lsm) while simultaneously rolling out patched Linux kernels. The post emphasizes that no customer impact occurred and highlights the effectiveness of their proactive security posture and established patching procedures.
  19. Post-quantum encryption for Cloudflare IPsec is generally availableThis post announces the general availability of post-quantum encryption in Cloudflare IPsec, utilizing the hybrid ML-KEM standard (FIPS 203) for enhanced security against harvest-now-decrypt-later attacks. It details the implementation of the hybrid handshake, which combines classical Diffie-Hellman with ML-KEM for session key derivation. The post highlights successful interoperability testing with Cisco and Fortinet branch connectors, underscoring the importance of industry-wide standards for widespread adoption. It also contrasts this approach with Quantum Key Distribution (QKD), advocating for software-based post-quantum cryptography for Internet-scale deployment and authentication.
  20. Moving past bots vs. humansThis post explores the evolving landscape of web protection, moving beyond the 'bots vs. humans' dichotomy to focus on client intent and behavior. It details how the traditional client-server model and the implicit agreements of the web are being disrupted by AI agents that bypass browser rendering. The post outlines current bot management strategies based on passive client signals (IP, TLS), active client signals (User-Agent, credentials), and server signals (location, time). It highlights the rate limit trilemma (decentralized, anonymous, accountable) and discusses how the blurring lines between bots and humans necessitate a shift towards understanding client intent for effective web protection and resource management.
  21. Securing non-human identities: automated revocation, OAuth, and scoped permissionsIntroduced scannable API token formats (cfk_, cfut_, cfat_) with checksums for better detection by credential scanning tools. Integrated with GitHub's Secret Scanning program for automated revocation of leaked tokens in public repositories. Extended credential leak protection to Cloudflare One customers via Credentials and Secrets DLP profile across network traffic, outbound email, and data at rest. Integrated AI Gateway with DLP profiles for scanning prompts and responses. Improved OAuth consent experience by providing visibility into requesting third-party applications, scopes, and accounts, with a new 'Connected Applications' experience for management and revocation. Expanded resource-scoped RBAC to new resources, including Access Applications, to enable fine-grained permissioning for users and agents.
  22. From bytecode to bytes- automated magic packet generationIntroduced a novel tool leveraging symbolic execution and the Z3 theorem prover to automatically generate "magic packets" that trigger Linux malware hidden within classic BPF socket programs. This significantly reduces the manual effort required for security researchers to reverse-engineer stealthy backdoors.
  23. Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customersIntroduced Programmable Flow Protection for Magic Transit customers, enabling custom DDoS mitigation logic for UDP-based protocols using eBPF. This allows customers to define 'good' and 'bad' packets based on proprietary protocol knowledge and deploy this logic across Cloudflare's global network. The system integrates with existing DDoS mitigation systems and provides stateful tracking and challenge mechanisms.
  24. Cloudflare Client-Side Security: smarter detection, now open to everyoneThis post details the evolution of Cloudflare's Client-Side Security product, specifically the integration of a two-stage AI detection system. The first stage uses a Graph Neural Network (GNN) for high recall detection of malicious JavaScript patterns via Abstract Syntax Trees (AST). The second stage employs an open-source Large Language Model (LLM) hosted on Workers AI for semantic evaluation to drastically reduce false positives. This cascading architecture ensures minimal latency for benign scripts while leveraging the LLM's understanding of JavaScript idioms to filter out legitimate but complex code. The system is deployed on Cloudflare's network using Workers AI and stores flagged scripts in R2 for auditing. The LLM integration has reduced false positives by nearly 3x overall and ~200x for unique scripts. The post also highlights a real-world example of catching a zero-day exploit targeting home routers via a malicious script injected through browser extensions.
  25. Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humansThis post introduces Cloudflare Account Abuse Protection, a new suite of capabilities designed to prevent fraudulent attacks from bots and humans. Key technical contributions include: 1. **Disposable email check**: A binary field to detect users signing up with disposable email addresses, commonly used for promotion abuse and fake account creation. This allows for rule-based enforcement, such as blocking or challenging such signups. 2. **Email risk**: A tiered risk assessment (low, medium, high) based on email patterns and infrastructure, enabling customers to express their tolerance for risk and friction at account creation. 3. **Hashed User IDs**: Per-domain, cryptographically hashed identifiers generated from usernames. These provide better insight into suspicious account activity and enable mitigation at the account level, rather than solely relying on IP addresses. This shifts defense strategy to the account level, moving away from a 'whack-a-mole' approach with rotating IPs and residential proxies. These features build upon existing capabilities like leaked credentials detection and account takeover (ATO) detection IDs, enhancing the layered defense against account takeover and other malicious automated attacks.
  26. Slashing agent token costs by 98% with RFC 9457-compliant error responsesIntroduced RFC 9457-compliant structured error responses (Markdown and JSON) for AI agents encountering Cloudflare platform errors (1xxx-class). This replaces HTML error pages with machine-readable instructions, providing fields like `error_code`, `retryable`, `retry_after`, and `owner_action_required` to enable agents to make informed decisions about retrying, backing off, or escalating. This change dramatically reduces payload size and token usage (over 98% for 1015 errors) and is automatically applied across the network without customer configuration.
  27. AI Security for Apps is now generally availableIntroduced AI Security for Apps, a new capability to detect and mitigate threats to AI-powered applications. This includes free AI endpoint discovery for all Cloudflare customers, custom topic detection for tailored threat identification, and enhanced prompt extraction capabilities. The service integrates with the WAF rule builder for unified mitigation strategies and expands partnerships with IBM and Wiz for a comprehensive AI security posture.
  28. Building a security overview dashboard for actionable insightsThis post details the engineering behind Cloudflare's revamped Security Overview dashboard. It introduces 'Security Action Items' ranked by criticality and 'Detection Tools' to surface the status of security configurations. The system architecture is described, featuring specialized microservices ('checkers') for scheduled configuration checks and real-time event handlers. A key contribution is the concept of 'Contextual Insights,' exemplified by dangling DNS records, which correlate security findings with traffic volume and target context. The post explains the two-phase process for generating these insights: active verification (dead server check, takeover check) and contextual enrichment.
  29. Translating risk insights into actionable protection: leveling up security posture with Cloudflare and MastercardThis post announces a planned integration between Cloudflare and Mastercard's RiskRecon attack surface intelligence. The integration will allow Cloudflare Security Insights to identify and display 'shadow IT' and unprotected hosts discovered by RiskRecon. Users will be able to secure these assets by routing traffic through Cloudflare's proxy and applying security controls like WAF and DDoS protection. The post highlights data showing that systems using Cloudflare have better security hygiene than those that do not. It also details the criticality levels assigned to discovered assets (High, Medium, Low) and provides a fictitious example of an organization with shadow domains. Future plans include risk scoring and AI-assisted diagnosis paths within the Security Insights dashboard.
  30. Active defense: introducing a stateful vulnerability scanner for APIsIntroduces Cloudflare's Web and API Vulnerability Scanner beta, a stateful DAST platform focused initially on BOLA detection for API Shield customers. The scanner leverages OpenAPI schemas and AI (Workers AI) to automatically construct scan plans by modeling API call graphs and inferring endpoint relationships. It differentiates from traditional DAST by integrating with Security Insights, utilizing existing API Discovery and Schema Learning knowledge, and enabling active verification of passive traffic inspection findings. The platform aims to simplify API security testing by reducing setup time and providing context-aware vulnerability reporting.
  31. Fixing request smuggling vulnerabilities in Pingora OSS deploymentsThis post details the identification and patching of three HTTP/1.x request smuggling vulnerabilities (CVE-2026-2833, CVE-2026-2835, CVE-2026-2836) in the Pingora open source framework. It explains how these vulnerabilities could allow attackers to bypass security controls, desync requests, and poison caches in standalone Pingora deployments. The post outlines specific fixes for premature upgrade handling without a 101 handshake and for misinterpretations of HTTP/1.0, close-delimiting, and transfer-encoding, emphasizing that Cloudflare's CDN was not affected due to architectural differences and internal traffic handling practices.
  32. Ending the "silent drop": how Dynamic Path MTU Discovery makes the Cloudflare One Client more resilientThis post introduces Dynamic Path MTU Discovery (PMTUD) to the Cloudflare One Client, enhancing its resilience against 'PMTUD Black Holes'. It details how the client actively probes network paths to determine optimal packet sizes, moving beyond reliance on potentially dropped ICMP messages. This ensures stable connections for users across various network conditions, particularly benefiting mission-critical applications like those used by first responders and hybrid workers.
  33. Always-on detections: eliminating the WAF “log versus block” trade-offIntroduces Attack Signature Detection and Full-Transaction Detection for Cloudflare's WAF. Attack Signature Detection separates detection from mitigation, running all signatures on every request to enrich analytics and provide metadata for custom policies. It categorizes signatures by attack vector and confidence level (High, Medium). Full-Transaction Detection correlates request and response data to reduce false positives and uncover subtle threats. The post details how these detections populate fields like `cf.waf.signature.request.confidence`, `cf.waf.signature.request.categories`, and `cf.waf.signature.request.ref` for use in Security Analytics and the Edge Rules Engine. It also explains how the "always-on" framework can execute detections after the request is sent to the origin to avoid introducing latency.
  34. Moving from license plates to badges: the Gateway Authorization ProxyThis post introduces the Gateway Authorization Proxy and PAC File Hosting, extending Cloudflare's identity-based security to unmanaged devices. It addresses the limitations of IP-based identification by integrating with Cloudflare Access to verify user identity, enabling granular policies and anonymous logs. The PAC File Hosting simplifies setup by allowing users to host their configuration files directly on Cloudflare.
  35. Stop reacting to breaches and start preventing them with User Risk ScoringIntroduces User Risk Scores into Cloudflare One's ZTNA policies, enabling adaptive access based on user behavior and external telemetry. This moves security from a static login check to a continuous assessment of user risk. The system calculates risk based on selected behaviors (e.g., impossible travel, DLP violations) and integrates with third-party signals from partners like CrowdStrike and SentinelOne. Adaptive Access policies can now dynamically adjust access levels based on these risk scores, and risk signals can be shared back to IdPs like Okta.
  36. Evolving Cloudflare’s Threat Intelligence Platform: actionable, scalable, and ETL-lessIntroduced a sharded, SQLite-backed architecture for the Threat Intelligence Platform (TIP) using Durable Objects, eliminating ETL pipelines and enabling real-time GraphQL queries on the edge. Implemented parallel query execution across shards via Workers, dynamic visualizations (Sankey diagrams), attribute mapping for correlating threat events, saved configurations for real-time notifications, and automated STIX2 exports. Leveraged Cloudflare Queues for ingestion, R2 for long-term retention, and Hyperdrive for edge compute.
  37. Introducing the 2026 Cloudflare Threat ReportThis post introduces the 2026 Cloudflare Threat Report, detailing the evolution of the threat landscape towards 'high-trust exploitation' and a focus on 'Measure of Effectiveness' (MOE) by adversaries. Key findings include AI automating attacker operations, state-sponsored pre-positioning, over-privileged SaaS integrations, weaponization of trusted cloud tooling (e.g., Google Drive, Dropbox, GitHub, Amazon SES, SendGrid) for C2 and payload hosting, deepfake personas for espionage, token theft bypassing MFA, relay blind spots for brand spoofing, and hyper-volumetric DDoS attacks. Cloudforce One's methodology includes using AI coding agents for self-vulnerability analysis (discovering CVE-2026-22813), analyzing Phishing-as-a-Service (PhaaS) with DMARC failures, and tracking DDoS baseline traffic. The report advocates for autonomous defense to counter threats moving at machine speed and announces an upgrade to Cloudflare's threat events platform.
  38. From reactive to proactive: closing the phishing gap with LLMsThis post details the integration of Large Language Models (LLMs) into Cloudflare's email security tools to proactively identify and categorize phishing threats. It describes how LLMs are used to analyze millions of emails daily, extracting nuanced threat vectors like 'Sales Outreach' and 'PrizeNotification'. This enables the creation of high-fidelity signals for analysts and the development of specialized machine learning models trained on LLM-generated tags. The post highlights a 20.4% reduction in customer-reported misses for Sales Outreach phishing in Q4 2025 due to this proactive approach, demonstrating a shift from reactive defense to proactive reinforcement.
  39. See risk, fix risk: introducing Remediation in Cloudflare CASBThis post introduces Remediation capabilities to Cloudflare CASB, allowing users to directly fix identified security risks within SaaS applications, specifically focusing on overshared files in Microsoft 365 and Google Workspace. This moves CASB from a detection-only tool to an active control plane, enhancing its role in website security and threat management by enabling immediate risk mitigation.
  40. Toxic combinations: when small signals add up to a security incidentThis post introduces the concept of 'toxic combinations' in security incidents, defined as the convergence of multiple minor signals (bot traffic, sensitive application paths, request anomalies, misconfigurations) to indicate a potential breach. It details how Cloudflare's platform can detect these combinations by analyzing these signals and provides specific examples of toxic combinations related to probing administrative endpoints and unauthenticated API endpoints with predictable identifiers. It also outlines mitigation strategies for these vulnerabilities.
  41. The most-seen UI on the Internet? Redesigning Turnstile and Challenge PagesThis post details the redesign of Cloudflare's Turnstile widget and Challenge Pages, which are served billions of times daily. The redesign was driven by a need to improve user experience amidst increasing bot traffic and security checks. Key contributions include: a comprehensive design audit revealing inconsistencies in error messages, visual language, and tone of voice; mapping the complete user journey to understand happy and unhappy paths; establishing a unified information architecture with consistent structure and visual hierarchy across both Turnstile and Challenge Pages; and user research that validated certain existing approaches while identifying critical areas for improvement, such as replacing 'Send Feedback' with 'Troubleshoot' to offer actionable help during error states.
  42. 2025 Q4 DDoS threat report: A record-setting 31.4 Tbps attack caps a year of massive DDoS assaultsThis post details the evolution of DDoS attacks in 2025, highlighting a 121% surge and record-breaking attack volumes. It introduces the Aisuru-Kimwolf botnet and its 'The Night Before Christmas' campaign, which utilized hyper-volumetric HTTP DDoS attacks. The post also analyzes network-layer DDoS attack growth, specific attack vectors like SYN floods and Mirai-generated attacks, and the impact on various industries and geographic locations. It emphasizes Cloudflare's autonomous DDoS defense systems' ability to automatically detect and mitigate these massive assaults.
  43. How we mitigated a vulnerability in Cloudflare’s ACME validation logicThis post details a vulnerability in Cloudflare's ACME validation logic where WAF features were disabled for ACME HTTP-01 challenge requests, potentially allowing them to reach the origin when they should have been blocked. The mitigation involved a code change that ensures WAF features are only disabled when the request matches a valid ACME HTTP-01 challenge token for the hostname, and Cloudflare is serving the challenge response.
  44. Innovating to address streaming abuse — and our latest transparency reportThis post details Cloudflare's evolving approach to addressing streaming abuse and copyright infringement. It highlights the development of new technical responses, including an API for rightsholders, feedback mechanisms on report quality, and scaled response to streaming reports. The post also discusses the increased volume of DMCA reports and takedown actions, as well as the use of this information to bolster technical tools for preventing unauthorized streaming on non-hosted services. Furthermore, it addresses the challenges of legally-mandated blocking and advocates for source-based content removal as a more effective and less damaging approach.
  45. React2Shell and related RSC vulnerabilities threat brief- early exploitation activity and threat actor techniquesThis post details the immediate threat intelligence and WAF rule deployment following the disclosure of the React2Shell vulnerability (CVE-2025-55182) and related RSC vulnerabilities (CVE-2025-55183, CVE-2025-55184). It describes the observed exploitation tactics and techniques used by threat actors, including the use of vulnerability scanners and asset discovery platforms, and the filtering of targets based on application metadata and SSL certificate attributes. It also details the specific WAF rules deployed by Cloudflare to mitigate these threats, including rules for scanning detection and exploit bypasses. The post quantifies the volume of detected activity, showing millions of hits per hour and thousands of unique IPs probing for the vulnerability.
  46. Cloudflare outage on December 5, 2025This post details a significant outage caused by changes to the WAF's body parsing logic and internal testing tools. It highlights how an attempt to protect customers against a React Server Components vulnerability led to a critical error in the FL1 proxy when an internal WAF testing tool was disabled. The incident underscores the challenges of managing global configuration changes and the need for more robust deployment and error handling mechanisms, especially in the context of security-related updates. It also emphasizes the ongoing work to improve resiliency following a previous outage.
  47. Cloudflare WAF proactively protects against React vulnerabilityThis post details the deployment of new WAF rules to protect against a Remote Code Execution (RCE) vulnerability (CVE-2025-55182) in React Server Components (RSC) and related frameworks like Next.js. The rules are automatically applied to all traffic proxied through Cloudflare's WAF, including free and paid plans. Two specific rule IDs are provided for the Managed Ruleset and the Free Ruleset, both with a default 'Block' action. The post emphasizes that Cloudflare Workers are inherently immune to this exploit. It also strongly recommends customers update their React and Next.js versions.
  48. Cloudflare's 2025 Q3 DDoS threat report -- including Aisuru, the apex of botnetsThis post details the Q3 2025 DDoS threat landscape, highlighting the unprecedented scale of attacks from the Aisuru botnet (exceeding 29.7 Tbps and 14.1 Bpps). It quantifies the surge in DDoS attacks against AI companies (347% MoM), the impact of geopolitical tensions on attacks against the Mining, Minerals & Metals and Automotive industries, and the overall increase in DDoS attacks mitigated by Cloudflare (15% QoQ, 40% YoY). It also analyzes attack characteristics, top attack sources (Indonesia leading), and top attacked industries and locations, correlating them with geopolitical events.
  49. Get better visibility for the WAF with payload loggingThis post introduces and details improvements to Cloudflare's WAF payload logging feature. The core contribution is the enhancement of the payload logging compiler, built on Wirefilter, to provide more precise and reduced logging. Key technical advancements include: 1. Partial evaluation of array fields (e.g., `http.request.headers.names[*]`) to log only matching elements, significantly reducing log volume. 2. Improved handling of 'partial' match operators (like 'contains', 'in', 'matches') to log only the specific matching parts of a field rather than the entire field. 3. Logging 'before' and 'after' context for partial matches to provide clearer debugging information and further reduce log volume. The post also explains the underlying Wirefilter architecture and the encryption of logs for customer privacy.
  50. Cloudflare outage on November 18, 2025This post details a major outage on November 18, 2025, caused by a database permission change that led to an oversized Bot Management feature file. This file's size exceeded the software's limit, causing widespread failures in core CDN, security services, Turnstile, Workers KV, and Access. The incident highlighted issues with database query behavior, feature file propagation, and the impact of configuration file size limits on network stability. It also led to a temporary failure of the status page and initial misdiagnosis as a DDoS attack. The post outlines the resolution steps and commits to preventing future occurrences.
  51. Fresh insights from old data: corroborating reports of Turkmenistan IP unblocking and firewall testingThis post leverages Cloudflare Radar's data on TCP resets and timeouts to corroborate reports of Turkmenistan unblocking IP addresses and potentially testing a new firewall. It analyzes historical data from mid-2024, showing a surge in requests from Turkmenistan and corresponding shifts in TCP connection anomalies, particularly in specific autonomous systems. The post highlights how analyzing network-level anomalies can provide insights into state-level internet control and tampering, complementing existing threat management capabilities.
  52. Go and enhance your calm- demolishing an HTTP:2 interop problemThis post details a specific instance of an internal microservice communication hitting Cloudflare's HTTP/2 PING flood mitigation (ENHANCE_YOUR_CALM). It explains the underlying Go standard library behavior where calling `resp.Body.Close()` without fully reading the response body can lead to unnecessary RST_STREAM frames, which in turn can trigger PING flood detection. The post provides a solution by ensuring the response body is fully read using `io.Copy(io.Discard, resp.Body)` before closing it, and offers a more robust pattern for handling response bodies in Go clients.
  53. Beyond IP lists- a registry format for bots and agentsIntroduces a registry format for bots and agents, extending the Web Bot Auth protocol. This format allows for the discovery of public keys by listing URLs to agent key directories. A complementary signature-agent card format is proposed to include metadata like client name, URI, logo, contacts, and expected crawl rate. Cloudflare will provide an initial registry instance, and a demo for Caddy server shows how to import registries. This addresses the problem of discovering public keys for bots and agents at scale, moving beyond IP lists and user agents to cryptographic authentication.
  54. Anonymous credentials- rate-limiting bots and agents without compromising privacyIntroduces the concept of using anonymous credentials (AC) to rate-limit AI agents and bots without compromising user privacy. Details the development of a simple AI agent using Cloudflare Workers and Stagehand for browser automation. Discusses the challenges origins face with increased agent traffic and proposes AC as a solution for fine-grained traffic management, aligning with ongoing IETF development.
  55. Defending QUIC from acknowledgement-based DDoS attacksThis post details the identification and mitigation of two vulnerabilities (CVE-2025-4820 and CVE-2025-4821) in the quiche library related to QUIC packet acknowledgement handling. The mitigation involves enforcing ACK range validation based on the largest packets sent by the server and implementing a dynamic CWND-aware skip frequency to counter Optimistic ACK attacks, thereby preventing DDoS vectors caused by artificially expanded send rates.
  56. How to build your own VPN, or- the history of WARPThis post details the initial implementation of WARP, Cloudflare's mobile-first performance and security app, which involved building a high-performance VPN using the Linux networking stack. It explains the technical challenges of securely and efficiently egressing arbitrary user packets from edge machines, detailing the use of Layer 3 VPN tunneling, Network Address Translation (NAT) with Netfilter and nftables, and the role of the conntrack module for stateful packet handling. The post also highlights the use of TUN devices and packet marking for distinguishing WARP client traffic and controlling routing decisions, laying the groundwork for future zero-trust products and capabilities.
  57. One IP address, many users: Detecting CGNAT to reduce collateral effectsThis post introduces Cloudflare's work on detecting Carrier-Grade NAT (CGNAT) and other large-scale IP sharing (LSS) mechanisms. It highlights the socioeconomic bias that can arise from traditional IP-based security measures when applied to shared IPs, particularly in developing regions. The post details the motivation for this work, the technical challenges of CGNAT, and Cloudflare's approach to building a supervised learning classifier using distributed traceroutes and public data sources to identify CGNAT IPs. This contributes to the broader theme of refining threat management by understanding the underlying network infrastructure and user access patterns.
  58. Helping protect the 2025 Moldova electionsThis post details Cloudflare's mitigation of large-scale DDoS attacks against the Moldovan Central Election Commission (CEC) and other election-related websites during the 2025 parliamentary elections. It quantifies the attacks, detailing over 898 million malicious requests mitigated against the CEC over a twelve-hour period, with peak rates exceeding 324,000 requests per second. The post also highlights the application of these protections to civic participation portals, democracy-related services, broadcasters, and news outlets, demonstrating a coordinated effort to disrupt both official processes and public information channels. The technical details include the categorization of attacks into multi-wave patterns and the real-time neutralization of these threats by Cloudflare's automated defenses.
  59. A framework for measuring Internet resilienceThis post introduces a data-driven framework for measuring Internet resilience. It defines resilience as the measurable capability of a national or regional network ecosystem to maintain diverse and secure routing paths in the face of challenges, and to rapidly restore connectivity following a disruption. The framework analyzes metrics related to routing hygiene (RPKI, ROV), physical infrastructure (IXPs, colocation facilities), network topology, interconnection patterns, and routing behavior. It emphasizes the importance of local decisions having global impact and the challenges of data access for accurate measurement, relying on public data sources for reproducibility.
  60. How Cloudflare’s client-side security made the npm supply chain attack a non-eventThis post details the evolution of Cloudflare Page Shield's malicious script detection capabilities, specifically highlighting the use of a message-passing graph convolutional network (MPGCN) for classifying JavaScript files. It explains the preprocessing of JavaScript into Abstract Syntax Trees (ASTs) and the model's ability to learn from code structure and syntax to identify malicious intent, including obfuscation and code modification for crypto-stealing. The post quantifies model evaluation metrics (Precision, Recall, F1) and discusses improvements achieved through more training data, better training examples, and refined evaluation criteria. It also mentions the ongoing integration of contextual data and agentic AI for hybrid analysis, and the retirement of the older 'Code Behaviour Analysis' classifier. The post verifies that Page Shield would have detected the 18 compromised npm packages in the September 2025 supply chain attack.
  61. Securing agentic commerce: helping AI Agents transact with Visa and MastercardThis post introduces a significant advancement in website security by detailing Cloudflare's partnership with Visa and Mastercard to secure agentic commerce. It leverages the previously introduced Web Bot Auth and HTTP Message Signatures to create a framework (Trusted Agent Protocol and Agent Pay) for cryptographically authenticating AI shopping agents. This enables merchants to distinguish legitimate agents from bots, link agents to consumer identities, and manage transaction expectations, thereby enhancing security and trust in automated commerce.
  62. Improving the trustworthiness of Javascript on the WebThis post introduces the Web Application Integrity, Consistency, and Transparency (WAICT) effort, a W3C-backed initiative to bring stronger security guarantees to the web. It defines web applications using integrity manifests that commit to all assets via hashes, and proposes achieving transparency by logging these hashes in public, append-only structures like hash chains. Key requirements for transparency include not breaking existing sites, no added round trips, user privacy, statelessness, non-centralization, ease of opt-in/out, transparent opt-out, and monitorability. The post details the concept of an integrity manifest with asset hashes and integrity policies, and explains how hash chains can serve as the foundation for transparently logging these manifests.
  63. A simpler path to a safer Internet: an update to our CSAM scanning toolThe CSAM Scanning Tool has been simplified by removing the requirement for website operators to create and provide their own NCMEC credentials. This change has led to a 1600% increase in monthly adoption. The tool now scans cached content for potential CSAM using fuzzy hashing and automatically blocks identified matches, notifying the site operator. The underlying fuzzy hashing technique is described as creating a 'perceptual fingerprint' that remains similar even if an image is modified.
  64. Automatically Secure: how we upgraded 6,000,000 domains by default to get ready for the Quantum FutureThis post details the implementation and results of Automatic SSL/TLS, a system that automatically scans and upgrades origin server TLS configurations to the most secure mode supported. It explains the technical evolution of TLS, the challenges of securing the edge-to-origin connection, and the mechanics of how Automatic SSL/TLS works by crawling websites, comparing HTTP/HTTPS content, and checking TLS certificates. It highlights the improvement from the previous SSL/TLS Recommender, which had low adoption, to an automated system that has secured over 6 million domains.
  65. Giving users choice with Cloudflare’s new Content Signals PolicyIntroduces the Content Signals Policy, an extension to robots.txt that allows website operators to specify preferences for how their content can be used by crawlers. Defines three content signals: 'search', 'ai-input', and 'ai-train'. Provides human-readable explanations and machine-readable syntax for expressing these preferences. Cloudflare will automatically update managed robots.txt files for customers to disallow AI training by default. The policy is released under CC0 license to encourage adoption.
  66. Building unique, per-customer defenses against advanced bot threats in the AI eraIntroduces a new platform for per-customer behavioral anomaly detection using machine learning models to identify unique bot behaviors. This platform establishes dynamic baselines of normal traffic for each customer, identifies deviations from these baselines, and generates actionable findings through new Bot Detection IDs for WAF rules. It also details improvements in globally scalable bot fingerprinting, including heuristics for HTTP/2 and Client Hello extensions, and enhanced detection for residential and commercial proxy networks by combining network data with client-side information from challenge solves.
  67. Helping protect journalists and local news from AI crawlers with Project GalileoProject Galileo now includes free access to Cloudflare's Bot Management and AI Crawl Control services for its participants, which include journalists, independent news organizations, and other non-profits supporting news-gathering. This provides tools to monitor and control AI crawler access to websites, helping news organizations protect their content and negotiate fair compensation.
  68. Integrating CrowdStrike Falcon Fusion SOAR with Cloudflare’s SASE platformThis post details the integration of Cloudflare's SASE platform (specifically Zero Trust Access and Email Security) with CrowdStrike Falcon Fusion SOAR. It introduces two out-of-the-box integrations for automated response workflows, leveraging webhooks and API calls. Technical details include the specific API actions available for Email Security and Zero Trust Access within CrowdStrike, an example of an automated workflow (phishing detection -> block sender -> revoke sessions -> isolate endpoint), and the configuration of Logpush jobs from Cloudflare to CrowdStrike via HTTP destinations.
  69. Addressing the unauthorized issuance of multiple TLS certificates for 1.1.1.1This post details the unauthorized issuance of TLS certificates for Cloudflare's 1.1.1.1 DNS resolver by Fina CA. It explains the mechanics of TLS certificate validation for DNS resolvers, the role of Certificate Transparency (CT) in detecting such misissuances, and the investigation into potential malicious use. The post emphasizes the security implications of CA negligence and the importance of robust CA security practices.
  70. The age of agents: cryptographically recognizing agent trafficIntroduces 'signed agents' as a new classification for AI agents directed by end-users, distinct from company-directed bots. This classification leverages Web Bot Auth for cryptographic verification of HTTP requests, allowing for more granular security controls and improved visibility. The Cloudflare bots and agents directory has been updated to include signed agents, and a submission form is available in the dashboard. Enterprise customers will soon be able to configure security rules based on this new classification. Partners like ChatGPT agent, Goose, Browserbase, and Anchor Browser are the first to be classified as signed agents.
  71. The next step for content creators in working with AI bots: Introducing AI Crawl ControlThis post announces the general availability of AI Crawl Control, rebranding the AI Audit tool. It introduces the ability for paid Cloudflare customers to send customizable HTTP 402 ('Payment Required') status codes when blocking individual crawlers. This allows content creators to specify contact information or API details for licensing negotiations directly within the 402 response. The feature is configurable via the AI Crawl Control dashboard.
  72. Block unsafe prompts targeting your LLM endpoints with Firewall for AIThis post introduces the integration of Llama Guard into Cloudflare Firewall for AI, enabling real-time detection and moderation of unsafe prompts targeting LLM endpoints. It details the underlying architecture, which uses parallel, non-blocking requests from a Cloudflare Worker to detection modules (including PII and unsafe topics), leveraging Workers AI for Llama Guard inference. The post explains how Llama Guard classifies prompts into categories like hate, violence, and sexual content, and how these detections can be used to enforce security rules via custom WAF rules to log or block harmful content. It also mentions future plans to detect prompt injection and jailbreak attempts.
  73. Beyond the ban: A better way to secure generative AI applicationsThis post introduces AI prompt protection as a new capability within Cloudflare's DLP product, integrated into Cloudflare One. It details the technical components: prompt detection (leveraging undocumented APIs), topic classification (content and intent with predefined profiles for PII, credentials, source code, customer data, financial information, code abuse, and jailbreaks), guardrails for granular policy enforcement based on these classifications, and encrypted logging. The implementation leverages Kivera's operation mapping for API analysis and provides Gateway log filters for AI-specific events. The core technical contribution is the system's ability to inspect and control data flow into and out of web-based GenAI applications based on semantic understanding of prompts and responses.
  74. How a volunteer-run wildfire site in Portugal stayed online during DDoS attacksThis post details how Cloudflare's automated DDoS mitigation systems protected the volunteer-run fogos.pt website during two significant attacks, mitigating 33,000 requests per second and 1.7 Gbps of bandwidth without service disruption. It highlights the effectiveness of Cloudflare's systems for smaller, yet critical, public interest sites, and the role of Project Galileo in providing these protections.
  75. MadeYouReset: An HTTP/2 vulnerability thwarted by Rapid Reset mitigationsThis post details the MadeYouReset (CVE-2025-8671) HTTP/2 vulnerability, which exploits server-sent stream resets. It explains how Cloudflare's existing mitigations for Rapid Reset and general HTTP/2 RFC 9113 compliance provide protection against this new vulnerability. It also notes that the Rust-language h2 library used by Cloudflare's Pingora framework was potentially susceptible in versions prior to 0.4.11, and advises users to update.
  76. Reducing double spend latency from 40 ms to < 1 ms on privacy proxyThis post details the optimization of authentication latency for Cloudflare's privacy proxy product. It identifies and resolves a significant performance bottleneck related to TCP Nagle's algorithm and delayed ACKs, reducing double-spend check latency from approximately 40ms to under 1ms. This directly improves the performance and privacy of services like Apple's Private Relay and Microsoft's Edge Secure Network by ensuring faster token validation.
  77. Perplexity is using stealth, undeclared crawlers to evade website no-crawl directivesThis post details the observed stealth crawling behavior of Perplexity, which uses undeclared user agents and rotates IP addresses and ASNs to evade robots.txt directives and WAF rules. Cloudflare has responded by de-listing Perplexity as a verified bot and implementing new heuristics in its managed rules to block this type of stealth crawling. The post also contrasts this behavior with well-behaved bots like OpenAI's ChatGPT Agent, which respects website preferences and adheres to standards like Web Bot Auth. Cloudflare's bot management system and managed rules are updated to protect customers from such evasive tactics.
  78. Vulnerability disclosure on SSL for SaaS v1 (Managed CNAME)This post details a vulnerability found in the older SSL for SaaS v1 (Managed CNAME) product, which relied on IP-based routing and lacked domain ownership verification. It explains how this architecture could be exploited and highlights the mitigation strategy: the phased transition to the more secure Cloudflare for SaaS (v2), which enforces hostname verification. The post also outlines compensating controls for remaining v1 customers and emphasizes the ongoing commitment to security and transparency.
  79. Cloudflare protects against critical SharePoint vulnerability, CVE-2025-53770This post details Cloudflare's rapid response to CVE-2025-53770 and CVE-2025-53771, critical SharePoint vulnerabilities. It explains the ToolShell exploit chain, which involves an authentication bypass via `Referer` header manipulation, a deserialization RCE, and the theft of cryptographic keys for persistent access. Cloudflare's WAF Managed Rules were updated with emergency releases to mitigate these threats, demonstrating a proactive security posture and rapid response to zero-day exploits. The post includes metrics on the number of blocked exploit attempts.
  80. Hyper-volumetric DDoS attacks skyrocket: Cloudflare’s 2025 Q2 DDoS threat reportThis post details the significant increase in hyper-volumetric DDoS attacks in Q2 2025, with Cloudflare blocking over 6,500 such attacks, averaging 71 per day. It highlights the record-breaking scale of these attacks, reaching 7.3 Tbps and 4.8 billion packets per second. The report also notes a year-over-year increase in overall DDoS attacks and a rise in Ransom DDoS attacks, while detailing shifts in the top attacked locations, industries, and sources of these attacks, including specific Autonomous System Numbers (ASNs) involved in HTTP DDoS attacks.
  81. Introducing simple and secure egress policies by hostname in Cloudflare’s SASE platformThis post introduces egress policies by hostname, domain, content category, and application within Cloudflare's SASE platform. Previously, egress policies were limited to user groups and destination IP addresses, making it difficult to manage access to external services with dynamic IP addresses. The new feature leverages Cloudflare's DNS resolver and a 'synthetic IP' mechanism to associate DNS queries with network connections, enabling L4 egress policy evaluation based on L7 information like hostnames. This significantly simplifies policy management for organizations and enhances security by providing more granular control over outbound traffic.
  82. Control content use for AI training with Cloudflare’s managed robots.txt and blocking for monetized contentThis post introduces two new tools for controlling AI bot access to content: a managed robots.txt file generation service and a feature to block AI bots only on monetized portions of a site. It also provides updated data on AI crawler traffic, crawl-to-refer ratios for major AI companies, and the adoption of AI bot blocking features by Cloudflare customers. The post details the underutilization of robots.txt for AI bots and highlights the shift towards 'fully disallowed' permissions for top AI crawlers.
  83. From Googlebot to GPTBot: Who’s crawling your site in 2025This post analyzes recent trends in web crawling, focusing on the emergence and growth of AI crawlers (e.g., GPTBot, Meta-ExternalAgent) and traditional search crawlers (e.g., Googlebot). It quantises the growth of AI and search crawler traffic by 18% year-over-year, with Googlebot showing a 96% increase. The post details the top AI crawlers, their purposes, and the challenges they pose regarding content rights and infrastructure. It also discusses how webmasters can manage AI crawlers using robots.txt and Cloudflare's AI Audit tools. The analysis highlights shifts in the AI crawler landscape, with OpenAI and Meta becoming dominant players.
  84. Introducing pay per crawl: Enabling content owners to charge AI crawlers for accessIntroduces 'Pay per crawl', a new feature enabling content owners to charge AI crawlers for access. This leverages HTTP response code 402, HTTP Message Signatures for crawler authentication and payment intent, and Cloudflare's role as Merchant of Record. Publishers can define pricing and control access (Allow, Charge, Block) via a rules engine that operates after WAF and bot management policies. Two payment flows are supported: reactive (discovery-first via 402 response) and proactive (intent-first via crawler-max-price header). Billing events are recorded for authenticated requests with payment intent and a crawler-charged header.
  85. Message Signatures are now part of our Verified Bots Program, simplifying bot authenticationThis post announces the integration of HTTP Message Signatures into Cloudflare's Verified Bots Program. It details how bots can use Message Signatures for faster enrollment and how Cloudflare verifies these signatures at the edge to identify authenticated bot traffic. It also introduces open-source libraries for generating these signatures and outlines the steps for bot operators to register their bots using this new method. The post explains the verification process for origins and highlights the benefits for site owners in managing bot traffic.
  86. The crawl before the fall… of referrals: understanding AI’s impact on content providersThis post introduces a new metric, the 'crawl-to-refer ratio', displayed on Cloudflare Radar's AI Insights page. This metric quantifies the relationship between AI bot crawl requests for HTML content and the number of HTML page requests referred by AI platforms. The measurement methodology involves dividing HTML page requests from relevant user agents by HTML page requests where the Referer header contains a hostname associated with a given search or AI platform. The post presents observational data on these ratios for various AI platforms and search engines, analyzes trends in crawling and referral traffic, and discusses the implications for content providers. It also references existing tools for blocking AI crawlers and new initiatives for fair value exchange.
  87. Defending the Internet: How Cloudflare blocked a monumental 7.3 Tbps DDoS attackThis post details the autonomous mitigation of a record-breaking 7.3 Tbps DDoS attack, highlighting the scale of the attack (37.4 terabytes in 45 seconds) and its multi-vector nature, primarily UDP floods with smaller percentages of QOTD, Echo, NTP, Mirai UDP, Portmap, and RIPv1 reflection/amplification attacks. It provides detailed breakdowns of each attack vector, including how they work, how to prevent becoming a reflection/amplification participant, and how to defend against them. The post also analyzes the attack origins, noting the significant contributions from Brazil and Vietnam, and the involvement of over 122,000 source IP addresses across 5,433 Autonomous Systems.
  88. Resolving a request smuggling vulnerability in PingoraThis post details a request smuggling vulnerability (CVE-2025-4366) discovered in the Pingora OSS framework, specifically when the pingora-cache crate is enabled. The vulnerability arises from an HTTP/1.1 parsing bug where, on a cache hit, unread request bodies could be misinterpreted as the start of a subsequent request, enabling request smuggling. This could lead to modification of request headers and URLs sent to customer origins, and in some cases, allow attackers to observe visited URLs via redirect responses. Cloudflare mitigated the vulnerability by disabling traffic to the affected component and releasing a patch (Pingora 0.5.0 or later).
  89. Your IPs, your rules- enabling more efficient address space usageThis post details the technical enhancements made to Cloudflare's BYOIP (Bring Your Own IP) functionality, enabling dynamic reallocation of IP address prefixes across services (CDN, Spectrum, Magic Transit). Key technical contributions include: extending the Tubular eBPF program to support CDN traffic by integrating with the NGINX ingress proxy via a shared Unix domain socket, enabling dynamic IP address binding without service restarts; implementing Service Bindings for granular control over traffic routing to different pipelines based on IP address or subnet; and outlining the ongoing work to reduce IP prefix transition times from hours to minutes through improved coordination and orchestration systems.
  90. Vulnerability transparency: strengthening security through responsible disclosureThis post details Cloudflare's commitment to transparency in vulnerability reporting, aligning with CISA's "Secure by Design" pledge. It explains the process of issuing CVEs as a CVE Numbering Authority (CNA), including triage criteria and disclosure timelines. Notable CVEs related to Cloudflare products (quiche, WordPress plugin, WARP client) and external dependencies (BoringSSL impacting mTLS) are highlighted, demonstrating the practical application of these security practices.
  91. Forget IPs: using cryptography to verify bot and agent trafficThis post introduces two proposals for authenticating bot and agent traffic: HTTP Message Signatures (RFC 9421) and request mTLS. It details how these mechanisms work, including the use of `Signature-Input` and `Signature-Agent` headers for HTTP Message Signatures, and provides examples of how agents can generate these signatures using libraries like `web-bot-auth` and Chrome's `webRequest` API. The post also discusses the limitations of existing verification methods (User-Agent and IP addresses) and highlights the benefits of cryptographic signing for improved bot identification and control.
  92. First-party tags in seconds: Cloudflare integrates Google tag gateway for advertisersThis post introduces a direct integration with Google tag gateway for advertisers, allowing any domain proxied through Cloudflare to serve Google tags from its own domain. This simplifies server-side tagging by eliminating the need to maintain a separate server, leveraging Cloudflare's reverse proxy infrastructure. The integration intercepts and rewrites calls to Google's measurement servers, fetching scripts from Google's servers and serving them back to the end user's browser from the customer's domain. This results in first-party requests and first-party cookie storage, improving data signals and campaign performance.
  93. Targeted by 20.5 million DDoS attacks, up 358% year-over-year: Cloudflare’s 2025 Q1 DDoS Threat ReportThis post details the significant increase in DDoS attacks observed in Q1 2025, with a 358% YoY increase and 198% QoQ increase, totaling 20.5 million blocked attacks. It highlights the evolution of Cloudflare's autonomous defenses in handling hyper-volumetric attacks, including record-breaking campaigns of 4.8 Bpps and 6.5 Tbps. The post also analyzes emerging threat vectors like CLDAP and ESP reflection attacks, and discusses the anatomy of both network-layer and HTTP-layer DDoS attacks, including the prevalence of SYN floods, Mirai botnets, and botnet-impersonating attacks. It also touches on threat actor motivations and the short duration of most attacks, necessitating rapid, automated mitigation.
  94. A next-generation Certificate Transparency log built on Cloudflare WorkersThis post introduces a next-generation Certificate Transparency (CT) log built on Cloudflare Workers, leveraging the new static CT API design. It details the history and importance of CT, the challenges in operating existing CT logs (integrity, availability, cost), and how the new design, implemented in Rust and deployable on Cloudflare's Developer Platform, addresses these issues by making CT logs more efficient, cacheable, and easier to operate. This represents an advancement in Cloudflare's contribution to internet security infrastructure.
  95. Detecting sensitive data and misconfigurations in AWS and GCP with Cloudflare OneThis post introduces the extension of Cloudflare CASB to include Cloud DLP (Data Loss Prevention) functionality, enabling users to scan objects in Amazon S3 buckets and Google Cloud Storage for sensitive data matches. It details a serverless architecture for this process, involving a Compute Account, Controller function, Crawler function, and Scanner function, ensuring data remains within the customer's cloud environment. It also highlights posture management features for identifying misconfigurations in IAM, bucket, and object settings.
  96. Improving Data Loss Prevention accuracy with AI-powered context analysisThis post introduces a self-improving AI-powered algorithm for Cloudflare's Data Loss Prevention (DLP) solution to reduce false positives. The algorithm leverages Workers AI for text embedding and Vectorize for nearest neighbor search and storage. It learns from customer feedback (false positive reports) to improve future detection accuracy. The system uses online clustering to reduce storage needs and Cloudflare Queues for asynchronous indexing. Privacy is maintained through data redaction before embedding and customer-specific private namespaces. Latency increases are associated with AI context analysis, and future improvements include multilingual support and enhanced transparency. AI context analysis is currently available for Gateway HTTP traffic and will be extended to CASB and Email Security.
  97. HTTPS-only for Cloudflare APIs: shutting the door on cleartext trafficThis post details the technical implementation of closing HTTP ports (80 and others) for api.cloudflare.com to enforce HTTPS-only API traffic. It explains the security risks of cleartext HTTP requests, especially for API tokens, and the limitations of redirection and HSTS for API clients. The solution involves preemptively refusing connections at the transport layer by disabling HTTP ports, preventing handshake and data exchange before sensitive information is transmitted. It also touches on the challenges of global scale, the need to support legacy clients, and the use of Tubular with BSD Sockets API for managing IP addresses and ports.
  98. Making Application Security simple with a new unified dashboard experienceThis post introduces a unified dashboard experience for Cloudflare's Application Security features, breaking down traditional product silos. It defines three core concepts: web traffic (data), signals/detections (metadata), and security rules. It explains how all application security products can be viewed as generating signals (metadata) from web traffic (data), which are then used by security rules to perform actions. This enables 'always-on detections' and a unified rule system. The post details the new dashboard's overview, analytics, web assets management, and security rules pages, emphasizing simplified configuration and improved threat detection by combining signals like bot score and attack score.
  99. Simplify allowlist management and lock down origin access with Cloudflare AegisThis post introduces Bring Your Own IPs (BYOIP) for Cloudflare Aegis, enabling customers to onboard entire IPv4 /24 prefixes or IPv6 /64 prefixes. It also announces a customer-accessible Aegis API and the gradual rollout of observability for Aegis IP utilization. The post details the technical aspects of Aegis, including its use of soft-unicasting, L4 XDP-based load balancer Unimog, and capacity constraints for both IPv4 (40k concurrent connections per Aegis IP per origin) and IPv6 traffic.
  100. How we train AI to uncover malicious JavaScript intent and make web surfing saferIntroduced a new AI model for Page Shield that detects specific malicious JavaScript intents (Magecart, crypto mining, malware) by parsing JavaScript into concrete syntax trees (CSTs) using tree-sitter, converting them to an AST-like structure, and feeding this into a message-passing graph convolutional network (MPGCN). The model handles obfuscated code by treating it as is and leveraging graph structure information. The TF-GNN library is used for implementation, with consideration for switching to PyTorch Geometric due to sparse matrix support limitations.
  101. Improved Bot Management flexibility and visibility with new high-precision heuristicsThe post details the migration of Cloudflare's Bot Management heuristics engine from a Lua-based system within an openresty reverse proxy to the Cloudflare Ruleset Engine. This change allows for more complex rules written in YAML, incorporating multiple characteristics and arbitrary sub-conditions. A key improvement is the reduction of false positives, exemplified by a Golang TLS fingerprint heuristic that was refined to have a 0.0001% false positive rate by incorporating network context. The new engine also provides Bot Detection IDs to customers, offering granular visibility into why a request was flagged as a bot and enabling custom rule creation based on these IDs. New detection IDs for monitoring login failures and attempts have been added to help identify account takeover risks.
  102. Take control of public AI application security with Cloudflare's Firewall for AIThis post introduces Firewall for AI, an inline security solution for LLM applications. It details the technical approach to discovering LLM endpoints by analyzing API path signatures, server-sent events, and response bitrate heuristics. It also describes the detection mechanism using regexes and a NER model (Presidio) deployed on Workers AI. The integration with the WAF and Security Analytics for real-time mitigation and visibility is also explained.
  103. Trapping misbehaving bots in an AI LabyrinthIntroduced AI Labyrinth, a new bot mitigation technique that uses AI-generated content to trap and confuse AI crawlers. This involves pre-generating HTML pages with AI (Workers AI, open-source model), sanitizing them for XSS, and storing them in R2. These pages are then integrated as hidden links on existing pages via HTML transformation. The system identifies suspected AI scrapers by observing which bots follow these hidden links, feeding this data into machine learning models for improved bot identification. This feature is available as a simple toggle in the Cloudflare dashboard.
  104. Unleashing improved context for threat actor activity with our Cloudforce One threat events platformThis post introduces the Cloudforce One threat events platform, which provides contextual data about threats monitored and mitigated on the Cloudflare network. It leverages Cloudflare's traffic insights to offer a comprehensive, real-time view of threat activity. The platform is built using Cloudflare Workers and SQLite-backed Durable Objects for storage, allowing for dynamic table creation and scalable datasets. Events include those related to denial of service attacks and advanced threat operations tracked by the Cloudforce One Intelligence team, mapped to MITRE ATT&CK and cyber kill chain stages. The platform aims to empower customers to investigate and address threats targeting their organization by providing key information and actionable indicators of compromise.
  105. Extending Cloudflare Radar’s security insights with new DDoS, leaked credentials, and bots datasetsThis post introduces new DDoS-focused graphs, new insights into leaked credential trends, and a new "Bots" page to Cloudflare Radar. It also details the refactoring of Radar's "Security & Attacks" page into separate "Application Layer" and "Network Layer" sections. New visualizations include geographic and AS-level distribution maps for application layer DDoS attacks, and a graph showing the worldwide distribution of leaked credentials in authentication requests (classified as "clean" or "compromised"). It also highlights the share of authentication requests originating from bots versus humans.
  106. One platform to manage your company’s predictive security posture with CloudflareThis post details the evolution of Cloudflare's security posture management by introducing real-time data collection for SaaS applications and a new 'Security Overview' page for web applications. For SaaS, the shift from batch crawlers to a dynamic pipeline using Workers, R2, and Queues to process vendor webhooks is a key technical contribution. This pipeline involves a webhook listener Worker, R2 for raw payload storage, a queue for raw changes, a transformation Worker to normalize data, another R2 for transformed data, and a queue for transformed messages. The CASB layer then uses a polling consumer and crawlers to fetch updated asset details from vendor APIs. For web applications, the 'Security Overview' page aggregates security suggestions based on discovered web assets and traffic profiles. The post also mentions the addition of RBAC to Security Insights.
  107. Upgraded Turnstile Analytics enable deeper insights, faster investigations, and improved securityThis post details the upgrade to Cloudflare Turnstile Analytics, introducing enhanced visibility into visitor traffic, challenge effectiveness, and bot detection. New features include TopN statistics (hostname, ASN, user agent, browser, source IP, country, OS), granular challenge outcomes (Likely Human vs. Likely Bot), detailed solve rates (interactive, non-interactive, pre-clearance), and token validation metrics. The post provides real-world examples of using Turnstile for login/signup pages, including code snippets for widget rendering and Siteverify API validation, and explains how to interpret the new analytics to identify and mitigate bot behavior patterns and strengthen security layers.
  108. Enhanced security and simplified controls with automated botnet protection, cipher suite selection, and URL Scanner updatesThis post details the automation of Cloudflare's Security Level feature, moving from manual threshold configuration to an always-protected state by integrating botnet data and other request rate signals. It also introduces granular cipher suite selection in the dashboard and enhancements to the URL scanner, including bulk scanning and similarity search.
  109. Password reuse is rampant: nearly half of observed user logins are compromisedThis post details an analysis of Cloudflare's observed traffic between September-November 2024, revealing that 41% of successful logins involve compromised passwords. It highlights that 95% of login attempts using leaked passwords are bot-driven, indicating widespread credential stuffing attacks. The analysis further breaks down these statistics for WordPress, showing 76% of leaked password login attempts are successful, with 48% being bot-driven. The post emphasizes the role of password reuse as a primary vulnerability and provides recommendations for users and website owners to enhance security.
  110. How Cloudflare is using automation to tackle phishing head onThis post details the development and deployment of an automated phishing identification pipeline on the Cloudflare Developer Platform. The pipeline leverages Cloudflare Workers for initial URL scanning, Workers AI for machine learning classifiers, KV and Durable Objects for storing report summaries and tracking attributes, Hyperdrive for accessing Postgres abuse report data, Queues for managing scanning jobs, and D1 for storing detection logs. A Remix Pages UI is used for presenting analysis to investigators. The automation significantly improved the resolution rate of phishing reports from 37% to 78% and reduced the median time to action from 3.4 days to under an hour.
  111. Banish bots from your Waiting Room and improve wait times for real usersThis post introduces two new capabilities for Cloudflare Waiting Room: the integration of an invisible Turnstile challenge to quantify bot traffic within the queue, and the Infinite Queue feature for Advanced Waiting Rooms, which redirects failing bot traffic to a custom page to waste their resources. It also details Session Revocation, allowing for dynamic session termination to open up spots and improve queue throughput. The post explains how Turnstile's challenge outcomes are categorized as 'Likely Bots', 'Bots', and 'Likely Humans', and how these metrics are available in Waiting Room Analytics.
  112. QUIC action: patching a broadcast address amplification vulnerabilityThis post details the discovery and mitigation of a broadcast address amplification vulnerability in Cloudflare's QUIC implementation. It explains how sending a QUIC Initial packet to a broadcast IP address could trigger a server CPU and reflection amplification attack. The vulnerability was traced to the way Cloudflare servers bind anycast IP ranges to their loopback interfaces, creating local and broadcast routes that, when targeted by a QUIC Initial packet to a broadcast address, could lead to excessive response packets. The fix involved modifying the server's packet handling logic to prevent this amplification vector.
  113. Resolving a Mutual TLS session resumption vulnerabilityThis post details a vulnerability in Cloudflare's Mutual TLS (mTLS) implementation related to session resumption, tracked as CVE-2025-23419. A flaw in how BoringSSL handled session caches allowed a client with a valid mTLS certificate for one zone to resume a TLS session with another zone without re-authentication. Cloudflare mitigated this by disabling TLS session resumption for all customers with mTLS enabled and is exploring ways to reintroduce performance benefits. The post also provides guidance on further hardening mTLS configurations using Transform Rules, logging, and WAF custom rules, including passing client certificate metadata to origins.
  114. Preserving content provenance by integrating Content Credentials into Cloudflare ImagesThis post introduces the integration of the C2PA standard into Cloudflare Images, enabling the preservation and cryptographic signing of Content Credentials. It details how Cloudflare Images can retain existing credentials and append new, signed assertions for transformations like resizing. The technical explanation covers JUMBF as the metadata container, JSON manifests for assertions, and the use of DigiCert for Cloudflare's end-entity certificate to join the Trust List for verification.
  115. Record-breaking 5.6 Tbps DDoS attack and global DDoS trends for 2024 Q4This post details the analysis of DDoS attack trends for Q4 2024 and the year as a whole, highlighting a record-breaking 5.6 Tbps attack. It provides technical insights into the volume and types of DDoS attacks mitigated, including Layer 3/4 and HTTP attacks. Specific contributions include the breakdown of HTTP attack vectors, analysis of commonly abused user agents (e.g., HITV_ST_PLATFORM, hackney), and examination of HTTP attributes like methods (HEAD, DELETE) and paths (/wp-admin/) that are disproportionately used in attacks. It also details the top Layer 3/4 attack vectors (SYN flood, DNS flood, UDP floods) and the emergence of vectors like Memcached DDoS attacks. The post emphasizes the role of Cloudflare's autonomous defense systems and its unique vantage point from its global network in detecting and mitigating these threats.
  116. TikTok ban takes hold: data reveals sharp traffic decline and rapid shift to alternativesThis post details how Cloudflare's DNS resolver and network traffic analysis capabilities were used to observe the immediate impact of the US ban on TikTok. It quantifies the sharp decline in traffic to TikTok and its associated domains, as well as the concurrent surge in traffic to alternative platforms like RedNote (Xiaohongshu). The post also highlights the global reach of these traffic shifts and the subsequent partial restoration of TikTok services, underscoring Cloudflare's role in real-time internet traffic monitoring and analysis in response to significant geopolitical events.
  117. Demonstrating reduction of vulnerability classes: a key step in CISA’s “Secure by Design” pledgeThis post details Cloudflare's proactive efforts to reduce entire classes of vulnerabilities, specifically injection flaws and secrets in code, aligning with CISA's 'Secure by Design' pledge. It highlights the implementation of custom SAST rulesets, automated detection, and 'build break' enforcement within CI/CD pipelines to prevent these vulnerabilities from entering production. The post quantifies the impact with a 79% reduction in secrets and a 44% reduction in injection vulnerabilities in the latter half of 2024, showcasing a shift towards preventing vulnerabilities at their source rather than patching them.
  118. Open sourcing h3i: a command line tool and library for low-level HTTP/3 testing and debuggingThis post introduces h3i, a new open-source command-line tool and Rust library for low-level HTTP/3 testing and debugging. It details the motivation behind its development, its role in ensuring standards-compliant software and production systems, and provides guidance on its usage. The post also includes a recap of QUIC and HTTP/3, and background on Cloudflare's existing testing methodologies for these protocols, highlighting the need for more accessible and maintainable tools like h3i to test edge cases and protocol deviations.
  119. Grinch Bots strike again: defending your holidays from cyber threatsThis post details the continued evolution of Cloudflare's bot management capabilities, specifically focusing on the rise of AI bots and their impact during peak shopping periods like Black Friday. It quantifies the increase in bot traffic, including AI bots and those originating from residential proxy networks. The post highlights new detection methods for AI bots and residential proxies, and provides actionable advice for customers on how to leverage Cloudflare's Bot Management and WAF features to protect against these threats, including blocking AI bots and monitoring for account takeover attempts.
  120. Global elections in 2024: Internet traffic and cyber threat trendsThis post details the observed trends in cyberattacks and Internet traffic patterns during global elections in 2024. It highlights the increase in DDoS attacks targeting political campaigns and infrastructure across various countries (US, France, UK, Netherlands, Romania, South Africa, Portugal, Taiwan, Japan), providing specific metrics like peak requests per second and attack volumes. It also documents election-related Internet shutdowns in Comoros and Pakistan, and social media access suspensions in Mauritius. Furthermore, it analyzes Internet traffic patterns on election days in several countries, correlating them with polling hours, results broadcasts, and dominant device usage (mobile vs. desktop).
  121. The role of email security in reducing user risk amid rising threatsThis post details how Cloudflare's email security solution integrates with its broader Zero Trust platform to provide a holistic view of user-based risk. It highlights the use of AI-driven predictive models for email security, automated browser isolation, and automated blocking of risky websites. The post also discusses the importance of a unified dashboard and data lake for increasing SOC productivity and reducing manual rule creation. It introduces the concept of a 'Unified Risk Score' derived from various signals, which can be exported for automated actions in other platforms. The post also mentions the use of Cloudflare's network visibility and signals from processing billions of email messages to combat multi-channel phishing attacks.
  122. Robotcop: enforcing your robots.txt policies and stopping bots before they reach your websiteThis post introduces 'Robotcop,' an extension of AI Crawl Control, which allows customers to programmatically enforce their robots.txt policies against AI bots. It provides visibility into which AI services are honoring robots.txt and enables the automatic translation of these policies into WAF rules for network-level enforcement, moving from voluntary compliance to mandatory adherence.
  123. Bigger and badder: how DDoS attack sizes have evolved over the last decadeThis post details the evolution of DDoS attack sizes over the last decade, highlighting an exponential growth trend in requests per second (rps), packets per second (pps), and bits per second (bps). It analyzes historical data from Google and Cloudflare, showing significant increases in attack volumes and a shift from IoT-based botnets to more powerful VM-based botnets. The post also discusses the challenges in defining individual attacks and how Cloudflare's Connectivity Cloud, with its automated detection and mitigation capabilities, adapts to these evolving threats.
  124. Exploring Internet traffic shifts and cyber attacks during the 2024 US electionThis post details Cloudflare's role in protecting US election infrastructure from cyberattacks during the 2024 election cycle. It highlights the mitigation of over 6 billion HTTP DDoS requests targeting election-related websites, with no significant disruptions observed. The post analyzes traffic shifts, DNS trends, and specific DDoS attack patterns against campaign and party websites, showcasing the scale and sophistication of these attacks. It also reiterates Cloudflare's commitment to election security through its Impact programs (Project Galileo, Athenian Project, Cloudflare for Campaigns) and collaborations with government agencies.
  125. DDoS threat report for 2024 Q3This post details the significant increase in DDoS attacks observed in Q3 2024, with nearly 6 million attacks mitigated. It highlights the mitigation of over 200 hyper-volumetric attacks exceeding 1 Tbps, including a record-breaking 4.2 Tbps attack. The analysis covers attack types (network vs. application layer), duration, vectors (SYN flood, DNS flood, SSDP amplification), user agents used in HTTP attacks (Chrome, Go-http-client, fasthttp), and HTTP attack attributes (DELETE method, non-standard HTTP/1.2, HTTPS). It also identifies top attacked locations (China, UAE) and industries (Banking & Financial Services, IT & Services).
  126. Training a million models per day to save customers of all sizes from DDoS attacksThis post introduces an advanced anomaly detection pipeline for identifying novel and subtle DDoS attacks. It details the limitations of naive volumetric models and time series forecasting, then presents a more robust approach using multiple traffic characteristics (beyond volume) analyzed through Principal Component Analysis (PCA) and Mahalanobis distance. This enables the training of millions of models daily to detect attacks that might otherwise go unnoticed, particularly for smaller customers.
  127. Protect against identity-based attacks by sharing Cloudflare user risk scores with OktaIntroduces an integration with Okta to share Cloudflare's real-time user risk scores. This enables dynamic security posture management by allowing Okta to enforce policies (e.g., MFA, logout) based on risk levels (high, medium, low) derived from user activities like impossible travel or DLP detections. The integration utilizes the OpenID Shared Signals Framework Specification (SSF) and Security Event Tokens (SETs) for secure and standardized risk data exchange.
  128. Cloudflare acquires Kivera to add simple, preventive cloud security to Cloudflare OneThe acquisition of Kivera adds inline cloud app controls to Cloudflare One, extending its SASE portfolio. This provides preventative security controls for cloud services by inspecting cloud API traffic. Key capabilities include blocking misconfigurations before they occur, enforcing tenant boundaries, preventing data exfiltration, reducing shadow infrastructure, streamlining compliance, and enabling flexible DevOps. This complements existing CSPM and CNAPP tools by acting as a first line of defense against deployment errors.
  129. Enhance your website's security with Cloudflare’s free security.txt generatorThis post introduces the integration of a security.txt generator into the Cloudflare dashboard. It details the dynamic generation of security.txt files from a PostgreSQL database, global data synchronization using Quicksilver, and support for expiration timestamps, encryption keys, and API management. The post also references the open-source Cloudflare Worker for security.txt generation and its previous blog post on the topic.
  130. How Cloudflare auto-mitigated a world record 3.8 Tbps DDoS attackThis post details Cloudflare's autonomous mitigation of a world-record 3.8 Tbps DDoS attack. It explains the anatomy of L3/4 DDoS attacks, focusing on CPU cycle and network bandwidth exhaustion. It highlights how Cloudflare's global anycast network distributes attack traffic, and how real-time dynamic signatures are generated to match attack traffic. The post also describes the use of kernel features to drop packets at wire-speed for efficient mitigation.
  131. AI Everywhere with the WAF Rule Builder Assistant, Cloudflare Radar AI Insights, and updated AI bot protectionThis post introduces three key advancements in Cloudflare's AI and bot management capabilities: 1. AI Assistant for WAF Rule Builder: A new feature that allows users to generate WAF custom and rate-limiting rules using natural language prompts. This assistant provides a foundation for rules that can be further refined. 2. AI Bot Traffic Insights on Cloudflare Radar: The Cloudflare Radar platform now includes a graph on its Traffic page displaying insights into AI bot and crawler traffic trends over selected time periods, based on the ai.robots.txt list. Time series and summary data are available via the Radar API. 3. Enhanced AI Bot Blocking Capabilities: The existing AI bot blocking feature has been updated to include 27 signatures of AI bots that do not respect robots.txt or crawl rates. This enhanced rule logic is now powered by Cloudflare managed rules, enabling real-time updates. The ML model for bot detection has been improved with additional heuristics, increasing detection rates and certainty. These updates have led to a significant reduction in AI bot traffic.
  132. A safer Internet with Cloudflare: free threat intelligence, analytics, and new threat detectionsThis post introduces several new security features and enhancements, making them available to all Cloudflare customers, including those on free plans. Key contributions include the launch of a free, publicly accessible threat intelligence website by Cloudforce One, offering insights into threat actors, campaigns, and vulnerabilities. Security Analytics and DNS Analytics are now available to all users, providing deeper visibility into HTTP traffic and DNS queries, respectively. New free offerings for Cloudflare One bundle Zero Trust products with Magic Network Monitoring, Data Loss Prevention, and Digital Experience Monitoring. Additionally, account takeover attack detection, API schema validation, and Page Shield script monitoring are now universally available. Google Authentication is introduced as a new sign-up and login option.
  133. Cloudflare helps verify the security of end-to-end encrypted messages by auditing key transparency for WhatsAppCloudflare has developed and deployed an Auditor service on Cloudflare Workers to verify WhatsApp's Key Transparency audit proofs. This service guarantees the global uniqueness and validity of epochs (versions of WhatsApp's Auditable Key Directory). The uniqueness is achieved using Durable Objects for timestamping, and validity is ensured by a Rust-based containerized service that performs compute-intensive tree validation using the `verify_consecutive_append_only` method. Epoch data is temporarily stored in R2 for validation. This contributes to the broader capability of security posture management by providing an independent audit mechanism for critical cryptographic infrastructure.
  134. Introducing Ephemeral IDs: a new tool for fraud detectionIntroduced Ephemeral IDs, a new feature for Turnstile that generates short-lived, client-specific identifiers. These IDs are calculated based on aggregated client-side signals analyzed by Turnstile, without using cookies or other client-side storage. Ephemeral IDs are intentionally not 100% unique and have a brief lifespan, making them effective for identifying fraud and abuse patterns without compromising user privacy. They are distinct for each Cloudflare customer and change frequently, preventing long-term visitor tracking. The feature integrates seamlessly into Turnstile's existing bot detection logic and is available via the siteverify response for custom integrations, particularly for preventing fraudulent account signups through aggregate analysis.
  135. Start auditing and controlling the AI models accessing your contentIntroduces new analytics views for AI crawler activity, a one-click option to block all AI bots, and granular controls within the WAF to allow specific AI providers or bot types. Previews a monetization feature for content scanning.
  136. How Cloudflare is helping domain owners with the upcoming Entrust CA distrust by Chrome and MozillaThis post details Cloudflare's integration of SSL.com as a new certificate authority (CA) for its Advanced Certificate Manager and SSL for SaaS products. This allows customers who previously relied on Entrust (which is being distrusted by Chrome and Mozilla) to transition to a trusted CA with automated issuance and renewal through Cloudflare's platform. It outlines the UI and API configurations for selecting SSL.com, the default 90-day validity period, and the option for custom validity periods for Enterprise customers. It also emphasizes the benefits of Cloudflare's managed certificate pipeline over manual management for Entrust customers.
  137. Protecting APIs from abuse using sequence learning and variable order Markov chainsThis post details the technical implementation of Sequence Analytics for API abuse protection. It introduces the concept of API sessions and sequences, and explains how Markov chains and variable order Markov chains (VOMCs) are used to model sequential API request behavior. The post highlights the use of credible intervals for estimating probabilities and addresses the limitations of fixed-order Markov chains. It also introduces the concept of VOMCs to handle variable sequence lengths and improve the accuracy of abuse detection.
  138. A global assessment of third-party connection tamperingThis post introduces a significant new dimension to website security by detailing Cloudflare's research into global connection tampering. It quantifies the prevalence of such tampering (20% of connections), identifies signature patterns indicative of third-party intervention (censorship, ISP blocking, enterprise security), and provides global insights into these practices through new dashboards and APIs on Cloudflare Radar. The post also explains the technical underpinnings of connection tampering, particularly related to the SNI field in TLS, and uses telephone call analogies to make the concept accessible.
  139. Go wild: Wildcard support in Rules and a new open-source wildcard crateIntroduced wildcard support ('wildcard' and 'strict wildcard' operators) to the Ruleset Engine, enabling flexible pattern matching in various Cloudflare products. Developed a custom Rust crate for byte-oriented, UTF-8 compatible wildcard matching with substring capture, supporting up to 8 asterisks and escape sequences. Implemented the `wildcard_replace()` function for dynamic URL redirection in Single Redirects and added a simplified UI for wildcard pattern configuration.
  140. Advancing Threat Intelligence: JA4 fingerprints and inter-request signalsThis post introduces JA4 fingerprinting as a successor to JA3, addressing the limitations of JA3 due to TLS extension randomization and limited scope. It details the JA4 fingerprint structure and its advantages, including support for ALPN and resistance to randomization. Cloudflare's integration of JA4 is enabled by a new Rust-based crate, client-hello-parser, which provides optimized memory usage, memory safety, and ultra-low latency for parsing TLS ClientHello messages. The crate's features, including amortized zero heap allocations, robust testing suite, and seamless integration with nginx, are highlighted.
  141. Introducing Automatic SSL/TLS: securing and simplifying origin connectivityIntroduces Automatic SSL/TLS setting for origin connectivity, leveraging the SSL/TLS Recommender to transparently and seamlessly maximize encryption modes between Cloudflare and origin servers without risking site downtime. This builds upon previous efforts in Universal SSL and the SSL/TLS Recommender to automate origin security configuration.
  142. Avoiding downtime: modern alternatives to outdated certificate pinning practicesThis post details the obsolescence of certificate pinning due to the evolving PKI ecosystem, specifically shorter certificate lifetimes and more frequent intermediate CA rotations. It highlights the increase in customer outages caused by certificate pinning and advocates for modern alternatives like ACME protocol adoption and increased use of certificate transparency logs.
  143. Exploring Internet traffic during the 2024 U.S. Republican National ConventionThis post contributes to the website security and threat management thread by detailing observed cyberattack trends and internet traffic shifts during major political events in the US, specifically the 2024 Republican National Convention and the attempted assassination of Donald Trump. It highlights the occurrence of DDoS attacks targeting political websites and campaigns, the impact of news events on traffic to media outlets, and the importance of automated, in-line detection and mitigation systems for short, high-volume attacks. It also provides specific data points on attack volumes and traffic increases, reinforcing the need for robust threat management capabilities.
  144. Application Security report: 2024 updateThis post provides a 2024 update on Cloudflare's Application Security Report, detailing key trends and metrics observed across its network. It highlights a significant increase in mitigated traffic (averaging 7%), with WAF and Bot mitigations accounting for over half. DDoS attacks remain the primary vector, with a notable increase in volumetric attacks and application-layer HTTP DDoS attacks. The report emphasizes the rapid weaponization of CVEs, with exploits occurring as quickly as 22 minutes after proof-of-concept release, necessitating ML-based approaches to complement human-written WAF rules. Bot traffic constitutes about a third of observed traffic, with 93% being potentially malicious. API traffic now accounts for 60% of all traffic, with a concerning quarter of endpoints unaccounted for. The proliferation of third-party integrations in web applications is also highlighted, with enterprise sites integrating an average of 47 third-party endpoints. The report also quantifies the growth in Cloudflare's network capacity and threat mitigation, noting a substantial year-over-year increase in blocked cyber threats.
  145. DDoS threat report for 2024 Q2This post details Cloudflare's DDoS threat landscape analysis for Q2 2024, observing a 20% year-over-year increase in DDoS attacks and a significant rise in threat actor sophistication, necessitating a tenfold increase in automated mitigation fingerprints. It also highlights the rise in Ransom DDoS attacks and provides detailed statistics on attacked countries, industries, and attack sources, along with an analysis of network-layer and HTTP DDoS attack vectors.
  146. RADIUS/UDP vulnerable to improved MD5 collision attackThis post details a new 'Blast-RADIUS' attack that exploits MD5 collisions in the RADIUS Response Authenticator to achieve Man-in-the-Middle (MitM) unauthorized administrative access to network devices. The attack targets RADIUS/UDP authentication modes (PAP, CHAP, MS-CHAP) by forging the Response Authenticator, which is based on an ad hoc MD5 construction. The post explains the cryptographic weaknesses of MD5 in this context, including length extension attacks and identical prefix collisions, and discusses the implications for network security. It also highlights the lack of widespread adoption of RADIUS over TLS (RADSEC) and provides an overview of mitigations for network operators.
  147. French elections: political cyber attacks and Internet traffic shiftsThis post details Cloudflare's role in defending French political parties against significant DDoS attacks during the 2024 legislative elections. It quantifies the intensity and volume of these attacks, highlighting their impact on protected entities and their potential as a distraction for other cyber threats. Additionally, the post analyzes internet traffic shifts during election periods, noting a distinct dip in traffic when initial results were announced, and observes an increase in mobile device usage on election days. It also tracks DNS trends for news outlets and social media, demonstrating how these platforms see increased activity during election reporting.
  148. First round of French election: party attacks and a modest traffic dipThis post details Cloudflare's role in blocking Distributed Denial of Service (DDoS) attacks against three French political parties during the early stages of the 2024 legislative elections. It quantifies the attack volumes (up to 118,000 requests per second) and provides insights into traffic patterns, including a modest dip in overall internet traffic during voting hours and a subsequent increase after polls closed. The post also references previous election-related cyberattack coverage and directs readers to Cloudflare Radar for ongoing election insights.
  149. Declare your AIndependence: block AI bots, scrapers and crawlers with a single clickIntroduced a one-click feature to block all AI bots, including those that impersonate legitimate visitors. This feature is available for all customers and will be automatically updated as new bot fingerprints are identified. The post also provides data on AI bot activity, including top AI crawlers by request volume and share of websites accessed, and analyzes how website operators are responding to AI bot traffic.
  150. Automatically replacing polyfill.io links with Cloudflare’s mirror for a safer InternetThis post introduces an automatic JavaScript URL rewriting service that replaces links to polyfill.io with a mirror on cdnjs. This feature is enabled by default for free plan customers and available as a one-click option for paid plans. The service leverages ROFL (Response Overseer for FL), a Rust-based HTML rewriting engine, to modify script tags on the fly. The logic is bypassed if a Content Security Policy (CSP) header is present. The post also details the detection of malicious activity associated with polyfill.io using Page Shield data and IoCs.
  151. Helping keep customers safe with leaked password notificationThis post introduces a new feature that automatically checks Cloudflare user passwords against threat intelligence sources monitoring data breaches. If a leaked password is detected during login, the user is alerted and prompted to reset their password after a grace period of three login attempts. The post also details how credentials leak (hashing, salting, credential stuffing attacks) and how customers can protect themselves (unique passwords, password managers, two-factor authentication). It explains the technical implementation of the leaked password check using password hashes and fast lookups, and outlines future plans for increasing 2FA adoption and expanding SSO capabilities.
  152. Using machine learning to detect bot attacks that leverage residential proxiesThis post introduces Bot Management ML model v8, which specifically targets the detection of residential proxy abuse. It details the challenges posed by residential proxies, such as IP address rotation and masquerading as legitimate users. The post outlines the ML model training process, including data fetching from Clickhouse, orchestration with Airflow, and Catboost model training with hyperparameter tuning. It also describes the validation process, including the use of specializations and SHAP explainers. The core contribution is the detection methodology for residential proxies, which involves comparing network latency between direct and proxied requests and analyzing behavioral signals, while acknowledging the need to go beyond solely network characteristics due to internet diversity.
  153. Dutch political websites hit by cyber attacks as EU voting startsThis post details Cloudflare's mitigation of significant DDoS attacks targeting Dutch political websites during the European Parliament election. It quantifies attack volumes (billions of HTTP requests, tens of thousands of requests per second) and provides specific peak times and durations for two distinct attacks. It also contextualizes these attacks within broader geopolitical events and links to relevant resources for DDoS defense and election insights.
  154. Disrupting FlyingYeti's campaign targeting UkraineThis post details Cloudforce One's proactive disruption of the FlyingYeti phishing campaign targeting Ukraine. It describes the campaign's background, including the use of debt-themed lures and the COOKBOX PowerShell malware, and the exploitation of the WinRAR vulnerability CVE-2023-38831. The post outlines the technical details of the attack infrastructure, including the use of Cloudflare Workers and GitHub, and the analysis of the malicious RAR file. It also details the countermeasures taken by Cloudforce One, such as remediating the actor-associated Worker and developing detections, which significantly prolonged the actor's operational timeline and prevented them from achieving their objectives.
  155. Unified Risk Posture Management by Cloudflare | Use CasesThis post introduces Cloudflare for Unified Risk Posture, a new suite that converges SASE and WAAP capabilities onto Cloudflare's global network. It enables automated and dynamic risk posture enforcement by evaluating risk across people (UEBA, user risk scores) and applications (malicious payload, zero-day threat, bot detection models), exchanging risk indicators with partners (EPP, IDP, SIEM, XDR), and enforcing automated risk controls at scale. Key integrations announced include sharing Cloudflare Zero Trust and email log data with CrowdStrike Falcon Next-Gen SIEM, and sharing Cloudflare's user risk score with Okta for access policy enforcement. New first-party UEBA models, including user risk scores based on device posture checks, are also coming soon. The post details a use case for enforcing Zero Trust with Cloudflare and CrowdStrike, outlining a workflow for automated investigation, Zero Trust enforcement, and remediation.
  156. How Cloudflare Cloud Email Security protects against the evolving threat of QR phishingThis post details Cloudflare's evolution in detecting and mitigating quishing (QR phishing) attacks. It explains how quishing bypasses traditional URL/attachment-based detection by embedding malicious links within QR codes, which require a computer vision engine to scan. Cloudflare's approach involves two parts: 1) QR code detection and scanning using specialized heuristics and computer vision models, and 2) analysis of decoded QR codes using existing phishing detection engines, URL deconstruction, attachment scanning, and decryption capabilities. The post highlights the challenges of obfuscated QR codes and the need for continuous updates to detection tools. It also discusses overcoming CAPTCHAs and conditional blocks in redirect chains using specialized tools and ML models for link reputation analysis. Real-world examples of quishing attacks impersonating Microsoft and DocuSign are provided.
  157. DDoS threat report for 2024 Q1This post details the Q1 2024 DDoS threat landscape, highlighting a 50% year-over-year increase in mitigated attacks to 4.5 million. It notes an 80% YoY surge in DNS-based DDoS attacks, which now constitute 54% of network-layer attacks. The report also discusses the emergence of HTTP/2 Continuation Flood as a new, potentially severe attack vector, detailing its technical mechanism and impact, while confirming Cloudflare's network is not affected. It also mentions the continued prevalence of Mirai-variant botnets and the growth of Jenkins Flood attacks.
  158. An Internet traffic analysis during Iran's April 13, 2024, attack on IsraelThis post analyzes internet traffic patterns in Israel and the Palestinian territories during Iran's April 13, 2024, attack. It observed a surge in traffic in Israel as people sought news and a noticeable drop in traffic in the Palestinian territories. The post also notes the absence of a coordinated large cyberattack on Israeli domains protected by Cloudflare, while highlighting ongoing DDoS attacks targeting the Government Administration sector. This contributes to the understanding of how Cloudflare's threat management capabilities are applied during significant geopolitical events and the types of attacks it monitors.
  159. How we ensure Cloudflare customers aren't affected by Let's Encrypt's certificate chain changeThis post details Cloudflare's proactive approach to managing the upcoming Let's Encrypt certificate chain change. It explains how Cloudflare will migrate customer certificates to ensure compatibility with legacy devices that might not support the new chain, thereby preventing service disruptions. The post also highlights the robustness of Cloudflare's TLS certificate pipeline, emphasizing its ability to ensure certificate availability, handle CA outages, adopt best security practices like 90-day certificate lifetimes, and support modern cryptographic standards like ECDSA, all to maintain a secure and accessible internet for everyone.
  160. New tools for production safety — Gradual deployments, Source maps, Rate Limiting, and new SDKsThis post introduces a new Rate Limiting API that can be directly accessed from Cloudflare Workers at runtime. Previously, rate limiting was primarily configured via the dashboard or API. This new API allows for dynamic enforcement of rate limits, enabling more granular control based on application needs, customer tiers, and specific scenarios. It is backed by memcached for speed and is designed to be easily integrated into Workers. This significantly enhances the flexibility and power of Cloudflare's rate limiting capabilities, moving beyond static configurations to dynamic, code-driven enforcement.
  161. Upcoming Let’s Encrypt certificate chain change and impact for Cloudflare customersThis post details Cloudflare's proactive management of a critical upcoming change in Let's Encrypt's certificate chain, which will impact legacy devices. Cloudflare is transitioning to Let's Encrypt's ISRG Root X1 chain and provides guidance for customers to mitigate potential client-side issues, including options for Enterprise customers to switch to Google Trust Services. The post also reflects on past advancements in TLS adoption and PKI agility, highlighting Cloudflare's commitment to supporting new security standards for a more secure internet.
  162. Protocol detection with Cloudflare GatewayIntroduced protocol detection to Cloudflare Gateway, allowing for filtering of network traffic based on protocol signatures (e.g., SSH, HTTP, MQTT) rather than solely relying on port numbers. This was implemented by adding a TCP socket pre-read hook to OXY, Cloudflare's Rust-based policy framework, to buffer initial data bytes for comparison against a protocol signature database. This enables more precise security policies and reduces the risk of over/under-filtering.
  163. Network performance update: Security Week 2024This post provides an update on Cloudflare's network performance benchmarking, highlighting continued leadership in 95th percentile TCP connection times. It details the methodology for data collection using Real User Measurements (RUM) and the refinement of this methodology to use a fixed list of the top 1000 networks for consistent analysis. The post emphasizes the significant performance gains achieved through the adoption and utilization of HTTP/3, demonstrating a 116ms improvement in P95 connection times compared to non-HTTP/3 enabled zones. It also presents comparative data against competitors like Amazon CloudFront, Google, Akamai, and Fastly, showcasing Cloudflare's consistent speed advantage.
  164. Cloudflare’s URL Scanner, new features, and the story of how we built itThis post details the integration of the URL Scanner with Cloudflare's Security Center, enabling users to access scan history and reports directly within the Investigate Portal. It also introduces new features for the URL Scanner API, including custom HTTP headers, multi-device screenshots, and enhanced search functionality. The technical implementation leverages Cloudflare Workers, Durable Objects, R2, Queues, and the Browser Rendering API, with a focus on reusing browser instances across scans via a Browser Pool and Browser Controller.
  165. Advanced DNS Protection: mitigating sophisticated DNS DDoS attacksIntroduced the Advanced DNS Protection system, a new defense mechanism against sophisticated DNS-based DDoS attacks. This system complements existing DDoS defenses by leveraging a stateful mitigation platform called `flowtrackd` and a distributed, gossip-based threat intelligence sharing mechanism. It aims to address attacks that are difficult to mitigate with traditional fingerprinting methods, particularly randomized and DNS laundering attacks. New DNS-centric data points have also been added to the Network Analytics dashboard and GraphQL API.
  166. Collect all your cookies in one jar with Page Shield Cookie MonitorIntroduced Page Shield Cookie Monitor, a feature that automatically collects and displays all first-party cookies used by a website in a single dashboard. This eliminates the need for manual scanning bots and complex configurations. The feature provides detailed cookie attributes, first/last seen times, and pages, along with exportable CSV data and new alert types for newly detected cookies. The underlying mechanism observes `Set-Cookie` headers and compares them with returned cookies to identify first-party cookies, even those set by third-party snippets.
  167. Zero Trust WARP: tunneling with a MASQUEThis post details the integration of the MASQUE protocol into Cloudflare's Zero Trust WARP offering. MASQUE, built on HTTP/3 and QUIC, replaces WireGuard as the tunneling protocol. Key technical benefits include leveraging standard port 443 for improved connectivity across restrictive networks, offering FIPS-compliant cipher suites via TLS 1.3, and providing a more extensible protocol for future Zero Trust solutions. The implementation leverages Cloudflare's existing global network infrastructure for MASQUE, HTTP/3, and QUIC, ensuring proven reliability and scale.
  168. Secure your unprotected assets with Security Center: quick view for CISOsThis post introduces new insights within Cloudflare's Security Center to provide CISOs and security teams with a quick view of Cloudflare product deployment and optimization status across their infrastructure. It highlights specific areas like WAF, Access, and Email Security configuration, and introduces the ability to export these insights via API and directly from the dashboard. The feature aims to close security gaps by identifying underconfigured or unutilized security services and unprotected assets.
  169. Protecting APIs with JWT ValidationThis post announces the General Availability (GA) of JWT validation in Cloudflare's API Gateway. It details the improvements made since the beta release, including support for Bearer token format, multiple JWKS configurations, validation of JWTs in cookies, and the ability to exclude managed endpoints. The post also explains the threat of broken authentication and authorization, provides a primer on JWT structure and its security benefits, and illustrates how JWT validation protects against missing/broken authentication and expired token reuse.
  170. Announcing two highly requested DLP enhancements: Optical Character Recognition (OCR) and Source Code DetectionsThis post introduces two new capabilities to Cloudflare's DLP service: OCR for image-based data detection and predefined source code detections for various programming languages. OCR allows DLP policies to scan images for sensitive text, while source code detections leverage machine learning models trained on public repositories to identify and block code exfiltration. The post details how to configure these features within DLP policies, including selecting language profiles and enabling OCR for inline blocking via Secure Web Gateway and data-at-rest scanning via CASB.
  171. Cloudflare announces Firewall for AIIntroduces Firewall for AI, a new protection layer for Large Language Models (LLMs). This feature extends existing WAF capabilities like Rate Limiting and Sensitive Data Detection to address LLM-specific threats such as prompt injection, data exfiltration, and model denial of service. It analyzes user prompts to identify and block abuse attempts before they reach the LLM, and can be deployed in front of models hosted on Cloudflare Workers AI or other infrastructures.
  172. Changing the industry with CISA’s Secure by Design principlesThis post details Cloudflare's commitment to CISA's 'Secure by Design' principles, highlighting how memory-safe languages like Rust are used in critical components like the WAF and HTTP proxy (Pingora), and how Zero Trust principles are applied by default. It also emphasizes the free offering of Universal SSL, unmetered DDoS mitigation, MIGP for credential checking, WAF Managed Rulesets, and post-quantum cryptography, all of which contribute to a more secure internet by default.
  173. Dispelling the Generative AI fear: how Cloudflare secures inboxes against AI-enhanced phishingThis post details how Cloudflare's email security models are being enhanced to defend against AI-generated phishing and Business Email Compromise (BEC) attacks. It explains how LLMs can be used by attackers to create more convincing emails, but also highlights the inherent limitations and trade-offs. Cloudflare's existing machine learning systems, trained on billions of messages, are already equipped to detect these AI-enhanced threats by analyzing multiple signals beyond just text, including sender reputation, domain authenticity, communication patterns, and metadata. The post provides examples of how these signals are used to identify malicious emails, such as domain mismatches and recently registered domains, and discusses the importance of opportunity and data availability as bottlenecks for AI-driven attacks. It also reiterates the effectiveness of Cloudflare's existing email security products in protecting customers.
  174. Navigating the maze of Magecart: a cautionary tale of a Magecart impacted websiteThis post details the discovery and analysis of a Magecart-style attack script that impersonates jsDelivr, steals PII and credit card details, and exfiltrates data to a malicious server. The script uses obfuscation, Base64/URL encoding, and local storage for stealth. Cloudflare's Page Shield ML model successfully detected this novel attack script, highlighting its evolving capabilities in identifying sophisticated client-side threats.
  175. Introducing behavior-based user risk scoring in Cloudflare OneIntroduces user risk scoring within Cloudflare One, leveraging AI/ML to analyze real-time user activity telemetry and identify abnormal behaviors. This feature assigns Low, Medium, or High risk scores to users based on predefined and custom behavioral rules, such as 'impossible travel' and Data Loss Prevention (DLP) triggers. The system analyzes existing Zero Trust logs without collecting additional user data, enabling dynamic security posture adjustments.
  176. polyfill.io now available on cdnjs: reduce your supply chain riskThis post introduces an alternative, Cloudflare-hosted endpoint for polyfill.io on cdnjs. This directly addresses supply chain risks associated with third-party JavaScript libraries by offering a more secure and reliable hosting option. It also highlights Cloudflare's commitment to web security by providing this alternative and mentions the development of Page Shield for detecting and mitigating such attacks.
  177. Thanksgiving 2023 security incidentThis post details a security incident where a threat actor gained access to Cloudflare's internal Atlassian servers using unrotated credentials from a previous Okta compromise. The incident involved reconnaissance, access to Jira, Confluence, and Bitbucket, and attempts to gain further access. Cloudflare's response involved a 'Code Red' remediation effort, including rotating over 5,000 production credentials, physically segmenting systems, reimaging and rebooting global network machines, and replacing hardware in a new data center. The post emphasizes the effectiveness of Cloudflare's Zero Trust architecture in limiting lateral movement and protecting customer data, while also highlighting lessons learned regarding internal credential management and system hardening.
  178. Cyber attacks targeting Jewish and Holocaust educational websites surge by 872% in 2023Mitigated 35.7 million malicious HTTP requests targeting Jewish and Holocaust educational websites in 2023, a 2,190% increase from 2022. The share of mitigated requests for these websites grew from 0.3% in 2022 to 2.6% in 2023, an 872% year-over-year growth. This surge in cyber attacks against these specific websites coincides with a 27% increase in DDoS attacks against Israeli websites.
  179. How Cloudflare’s AI WAF proactively detected the Ivanti Connect Secure critical zero-day vulnerabilityThis post details how Cloudflare's AI-powered WAF Attack Score and Emergency Rules proactively detected and mitigated the Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887). It provides a technical analysis of the exploit techniques, including directory traversal and command injection via Python reverse shells, and explains how the WAF Attack Score (specifically the RCE score) identified these malicious requests. The post also highlights the rapid deployment of Emergency Rules to block these specific threats, demonstrating the effectiveness of Cloudflare's AI-driven security approach in protecting customers against undisclosed vulnerabilities.
  180. DDoS threat report for 2023 Q4This post details the evolution of DDoS attack trends observed in Q4 2023 and throughout the year. It highlights a significant increase in network-layer DDoS attacks (117% YoY) and a decrease in HTTP DDoS attacks (20% YoY). It also details specific attack patterns related to geopolitical events (Israel-Hamas conflict, Taiwan tensions) and major conferences (COP 28). A key technical contribution discussed is the mitigation of hyper-volumetric DDoS attacks exploiting an HTTP/2 vulnerability, including the largest attack ever seen by Cloudflare (201 million rps). The post also quantifies the volume of mitigated HTTP and network-layer attacks, and analyzes attack targets by industry and region.
  181. Introducing Cloudflare’s 2024 API security and management reportThis post introduces Cloudflare's 2024 API security and management report, which is based on real traffic data rather than user surveys. It highlights the significant discovery of 'Shadow APIs' (30.7% more endpoints found via ML-based discovery than self-reported) and emphasizes the importance of accurate API inventories. It also details best practices for API rate limiting, recommending session IDs over IP addresses and suggesting HTTP 429 as a response code. The post also stresses the need for WAF protection for APIs against OWASP Top 10 style attacks and provides statistics on common API threats seen by Cloudflare's WAF.
  182. Privacy Pass: upgrading to the latest protocol versionThis post details the upgrade of the Privacy Pass protocol to its latest IETF draft version. It introduces new open-source templates for Privacy Pass Origins, Issuers, and Attesters based on Cloudflare Workers, and releases updated browser extensions named 'Silk - Privacy Pass Client'. The post also discusses the deprecation of the Privacy Pass API for configuration and highlights the integration of Privacy Pass as a signal in Cloudflare's Web Application Firewall and Bot Management products, as well as Apple's Private Access Tokens system.
  183. Integrating Turnstile with the Cloudflare WAF to challenge fetch requestsThis post details the integration of Cloudflare Turnstile with the Cloudflare Web Application Firewall (WAF) to enable the challenging of browser-initiated API calls (fetch requests). Previously, fetch requests that were challenged by the WAF would fail because the browser could not render the HTML required to solve the challenge. This integration introduces "Turnstile Pre-Clearance mode," which allows Turnstile to issue a `cf_clearance` cookie for the domain it's embedded on. This cookie enables WAF rules to allow subsequent fetch requests to pass through without further challenges after the user has completed a Turnstile challenge on the page. The post provides a practical example of implementing this by overriding the `fetch()` function to invoke Turnstile when a `cf-mitigated` header indicates a challenge is required, and then replaying the request with the obtained `cf_clearance` cookie.
  184. 2024, the year of electionsThis post details the increased threat landscape against election entities, with a focus on HTTP Anomaly and SQL Injection as top attack vectors mitigated by the WAF. It highlights the significant volume of threats mitigated for U.S. election groups, political campaigns, and voting rights organizations, and discusses traffic trends observed during election periods. The post also touches on the increasing adoption of .gov domains and the use of managed rulesets by organizations with limited security resources.
  185. Introducing hostname and ASN lists to simplify WAF rule creationIntroduced hostname and ASN list types to Cloudflare's Custom Lists feature, expanding on the existing IP list functionality. These new list types are available on all Enterprise plans and can be used in WAF rules to match against http.host and ip.src.asnum fields respectively. The post details the usage of these lists, including wildcard support for hostnames and considerations for using ASN lists. It also outlines quota limits for custom lists and previews the upcoming string list type.
  186. Introducing HAR Sanitizer: secure HAR sharingIntroduced HAR Sanitizer, a client-side tool built on Cloudflare Workers, to remove session-related cookies and JWTs from HAR files, mitigating attacks that exploit stolen session tokens. The tool is open-sourced and available at no cost. It includes specific tuning for Cloudflare Access JWTs by stripping the cryptographic signature while preserving debugging information. Future enhancements will include DLP scanning and automated sanitization in collaboration tools.
  187. DDoS threat report for 2023 Q3This post details the evolution of Cloudflare's DDoS mitigation capabilities, specifically highlighting the unprecedented scale of HTTP/2 Rapid Reset attacks in Q3 2023. It quantifies the increase in HTTP DDoS traffic (65% QoQ) and L3/4 DDoS attacks (14% QoQ), detailing the largest attacks observed (201M rps for HTTP, 2.6 Tbps for L3/4). It also discusses the shift in targeted industries and the sources of these attacks, including the impact of VM-based botnets and the exploitation of HTTP/2. The post also references an engineering blog post for a deeper technical dive into the HTTP/2 Rapid Reset vulnerability and mitigation strategies.
  188. Cyber attacks in the Israel-Hamas warThis post details Cloudflare's response to significant DDoS attacks targeting Israeli websites during the Israel-Hamas war, including mitigation of attacks peaking at 1M rps. It also highlights the discovery and analysis of malicious Android applications impersonating legitimate alert apps, which exfiltrated sensitive user data. The post provides statistics on targeted industries and attack volumes against both Israeli and Palestinian websites, underscoring the role of Cloudflare's security services in conflict zones.
  189. How Cloudflare mitigated yet another Okta compromiseThis post details Cloudflare's response to a security incident where threat actors leveraged a compromised Okta authentication token to pivot into Cloudflare's Okta instance. It highlights the effectiveness of Cloudflare's Security Incident Response Team (SIRT) in detecting the compromise early (over 24 hours before Okta's notification), validating the scope using Zero Trust Access, Gateway, and Data Loss Prevention tools, and containing the incident before any customer data or systems were impacted. The post also provides specific recommendations for Okta and its customers to improve security practices, emphasizing hardware MFA, session management, and comprehensive monitoring.
  190. Malicious “RedAlert - Rocket Alerts” application targets Israeli phone calls, SMS, and user informationThis post details the analysis of a malicious Android application impersonating a legitimate rocket alert app. It describes how the attackers created a malicious website that offered a modified APK for download, which, when installed, collected sensitive user data including contacts, call logs, SMS, account information, and installed apps. The analysis includes the specific Android permissions requested by the malicious app, the structure of the malicious code within the APK, how stolen data is encrypted (AES with RSA public key) and uploaded to a command and control server, and the anti-analysis techniques employed (anti-debugging, anti-emulation, anti-test). It also provides IOCs such as the malicious download URL, C2 IP address, APK SHA-256 hash, and the public RSA key, along with recommendations for detection and protection.
  191. HTTP/2 Rapid Reset: deconstructing the record-breaking attackThis post details the HTTP/2 Rapid Reset attack (CVE-2023-44487), a novel DDoS vector that exploits the HTTP/2 protocol's RST stream mechanism to generate massive request volumes with minimal botnet resources. It explains the HTTP/1.1 and HTTP/2 protocols, the stream lifecycle, and how the RST_STREAM frame can be abused. Cloudflare's mitigation strategies, including automated DDoS system enhancements and coordinated disclosure with Google and AWS, are discussed. The post also provides technical details on the attack's mechanics and the protocol features exploited.
  192. HTTP/2 Zero-Day vulnerability results in record-breaking DDoS attacksThis post details Cloudflare's response to a novel zero-day vulnerability in the HTTP/2 protocol, dubbed 'HTTP/2 Rapid Reset'. It describes how the vulnerability was exploited to generate hyper-volumetric DDoS attacks, including an attack exceeding 201 million requests per second. Cloudflare mitigated these attacks by developing purpose-built technology and collaborating with industry partners for responsible disclosure and patching. The post also provides recommendations for CSOs on how to protect their organizations.
  193. Uncovering the Hidden WebP vulnerability: a tale of a CVE with much bigger implications than it originally seemedThis post details Cloudflare's discovery and rapid response to the WebP vulnerability (CVE-2023-4863), which stemmed from a heap buffer overflow in the libwebp library. Cloudflare identified the vulnerability's root cause in libwebp, distinct from its initial description as a Chrome-specific issue. They utilized an unreleased patch for libwebp to update their own services, which are written in Rust. Patches were submitted to Rust packages containing libwebp, and RustSec advisories (RUSTSEC-2023-0061 and RUSTSEC-2023-0062) were filed, informing the broader Rust ecosystem. The post highlights the interconnectedness of the internet ecosystem and the importance of swift, collaborative security responses.
  194. All Cloudflare customers protected from the Atlassian Confluence CVE-2023-22515This post details the proactive deployment of new managed WAF rules (Rule ID …ec9f34e1, Legacy Managed Rules 100604 and 100605, Free Managed Rule …91935fcb) to protect all Cloudflare customers against the CVE-2023-22515 Atlassian Confluence privilege escalation vulnerability. The rules were developed and deployed within hours of Atlassian releasing details of the zero-day.
  195. Waiting Room adds multi-host and path coverage, unlocking broader protection and multilingual setupsThis post announces a significant enhancement to Cloudflare Waiting Room, enabling it to protect multiple hostname and path combinations with a single waiting room configuration. This addresses a key customer need for broader site coverage and more flexible deployment, particularly for complex site structures like those using subdomains for different sections (e.g., checkout) or for multilingual sites. The update allows for a unified waiting room experience across these diverse configurations, simplifying management and improving end-user journeys during traffic surges. It also provides guidance and starter templates for implementing multi-language waiting rooms.
  196. Encrypted Client Hello - the last puzzle piece to privacyIntroduced Encrypted Client Hello (ECH) as a successor to ESNI, making it available on all Cloudflare plans. ECH masks the Server Name Indication (SNI) during TLS handshakes by splitting the ClientHello message into an encrypted inner part containing the actual server name and an outer part with a shared SNI (cloudflare-ech.com). This prevents network intermediaries from snooping on visited websites, enhancing user privacy. Cloudflare is actively promoting ECH adoption and has enabled it for all free zones.
  197. Detecting zero-days before zero-dayThis post details the evolution of Cloudflare's Web Application Firewall (WAF) towards achieving zero time to mitigation for zero-day exploits. It introduces the use of machine learning algorithms, trained on a combination of real-world traffic (leveraging signatures and bot management data) and synthetically generated data, to classify and block novel attack vectors. The post outlines a three-step process: creating a training set from existing signatures and true negatives, enhancing this set with artificial data, and building a fast inline classifier. It emphasizes the limitations of signature-based detection for zero-days and the necessity of ML for rapid threat response.
  198. Cloudflare is free of CAPTCHAs; Turnstile is free for everyoneThis post announces the full integration of Turnstile, Cloudflare's CAPTCHA replacement, across all Cloudflare-issued challenges, effectively eliminating CAPTCHAs for all users. It also details the decoupling of Turnstile from the Cloudflare platform, making it available as a free, unlimited service for all website operators. The post elaborates on Turnstile's technical approach, emphasizing its privacy-preserving nature, WCAG 2.1 Level AA compliance, and bot detection mechanisms that rely on in-browser tests and analysis of browser characteristics rather than visual puzzles. It highlights successful deployments, including protecting Cloudflare's own signup flow and handling the Eurovision voting traffic. Lessons learned from the beta, such as improved error reporting for system time inaccuracies and privacy-related browser configurations, are also discussed, along with the introduction of a user feedback form.
  199. Easily manage AI crawlers with our new bot categoriesIntroduced new Verified Bot categories (AI Crawler, Search Engine Crawler, etc.) available in the Cloudflare Rules Engine and Workers. These categories allow users to create granular firewall rules and Workers logic to manage specific types of bots. Defined criteria for 'respectful AI bots' and updated the Verified Bots policy. Announced plans for more detailed reporting on bot category traffic.
  200. Cloudflare is now powering Microsoft Edge Secure NetworkThis post announces a partnership with Microsoft Edge to power its Secure Network VPN. It details how Cloudflare's Privacy Proxy Platform, utilizing HTTP CONNECT, 1.1.1.1 for DNS, and Privacy Pass for authentication, provides a private and secure VPN experience directly within the browser. It highlights the platform's ability to maintain geolocation parity and leverage Cloudflare's global network for low latency and performance benefits, extending the company's security offerings into browser-level privacy.
  201. Amazon’s $2bn IPv4 tax — and how you can avoid paying itThis post details how Cloudflare can help users avoid AWS's new IPv4 charges by facilitating a transition to IPv6. It explains the technical steps involved in enabling IPv6 compatibility on Cloudflare and configuring AWS origins for IPv6. It also provides a credit incentive for Pro/Business subscribers who adopt this feature. The post also elaborates on the technical reasons behind IPv4 exhaustion and the advantages of IPv6.
  202. Switching to Cloudflare can cut your network carbon emissions up to 96% (and we're joining the SBTi)This post quantifies the carbon emission reductions achieved by migrating enterprise network services to Cloudflare's global network, citing an independent report that found up to 96% reduction. It details how consolidation of services improves carbon efficiency through increased server utilization. The post also announces Cloudflare's application to join the Science Based Targets initiative (SBTi) to set science-based carbon reduction targets across its operations, facilities, and supply chain.
  203. How Waiting Room makes queueing decisions on Cloudflare's highly distributed networkThis post details the evolution of Cloudflare Waiting Room's queuing decision algorithm. It explains how the system now makes decisions at the worker level, distributing available slots based on historical traffic patterns ('trafficHistory') and active workers ('globalWorkersActive', 'dataCenterWorkersActive'). The algorithm aims to balance admitting users to the origin with queuing excess traffic, using configured limits ('total active users', 'new users per minute') and session duration to manage user sessions. The use of Durable Objects for state aggregation and encrypted cookies for tracking admitted users is also highlighted.
  204. New! Rate Limiting analytics and throttlingIntroduced Rate Limit Analysis within Security Analytics to provide data-driven insights for setting rate limiting thresholds. This includes analyzing request rates based on IP, JA3 fingerprint, or a combination, over various time intervals. Also introduced a new 'throttle' behavior for rate limiting rules, which selectively drops requests to maintain a defined rate threshold, as an alternative to the 'fixed action' behavior.
  205. Making Content Security Policies (CSPs) easy with Page ShieldThis post introduces full support for all major Content Security Policy (CSP) directives within Cloudflare Page Shield. It details the enhanced policy builder with smarter suggestions for `script-src` and `connect-src`, customization based on policy application context, and the ability to import existing CSP policies. The post also highlights improved violation reporting and the `upgrade-insecure-requests` directive.
  206. Cloudflare’s tenant platform in action: Meter deploys DNS filtering at scaleThis post details how Meter leverages the Cloudflare Tenant API and Cloudflare Gateway for DNS filtering. It highlights the implementation of parent-child policy configurations, allowing for granular control across different customer locations (offices, warehouses). Technical details include the use of Gateway locations defined as IPv4, IPv6, DoH, and DoT endpoints, customizable block pages, and the ability for customers to upload their own certificates for custom block pages.
  207. Application Security Report: Q2 2023This report details Q2 2023 application security trends, showing that WAF custom rules are now the biggest contributor to mitigated traffic, with geolocation blocks being a common technique. Old CVEs continue to be exploited, and broken authentication rules are increasing.
  208. Introducing per hostname TLS settings — security fit to your needsIntroduced per-hostname TLS settings, allowing granular control over minimum TLS versions and cipher suites for individual hostnames within a domain. This supersedes zone-level settings and addresses the trade-off between adopting modern, secure protocols and maintaining compatibility with legacy clients and devices.
  209. Unmasking the top exploited vulnerabilities of 2022This post analyzes Cloudflare's observed attack traffic volume for the top exploited vulnerabilities of 2022, as highlighted by a CISA report. It details the prevalence of Log4J (CVE-2021-44228) and Atlassian Confluence Code Injection (CVE-2022-26134) as the most exploited, providing specific CVEs and attack trends for Microsoft Exchange, F5 BIG-IP, and VMware vulnerabilities. It also details the emergency WAF rule releases and the extension of WAF Managed Rules for high-impact vulnerabilities to all plans, including Free.
  210. Cloudflare Radar's new BGP origin hijack detection systemIntroduced a BGP origin hijack detection system integrated with Cloudflare Radar. The system uses a Rust-based custom IP prefix trie to process BGP update messages, detect origin changes, and identify potential hijack events. It leverages data from live BGP streams and historical archives (RouteViews, RIPE RIS) to provide public detection results and APIs for integration into user workflows.
  211. DDoS threat report for 2023 Q2This post details Cloudflare's Q2 2023 DDoS threat landscape, highlighting the increase in sophisticated and randomized HTTP DDoS attacks, a surge in DNS-based attacks including DNS Laundering, and the impact of hacktivist groups. It describes the technical challenges in mitigating highly randomized HTTP attacks that mimic browser behavior and the analysis of DNS Laundering attacks that leverage recursive DNS resolvers. The post also details the detection and mitigation of large-scale DDoS attacks, including an ACK flood from a Mirai-variant botnet and attacks associated with the 'Darknet Parliament' hacktivist alliance, providing insights into attack vectors, target industries, and mitigation strategies.
  212. Quickly see differences between Zone Versions with Version ComparisonsThis post introduces 'Version Comparisons' for Zone Versioning, a new capability that allows Enterprise customers to perform side-by-side diffs of their zone configurations between different versions. This directly addresses the challenge of manually inspecting configuration changes, making it easier and safer to evaluate and deploy new versions of zone configurations by providing a diff-like experience within the Cloudflare dashboard.
  213. DLP Exact Data Match beta now availableIntroduces Exact Data Match (EDM) for Data Loss Prevention (DLP). EDM allows customers to securely provide lists of sensitive data (e.g., credit card numbers, names, addresses) which are then hashed before reaching Cloudflare. Cloudflare scans traffic or repositories for matches of these hashes, enabling targeted DLP detections and reducing false positives compared to generic pattern matching. The feature includes a mechanism for uploading DLP datasets and integrating them into DLP profiles for inline scanning with Gateway or data-at-rest scanning with CASB.
  214. Bring your own CA for client certificate validation with API ShieldIntroduced the ability for customers to upload their own Certificate Authorities (CAs) to API Shield for mutual TLS (mTLS) client certificate validation. This allows customers to leverage their existing PKI infrastructure or meet regulatory requirements by using CAs other than the self-signed CA previously provided by Cloudflare. The feature supports uploading up to five CAs per account and associating them with specific hostnames via the API Shield hostname association API. It also includes a logging mechanism via Firewall rules to test setup before enforcing validation.
  215. How we scaled and protected Eurovision 2023 voting with Pages and TurnstileThis post details the integration of Cloudflare Turnstile with the Eurovision voting API endpoints to validate online votes and prevent fraudulent requests from emulated browsers. It also highlights the use of Cloudflare CDN, DDoS protection, and WAF to mitigate attacks during the event.
  216. Descale your network with Cloudflare’s enhanced Descaler ProgramThe Descaler Program has been enhanced with new features to accelerate the migration of Zscaler configurations to Cloudflare One. These enhancements include the ability to export configurations in a shareable Terraform file, enabling infrastructure-as-code management, and the addition of a summary output that details migratable objects. These improvements reduce migration time from days to hours and address customer feedback regarding workflow integration and visibility.
  217. How we think about Zero Trust PerformanceThis post details Cloudflare's approach to measuring and optimizing Zero Trust performance. It argues for end-to-end HTTP response time as the primary metric, contrasting it with proxy latency and decrypted latency SLAs. The post explains the importance of last-mile peering, cloud peering, and diverse network paths for achieving optimal Zero Trust performance. It also outlines the methodology for performing these measurements using client programs that connect to enterprise websites through Cloudflare's Zero Trust services.
  218. Donning a MASQUE: building a new protocol into Cloudflare WARPThis post introduces MASQUE, a new protocol for Cloudflare WARP that extends HTTP/3 and QUIC to proxy IP and UDP traffic. It aims to improve internet browsing speed and stability, offering a standards-based alternative to WireGuard with better extensibility and resilience. The integration of MASQUE into WARP is a significant step towards enhancing the security and performance of Cloudflare's consumer and enterprise offerings, particularly within the Zero Trust suite.
  219. Spotlight on Zero Trust: we're fastest and here's the proofThis post details performance testing methodology and results for Cloudflare's Zero Trust offerings (SWG, ZTNA, RBI) against competitors (Zscaler, Netskope, Palo Alto Networks). It explains the importance of performance in Zero Trust adoption, the testing setup involving VMs in 12 regions, and the metrics used (95th percentile HTTP response time). It highlights Cloudflare's speed advantage attributed to its global network, extensive peering, and local presence, providing specific performance comparisons and regional data.
  220. Protecting GraphQL APIs from malicious queriesThis post details the development of a custom, low-latency, no-heap-allocation GraphQL parser for Cloudflare's API Gateway. The parser tokenizes GraphQL queries to calculate query depth and size without building a full Abstract Syntax Tree, enabling the collection of these metrics for security analysis. It handles both JSON-encoded and raw GraphQL requests, using `serde_raw_value` for JSON parsing to avoid heap allocations. The parser achieves a p95 parsing time of 25 microseconds and introduces three new Wirefilter fields for customers to implement GraphQL-specific security rules.
  221. Understand the impact of Waiting Room settings with Waiting Room AnalyticsIntroduced Waiting Room Analytics, providing detailed metrics and visualizations of waiting room traffic, including time in queue, time on origin, active users, and new users per minute. This enables users to understand the impact of Waiting Room settings on user experience and make informed configuration decisions.
  222. Cloudflare is faster than Netskope and Zscaler across LATAMThis post introduces performance benchmarks comparing Cloudflare Access against Zscaler and Netskope across 10 Latin American countries. It details the testing methodology, focusing on 95th percentile Time to First Byte and Response times from an end-user perspective. The data shows Cloudflare Access to be significantly faster, attributing this to its larger data center presence in LATAM and optimized network performance.
  223. SLP: a new DDoS amplification vector in the wildThis post details the discovery of CVE-2023-29552, a new DDoS reflection/amplification attack vector leveraging the SLP protocol. It explains the SLP protocol, its exposure on the internet, and its high amplification factor. Cloudflare customers are protected by its automated DDoS protection system. Network operators are advised to block UDP port 427 to prevent their networks from being exploited to launch attacks.
  224. Secure by default: recommendations from the CISA’s newest guide, and how Cloudflare follows these principles to keep you secureThis post details Cloudflare's adoption of 'Secure-by-Design' and 'Secure-by-Default' principles, aligning with CISA's recommendations. It highlights the rewrite of the WAF evaluation engine in Rust for memory safety and performance, and the automatic provisioning of SSL certificates as examples of these principles. The ML-computed WAF Attack Score is presented as a mechanism for protecting against zero-day attacks without manual configuration. Cloudflare Tunnel is also discussed as a secure-by-default solution for network connectivity.
  225. Consent management made easy and clear with Cloudflare ZarazIntroduced the Zaraz Consent Manager, which integrates with Zaraz's existing third-party tool management to provide an opt-in consent modal. This modal allows users to accept or reject all tools with one click, or choose specific purposes. It automatically handles re-emitting pageview events for consented tools to prevent data loss. Basic administrator information and purpose assignment are required for configuration.
  226. DDoS threat report for 2023 Q1This post details the evolving landscape of DDoS attacks in Q1 2023, highlighting the rise of hyper-volumetric attacks powered by VPS-based botnets and the continued prevalence of Ransom DDoS attacks. It showcases Cloudflare's automated mitigation capabilities for large-scale attacks (e.g., 71M rps, 1.3 Tbps) and emphasizes proactive measures, including collaboration with cloud providers and the launch of a free Botnet Threat Feed. The report also provides key statistics on targeted countries and industries, and discusses the shift towards DNS-based attacks as a popular vector.
  227. Protect your domain with Zone HoldsThis post introduces Zone Holds, a new enterprise feature that prevents accidental or malicious takeover of a domain's Cloudflare configuration. It allows account owners to prevent other Cloudflare accounts from adding the same zone, optionally extending this protection to subdomains and custom hostnames. This directly addresses the risk of multiple teams within an organization inadvertently disrupting existing security configurations, ensuring a more controlled and secure environment for managing web properties.
  228. mTLS client certificate revocation vulnerability with TLS Session ResumptionDiscovered and mitigated a bug where revoked mTLS client certificates were not being blocked during TLS session resumption. The issue stemmed from the client certificate chain not being re-checked during session resumption, leading to bypassed revocation status checks. The immediate mitigation involved disabling session resumption for mTLS connections. A permanent fix was then rolled out to re-enable session resumption by ensuring the leaf certificate serial number and issuer SKI are accessible and checked for revocation status in both session resumption and non-resumption scenarios.
  229. Killnet and AnonymousSudan DDoS attack Australian university websites, and threaten more attacks — here’s what to do about itThis post details Cloudflare's observation and mitigation of DDoS attacks targeting Australian universities by Killnet and AnonymousSudan. It explains the nature of these hacktivist groups and their attack methodologies, highlighting the increasing scale and audacity of such attacks. The post also provides specific recommendations for Cloudflare customers to enhance their DDoS protection, including enabling managed rulesets, adaptive DDoS protection, firewall rules, rate-limiting, and bot fight mode, reinforcing the company's commitment to providing unmetered and unlimited DDoS protection.
  230. Out now! Auto-renew TLS certificates with DCV DelegationThis post introduces DCV Delegation, a feature that allows customers managing their DNS externally to offload the Domain Control Validation (DCV) process for TLS certificates to Cloudflare. This enables automatic renewal of TLS certificates without manual intervention, addressing the increased management overhead caused by shorter certificate lifetimes and stricter validation requirements like DNS-based DCV for wildcard certificates. This enhances the overall security and reliability of certificate management for a broader customer base.
  231. Account Security Analytics and Events: better visibility over all domainsIntroduced Account Security Analytics and Account Security Events, providing a holistic view of security traffic across all customer domains. These features offer dashboards for monitoring traffic, identifying threats (e.g., DDoS attacks), and reviewing mitigated requests. They categorize events by security service (WAF, Firewall Rules, API Shield) and action (allow, block, challenge), and allow for detailed filtering to fingerprint attacks. Access is initially provided to Enterprise plan customers.
  232. Wildcard and multi-domain support in Cloudflare AccessIntroduced multi-domain and wildcard support for Cloudflare Access application definitions, allowing a single Access application to protect multiple subdomains or a pattern of hostnames. This simplifies policy management for organizations with numerous subdomains or single-page applications with separate front-end and API hostnames, and ensures consistent JWT cookie issuance across protected hostnames.
  233. Cloudflare partners with KnowBe4 to equip organizations with real-time security coaching to avoid phishing attacksThis post details the integration between Cloudflare Area 1 email security and KnowBe4's SecurityCoach product. It outlines the technical steps required to set up the integration, including creating service accounts and API keys in the Cloudflare Area 1 dashboard and configuring the integration within the KnowBe4 KMSAT console. The post also describes how the integration provides real-time coaching to users when malicious attachments, links, spoofed emails, or suspicious emails are detected by Area 1.
  234. Super Bot Fight Mode is now configurable!Super Bot Fight Mode has been re-architected and integrated as a managed ruleset within the new WAF, allowing for configuration via Custom Rules. This enables a 'skip' action for Custom Rules, which can bypass Super Bot Fight Mode, providing more granular control. A specific configuration option has been added to securely allow WordPress loopback requests. Future plans include migrating the original Bot Fight Mode for Free plan customers.
  235. Announcing Cloudflare Fraud DetectionIntroduces Cloudflare Fraud Detection, a new product designed to detect and categorize various types of online fraud (fake account creation, account takeover, card testing, expediting). It leverages machine learning models and threat intelligence, integrates with existing Cloudflare security products via Firewall Rules, and offers flexible response actions (block, rate-limit, challenge, or send signals via headers). Specific techniques for detecting fake account creation (using signup data and threat intelligence) and expediting (using encrypted tokens to track user flow) are detailed.
  236. Analyze any URL safely using the Cloudflare Radar URL ScannerThis post introduces the Radar URL Scanner, a new free tool that provides a comprehensive report on a given URL, encompassing security (phishing, SSL), cookies, network activity, technologies, DOM, and performance. It leverages Cloudflare's Workers Browser Rendering API and aims to enhance threat modeling and provide aggregate insights into internet trends, thereby extending Cloudflare's capabilities in website security and threat analysis.
  237. Announcing WAF Attack Score Lite and Security Analytics for business customersIntroduced WAF Attack Score Lite and Security Analytics for Business plan customers. WAF Attack Score Lite uses machine learning to classify incoming HTTP requests into four types: Attacks, Likely Attacks, Likely Clean, and Clean, focusing on SQL Injection, Cross-Site Scripting, and Remote Code Execution attacks. Security Analytics provides a dashboard for investigating traffic and false negatives. The `cf.waf.score.class` field is exposed for use in WAF Custom Rules and Rate Limiting Rules.
  238. Automatically discovering API endpoints and generating schemas using machine learningIntroduced machine learning-based API Discovery that continuously identifies all API traffic without requiring session identifiers, overcoming limitations of previous methods. Developed Schema Learning to automatically generate OpenAPI formatted schemas for discovered endpoints in real-time, enabling schema validation for API protection. The ML model uses features from HTTP request/response samples and is trained using the CatBoost library. Feature extraction and model scoring are performed in Rust.
  239. Detecting API abuse automatically using sequence analysisThis post introduces Cloudflare Sequence Analytics for APIs, a new feature within API Gateway. It details the concept of API request sequences, explains their importance for security by enabling positive security models, and outlines the technical challenges of identifying and analyzing these sequences at scale. The post describes the 'Correlation Score' metric used to identify important sequences and shows a dashboard screenshot of the new functionality. It also previews upcoming features like sequence precedence rules.
  240. Using the power of Cloudflare’s global network to detect malicious domains using machine learningThis post details the application of machine learning, specifically transformer-based neural networks, to detect malicious domains. It covers the training of models using DNS resolver data and known DGA domains, achieving over 99% accuracy. It also describes the deployment of these models to process DNS query names from the 1.1.1.1 resolver for real-time detection of DGA domains. Additionally, it introduces a two-stage model for detecting DNS tunneling, distinguishing it from benign applications that use similar query patterns.
  241. How sophisticated scammers and phishers are preying on customers of Silicon Valley BankThis post details a specific SVB-themed KYC phishing campaign leveraging DocuSign branding, observed on March 14, 2023. It outlines the multi-stage redirect chain used by the attackers, starting from a malicious link to a Google Firebase application, then to a WordPress site, and finally to an attacker-controlled domain (docusigning[.]kirklandellis[.]net). It provides Indicators of Compromise (IOCs) such as malicious domains and IP addresses, and offers recommendations for Cloudflare Email Security and Gateway customers, including DMARC policy enforcement and phishing awareness training. The post highlights Cloudforce One's proactive monitoring and detection capabilities for such topical threats.
  242. Cloudflare One DLP integrates with Microsoft Information Protection labelsThis post introduces the integration of Cloudflare One's Data Loss Prevention (DLP) capabilities with Microsoft Purview Information Protection sensitivity labels. This allows organizations to leverage their existing Microsoft data classification and protection tools to identify and control sensitive data movement across corporate traffic managed by Cloudflare One. The integration enables CASB to retrieve Microsoft labels, populate DLP profiles, and build firewall policies to enforce rules based on these labels, extending Microsoft's data protection beyond its native environment.
  243. The state of application security in 2023This post provides updated insights and trends around mitigated traffic, bot and API traffic, and account takeover attacks for Security Week 2023. It details Cloudflare's growth, handling over 45 million HTTP requests/second on average, and defines key terms like 'Mitigated traffic', 'Bot traffic/automated traffic', and 'API traffic'. The report highlights that 6% of daily HTTP requests are mitigated on average, with DDoS mitigation accounting for 52% and WAF for 41%. HTTP Anomaly is the most frequent layer 7 attack vector mitigated by the WAF, though its share has decreased. Bot management has seen significant investment with improved classification of human vs. bot traffic.
  244. Top 50 most impersonated brands in phishing attacks and new tools you can use to protect your employees from themIntroduces new Brand and Phishing Protection tools within Cloudflare's Security Center. These tools leverage DNS query monitoring from 1.1.1.1 to detect newly registered domains and perform fuzzy matching against user-defined patterns to identify and block confusable domains used in phishing attacks. The feature includes real-time alerting, historical search capabilities for the past 30 days, and integration with Cloudflare Gateway and DNS policies for Zero Trust enforcement. Future enhancements will include matching against SSL/TLS certificates and automatic population of managed lists.
  245. Cloudflare Aegis: dedicated IPs for Zero Trust migrationIntroduced Cloudflare Aegis, a feature providing dedicated egress IP addresses for customers. This allows organizations to lock down their services at an IP level, enhancing Zero Trust migration by enabling IP-based access control lists (ACLs) for origins, complementing existing mTLS and Access solutions. Aegis aims to simplify the transition for large organizations with many applications by reducing the complexity of IP allowlisting.
  246. Locking down your JavaScript: positive blocking with Page Shield policiesIntroduces Page Shield policies for positive blocking of client-side JavaScript execution and data destinations. Leverages CSPs (specifically script-src and soon connect-src) to enforce allowed sources. Simplifies policy creation with a suggestions feature based on Page Shield data and wirefilter syntax. Supports report-only and enforcement modes.
  247. Mutual TLS now available for WorkersIntroduced general availability of mTLS support for Cloudflare Workers, enabling Workers to authenticate to services secured by mTLS. This involves uploading client certificates and private keys via `wrangler mtls-certificate upload`, configuring `mtls_certificates` bindings in `wrangler.toml`, and using the `environment.<BINDING>.fetch()` method in Worker code to present the client certificate during the TLS handshake.
  248. Cloudflare mitigates record-breaking 71 million request-per-second DDoS attackThis post details Cloudflare's mitigation of a record-breaking 71 million requests per second (rps) HTTP/2-based DDoS attack. It highlights the scale of the attack, its origin from over 30,000 IP addresses, and the types of targeted websites. The post also announces a free Botnet threat feed for service providers and provides recommendations for customers to optimize their DDoS protection, including enabling managed rulesets, adaptive DDoS protection, firewall and rate limiting rules, securing origin servers, leveraging managed IP lists and bot scores, enabling caching, and utilizing DDoS alerting.
  249. How Cloudflare erroneously throttled a customer’s web trafficThis post details an incident where a Cloudflare engineer erroneously applied a bandwidth throttle to a customer's website traffic due to a misinterpretation of a network congestion alert. The incident highlights a lack of established process for throttling customers and a need for clearer communication and approval workflows for actions that impact customer domains. The post outlines immediate steps to establish multi-level approval for such actions and improve tooling, as well as a commitment to revising terms of service for better clarity.
  250. Cloudflare's handling of a bug in interpreting IPv4-mapped IPv6 addressesThis post details the discovery and remediation of a vulnerability where specific DNS records using IPv4-mapped IPv6 addresses could bypass network policies and connect to loopback or internal IP addresses. The vulnerability arose from two bugs: one in the internal DNS system's serialization of IPv4-mapped IPv6 addresses, and another in the internal HTTP proxy's validation logic which incorrectly compared addresses against the wrong deny list based on the IP family of the DNS API response. A hotpatch was deployed to block exploitation by preventing the creation of such DNS records, followed by a permanent fix in the proxy service to correctly validate IP addresses against the appropriate deny list.
  251. Uptick in healthcare organizations experiencing targeted DDoS attacksThis post details Cloudflare's response to a surge in targeted DDoS attacks against healthcare organizations, attributed to the pro-Russian hacktivist group Killnet. It highlights the automatic detection and mitigation of HTTP DDoS attacks by Cloudflare systems, the variability in attack methods suggesting multiple threat actors or a sophisticated coordinated attack, and provides specific mitigation recommendations for healthcare customers. These recommendations include optimizing DDoS Managed Rules, enabling Adaptive DDoS Protection for Enterprise customers, deploying firewall and rate-limiting rules, securing origin exposure, leveraging Managed IP Lists, enabling caching, and enabling DDoS alerting.
  252. Investing in security to protect data privacyThis post emphasizes the critical role of data security in protecting personal information, arguing that robust security measures are more vital than mere compliance with data protection laws or data localization. It highlights Cloudflare's application layer security services (WAF, bot management, DDoS protection, SSL/TLS) as key defenses against attackers, drawing parallels to airport security. The post also stresses the importance of encryption in transit (Universal SSL) while acknowledging the necessity of inspecting encrypted traffic for malicious code. It further emphasizes the power of Cloudflare's global network in identifying and thwarting global cyber threats in real-time, transforming global learnings into protections for customers.
  253. Cloudflare incident on January 24, 2023This post details a critical incident on January 24, 2023, caused by a bug in the release of a new 'Last seen at' field for service tokens. The bug inadvertently overwrote the 'client_secret' metadata for service tokens, rendering them invalid and causing outages for several Cloudflare services, including Workers, Zero Trust, Cache Purge, Cache Reserve, Images, and R2. The post explains the technical details of the bug, the incident timeline, the fix implemented (manual restoration and database backup), and the root cause analysis, highlighting the importance of robust metadata handling and transactional integrity in authentication systems.
  254. Introducing Waiting Room Bypass RulesIntroduced Waiting Room Bypass Rules, allowing customers to define conditions for traffic that should bypass the waiting room. This feature is built on the Cloudflare Ruleset Engine, providing a unified rule management interface and enabling fine-grained control over which traffic is queued. The post details the implementation of bypass rules via the dashboard and API, with examples for administrative IP bypass and path exclusions. The core bypass action clears a flag that would trigger waiting room logic.
  255. Cloudflare Application Services for private networks: do more with the tools you already loveThis post significantly extends the Website Security & Threat Management feature thread by detailing how Cloudflare's WAF and security controls are now being applied to private networks. It introduces the ability to enforce WAF policies on internal traffic, secure private APIs, and leverage Cloudflare One's dataplane for in-path security for private applications. It also touches upon extending load balancing and performance optimization to private networks.
  256. Cloudflare's CASB integration with Salesforce and BoxThis post announces the release of two new SaaS integrations for Cloudflare CASB: Salesforce and Box. These integrations allow security administrators to scan these platforms for security risks, including insecure settings, inappropriate file sharing, and default permissions. The post highlights the types of sensitive data stored in Salesforce and Box and the potential security threats they pose. It also mentions Cloudflare's existing CASB integrations and encourages users to request new integrations.
  257. Zone Versioning is now generally availableIntroduced Zone Versioning for enterprise customers, enabling versioning of zone configurations and deployment to distinct environments (Development, Staging, Production) using the Ruleset Engine. This allows for safe testing, staged rollouts, and rapid rollbacks of configuration changes, addressing customer pain points around testing and reverting impactful changes.
  258. Email Link Isolation: your safety net for the latest phishing attacksIntroduces Email Link Isolation, a new feature within Cloudflare Area 1 that rewrites potentially malicious email links and uses Cloudflare Browser Isolation as a fallback for suspicious links. This feature aims to provide an additional layer of defense against phishing attacks without impacting user productivity or adding administrative burden.
  259. How Cloudflare CASB and DLP work together to protect your dataThis post details the upcoming integration of Cloudflare CASB and DLP, allowing for the scanning of sensitive data within files stored in SaaS applications. This extends DLP capabilities beyond data-in-transit to data-at-rest within supported SaaS platforms, enabling granular risk assessment and remediation for data exposures.
  260. Announcing Custom DLP profilesIntroduced custom DLP profiles, enabling users to define their own detection patterns using regular expressions within Cloudflare Gateway. This extends DLP capabilities beyond predefined identifiers to detect unique sensitive data like intellectual property and trade secrets. The implementation leverages the Rust regex crate for pattern matching and integrates with HTTP policies for enforcement. The post also outlines the roadmap for future DLP enhancements, including data at rest scanning, minimum match counts, and OCR.
  261. Cloudflare protection for all your cardinal directionsThis post details how Cloudflare's security offerings, particularly through Cloudflare One, now provide comprehensive protection for all traffic flows, regardless of traditional network definitions like north/south and east/west. It highlights the evolution from perimeter security to a cloud-first SASE model, emphasizing Zero Trust Network Access and Secure Web Gateway for internal traffic, and application security and network services for external traffic, effectively unifying security controls across the entire network.
  262. Cloudflare DDoS threat report for 2022 Q4This post details Cloudflare's DDoS threat landscape observations for Q4 2022, including an increase in HTTP DDoS attack traffic YoY, surges in volumetric attacks, and a steady increase in Ransom DDoS attacks. It also introduces updated methodologies for calculating attack traffic percentages, providing more granular insights into targeted industries and countries. The post highlights specific attack trends and provides data on the most targeted sectors and regions globally.
  263. Cloudflare is faster than ZscalerThis post details performance comparisons between Cloudflare's Zero Trust products (Gateway, Access, Browser Isolation) and Zscaler's equivalents (ZIA, ZPA, Cloud Browser Isolation). It quantifies the performance differences using 95th percentile Time to First Byte and Response tests, highlighting Cloudflare's speed advantage. The analysis includes a deep dive into proxy latency, demonstrating that Cloudflare's proxy latency is significantly lower than Zscaler's, often falling within Zscaler's SLA for 90th percentile while Zscaler exceeds its 95th percentile SLA. The post also discusses the importance of performance for user experience and security effectiveness in Zero Trust solutions.
  264. How Cloudflare can help stop malware before it reaches your appIntroduces WAF Content Scanning, a new feature that scans uploaded files for malware. It integrates with the Web Application Firewall (WAF) to block malicious files before they reach application servers. The feature supports scanning files up to 1MB, with plans to increase this limit. It uses heuristic detection for 'content objects' and supports parsing of multipart/form-data, multipart/mixed, and base64 encoded JSON payloads. The scanning engine is deployed locally on each server handling traffic, minimizing latency. The feature separates detection from mitigation, allowing for discovery of file upload endpoints and flexible rule creation using scan results. Custom scan expressions and custom response types are supported for JSON payloads. Future improvements include increasing max content size, adding a 'rewrite' action for quarantine, and enhancing analytics.
  265. The unintended consequences of blocking IP addressesThis post details the unintended consequences of IP address blocking as a method for content moderation, highlighting its technical limitations, opacity to users, and legal/human rights concerns. It explains how shared IP addresses lead to collateral damage, affecting thousands of legitimate websites. The post contrasts IP blocking with more precise methods like DNS manipulation or source-level content removal, and discusses the legal obligations for necessity and proportionality in blocking orders. It advocates for blocking to be a last resort and emphasizes the need for transparency regarding blocked content and the reasons behind it.
  266. More bots, more treesIntroduced a new ruleset engine for Bot Fight Mode, built on the same engine as the new WAF, Transform Rules, and Cache Rules. This provides more flexibility for writing complex rules to catch elusive bots without impacting legitimate traffic. The data from these new detections are used to train the Machine Learning engine. The post also notes a significant reduction in the time bots spend on challenge pages (166% reduction) and a six-fold increase in CPU intensive challenges issued daily.
  267. Cloudflare Zero Trust for Project Galileo and the Athenian ProjectThis post announces the availability of Cloudflare One's Zero Trust suite to organizations qualifying for Project Galileo and the Athenian Project at no cost. It details how specific components of Cloudflare One, such as Area 1 for email security and DNS filtering via 1.1.1.1, can be used to combat phishing attacks. It also explains how Cloudflare Tunnel and WARP can be used for secure employee and partner connectivity, and how the Secure Web Gateway and Data Loss Prevention features protect internet-bound traffic and sensitive data.
  268. Democratizing access to Zero Trust with Project GalileoProject Galileo is extending Cloudflare's Zero Trust products to all its participants, aiming to provide enterprise-level cybersecurity to underfunded and resource-constrained organizations. This initiative addresses the digital divide in cybersecurity product availability and the limitations of 'one-size-fits-all' security solutions. The post highlights how organizations like the CyberPeace Institute, the Information Technology Disaster Resource Center, Meedan, and the Organization of American States are leveraging Cloudflare Zero Trust to secure their operations, employees, and users.
  269. Expanding Area 1 email security to the Athenian ProjectExtends Cloudflare's Area 1 email security suite to state and local governments participating in the Athenian Project, providing free protection against phishing and ransomware attacks targeting election infrastructure. This builds upon existing Athenian Project offerings of DDoS protection, WAF, and SSL encryption, and addresses specific concerns raised by election officials regarding email as a primary attack vector.
  270. How Cloudflare helps secure the inboxes of democracyThis post details how Cloudflare's Area 1 product protected over 100 political campaigns during the US 2022 midterm elections, processing over 20 million emails and stopping approximately 150,000 phishing attacks. It highlights specific attack vectors such as domain proximity phishing and malicious attachments (e.g., 7-Zip files disguised as purchase orders). The post explains how Area 1's machine learning models analyze threat signals like domain similarity, recent domain registration, attachment types, and email sentiment to identify and block malicious emails, thereby securing democratic institutions by protecting campaign inboxes.
  271. The latest on attacks, traffic patterns and cyber protection in UkraineThis post details Cloudflare's response to cyberattacks on Ukrainian infrastructure during the conflict. It highlights the increase in DDoS and application layer firewall mitigated attacks on Ukrainian websites, and Cloudflare's provision of free services and support to Ukrainian government and infrastructure providers, as well as non-profits through Project Galileo. It also discusses the physical security of infrastructure in the region, the use of Keyless SSL, and the increased demand for zero trust solutions. The post also touches on internet disruptions and routing manipulation as tools in armed conflict, including tracking internet outages and rerouting of traffic through Russia.
  272. New! Security Analytics provides a comprehensive view across all your trafficIntroduced Security Analytics, a new feature that provides a security lens across all HTTP traffic, not just mitigated requests. This "detect then mitigate" approach leverages attack analysis, bot analysis, and other security signals to provide visibility into the entire traffic flow. The interface includes top statistics for defining focus, time-series charts for spotting anomalies, analysis signals for zooming into specific scenarios (e.g., attack requests by automated sources, likely attacks by humans, content scanning), sampled logs for detailed verification, and pre-set insights for quick exploration. This feature is being rolled out to Enterprise customers with Application Security Core or Advanced Bundles.
  273. Stop attacks before they are known: making the Cloudflare WAF smarterIntroduced a machine learning-powered WAF attack scoring system that classifies requests for malicious payloads, complementing signature-based rules. This system uses a model trained on millions of true positive samples from the Cloudflare network to detect evasion, bypass, and new attack techniques. The scoring system runs inline to HTTP traffic and is optimized for SQL Injection, XSS, and RCE attacks, with scores ranging from 1 (malicious) to 99 (clean). The post also announces new Security Analytics for visualizing attack score distributions and exploring unmitigated attacks before rule deployment. It details how to use Security Analytics to identify and mitigate attack traffic, and highlights the availability of WAF Attack Scores in HTTP logs and WAF Custom Rules.
  274. Bringing authentication and identification to Workers through Mutual TLSIntroduces the upcoming capability for Cloudflare Workers to use mutual TLS (mTLS) for outbound requests. This allows Workers to present client certificates, enabling server-side authentication and identification of the originating Worker. This addresses limitations of existing methods like Authenticated Origin Pull and token authentication by providing per-Worker granularity, secure HTTP communication, and client identity exposure.
  275. 2022 US midterm elections attack analysisThis post provides a detailed analysis of WAF-mitigated attack traffic targeting election-related websites during the 2022 US midterm elections. It breaks down attack types (SQLi, HTTP Anomaly, Software Specific, File Inclusion, XSS, Directory Traversal, Command Injection) and their prevalence for both the Athenian Project and Cloudflare for Campaigns. It also analyzes the geographical origin of attacks, noting that over 95% of attacks targeting Athenian Project participants originated from the US, while 55% of attacks targeting Cloudflare for Campaigns participants originated from the US, with other countries like Germany, Canada, and the UK also contributing.
  276. Cloudflare is not affected by the OpenSSL vulnerabilities CVE-2022-3602 and CVE-2022-3786This post details how Cloudflare's adoption of BoringSSL, rather than OpenSSL, renders it unaffected by critical OpenSSL vulnerabilities CVE-2022-3602 and CVE-2022-3786. It explains the nature of these vulnerabilities, their potential impact on clients and servers, and provides guidance on patching vulnerable OpenSSL instances. The key takeaway is Cloudflare's proactive security stance through its choice of cryptographic library.
  277. Privacy Gateway: a privacy preserving proxy built on Internet standardsIntroduced Privacy Gateway, a privacy-preserving proxy built on Internet standards (Oblivious HTTP - OHTTP) and hybrid public-key cryptography. Privacy Gateway encrypts HTTP requests and responses between a client and an application server, ensuring that neither Cloudflare nor the application server has the full picture of the communication, thereby enhancing end-user privacy. It enables use cases like private telemetry collection, secure healthcare reporting, and privacy-preserving DNS resolution. The post details the architecture (Client, Privacy Gateway, Application Server), data flow, and the concepts of request privacy and client privacy, along with server integration requirements.
  278. Stronger than a promise: proving Oblivious HTTP privacy propertiesThis post introduces Oblivious HTTP (OHTTP) and its implementation as Privacy Gateway, a new privacy-enhancing protocol. It details how OHTTP decouples sender identity from request content through an encrypted relay mechanism, enhancing user privacy for applications. The post also describes the formal, computer-aided security analysis conducted to prove the privacy properties of OHTTP, using tools like Tamarin for modeling and verification.
  279. Page Shield can now watch for malicious outbound connections made by third-party JavaScript codeIntroduced Connection Monitor as a new feature for Page Shield, which detects malicious outbound connections made by third-party JavaScript code. This feature complements Script Monitor by analyzing connection endpoints and leveraging threat intelligence feeds. It utilizes the `connect-src` directive from Content Security Policies to gather data on outbound connections initiated by various browser APIs. The implementation stores the scheme and host portion of URLs by default for privacy, with an option to enable path storage for more comprehensive threat analysis.
  280. Internet disruptions overview for Q3 2022This post contributes to the understanding of website security and threat management by detailing observed internet disruptions in Q3 2022, specifically focusing on government-directed shutdowns in Iraq, Cuba, Afghanistan, Sierra Leone, Somaliland, India, and Iran. It highlights how these disruptions, often aimed at controlling communication during protests or exams, impact internet availability and underscore the importance of robust security and resilience measures.
  281. Cloudflare DDoS threat report 2022 Q3This post details the trends and insights from Cloudflare's Q3 2022 DDoS Threat Report. It highlights the increasing frequency and scale of multi-terabit DDoS attacks, including a 2.5 Tbps attack targeting a Minecraft server. The report breaks down trends in both application-layer (HTTP) and network-layer (L3/4) DDoS attacks, noting increases in attack volume, duration, and specific botnet activity (e.g., Mirai). It also provides industry and country-specific attack data, as well as insights into ransom DDoS attacks and the sources of attack traffic.
  282. Total TLS: one-click TLS for every hostname you haveIntroduced Total TLS, a one-click feature that automatically issues individual TLS certificates for every subdomain of a customer's domain when Cloudflare is the authoritative DNS provider. This simplifies TLS management by eliminating the need for customers to manually specify hostnames for certificates, especially for those with thousands of subdomains. The feature leverages the existing Advanced Certificate Manager and provides warnings for proxied DNS records without TLS coverage.
  283. Automatic (secure) transmission: taking the pain out of origin connection securityThis post details the technical challenges and solutions for automatically upgrading origin SSL/TLS configurations to the highest available security level. It explains the evolution of origin security options (Off, Flexible, Full, Full (strict), Strict), the methodology used by the SSL/TLS Recommender tool (crawling, content similarity, certificate validation), and the shift from per-zone to per-origin SSL/TLS settings to maximize security posture for complex setups.
  284. Introducing post-quantum Cloudflare TunnelIntroduced Post-Quantum Cloudflare Tunnel, a beta feature that enables post-quantum secure connections between the `cloudflared` service and Cloudflare's network using hybrid key exchanges (X25519Kyber512Draft00 and X25519Kyber768Draft00). This is achieved by restricting `cloudflared` to the QUIC transport and only allowing these specific post-quantum hybrid key exchanges. The feature is opt-in via the `--post-quantum` flag or `post-quantum: true` in the configuration file. The post also details the motivation for post-quantum cryptography, the current limitations (browser and inter-data center connections are not yet post-quantum secure), and provides troubleshooting information.
  285. Gateway + CASB: alphabetti spaghetti that spells better SaaS securityThis post details the integration of Cloudflare CASB findings with Cloudflare Gateway to automatically generate HTTP policies. It provides three examples: blocking uploads to personal Google Drive, restricting repeat oversharers, and preventing file uploads to unapproved Shadow IT applications. The core technical contribution is the workflow enabling three-click policy creation from CASB findings to Gateway.
  286. The (hardware) key to making phishing defense seamless with Cloudflare Zero Trust and YubicoThis post details the integration of hardware security keys (YubiKeys) with Cloudflare Zero Trust to provide phish-proof authentication. It explains the limitations of traditional MFA and how hardware keys, using the WebAuthn standard, offer superior security. The post also highlights Cloudflare's ability to enforce the use of hardware keys through the Authentication Method Reference (AMR) standard within its Zero Trust platform, and announces an exclusive offer for Cloudflare customers to purchase YubiKeys at a discounted price.
  287. Back in 2017 we gave you Unmetered DDoS Mitigation, here's a birthday gift: Unmetered Rate Limiting for Self Serve customersIntroduced unmetered Rate Limiting for Free, Pro, and Business customers, removing usage-based charges. Launched an updated Rate Limiting engine based on the ruleset engine, offering advanced rule-building capabilities previously available in Advanced Rate Limiting. This includes the ability to combine multiple request parameters (path, host, URI, query, method, user agent, source IP), separate counting and mitigation expressions, and expanded counting dimensions (IP with NAT awareness, Query, Host, Headers, Cookie, ASN, Country, Path, JA3, JSON field).
  288. Click Here! (safely): Automagical Browser Isolation for potentially unsafe links in emailIntroduces Email Link Isolation, a feature that rewrites suspicious links in emails to open in a remote, sandboxed browser. This protects users from malicious payloads and zero-day exploits by executing untrusted content away from their local machine and corporate network. The feature leverages Cloudflare's DNS resolver and Gateway classifiers to identify potentially unsafe domains and integrates with Cloudflare Browser Isolation for remote execution. It also includes a mechanism for re-evaluating domain reputations.
  289. How Cloudflare implemented hardware keys with FIDO2 and Zero Trust to prevent phishingThis post details Cloudflare's internal migration from VPN-based authentication with TOTP to a Zero Trust architecture enforced by Cloudflare Access and FIDO2/WebAuthn security keys. It describes the selective enforcement strategy using OAuth2 AMR values and Terraform, the eventual full enforcement of FIDO2, and the extension of this security model to SSH connections via Cloudflare Tunnel and cloudflared.
  290. Announcing Turnstile, a user-friendly, privacy-preserving alternative to CAPTCHAIntroduced Turnstile, a new product offering a privacy-preserving, user-friendly alternative to CAPTCHA. Turnstile utilizes a rotating suite of non-intrusive browser challenges and machine learning models to validate users, minimizing data collection and integrating with Apple's Private Access Tokens. The product is available as a standalone service, allowing integration via a simple API without requiring traffic to pass through Cloudflare's global network. It offers implicit and explicit rendering options, custom 'Actions' for distinguishing use cases, and provides analytics on widget deployment and user behavior.
  291. Introducing Cloudflare’s free Botnet Threat Feed for service providersIntroduces a free Botnet Threat Feed for service providers, providing them with threat intelligence on their own IP addresses observed participating in HTTP DDoS attacks from the Cloudflare network. This enables service providers to identify and crack down on abusers, take down botnet nodes, and reduce abuse-driven costs.
  292. Cloudflare named a Leader in WAF by ForresterThis post announces Cloudflare's recognition as a Leader in The Forrester Wave™: Web Application Firewalls, Q3 2022 report. It highlights Cloudflare's highest scores in strategy, innovation, management UI, rule creation, Log4Shell response, incident investigation, and security operations feedback loops. The post details the WAF's rapid response to the Log4Shell vulnerability, deploying managed rules within 17 hours globally to protect customers. It also emphasizes the WAF's role in protecting web applications from attacks, securing APIs, stopping DDoS attacks, blocking bots, and monitoring for third-party JavaScript attacks.
  293. Introducing Configuration RulesIntroduces Configuration Rules as a successor to Page Rules, offering more granular control over Cloudflare features and settings. Configuration Rules allow users to selectively enable or disable features based on a wider range of criteria beyond just URLs, including cookies and country of origin. This enables new use cases such as A/B testing features like Polish and Mirage, and augmenting security policies with additional fields like managed IP lists. The post details the interplay between zone-level settings and Configuration Rules, and provides examples for A/B testing and augmenting URL-based security.
  294. Where to? Introducing Origin RulesIntroduces Origin Rules, a new product that allows for overriding the host header, Server Name Indication (SNI), destination port, and DNS resolution of matching HTTP requests. This feature is built on the ruleset engine and enables routing decisions based on various criteria beyond just the URL, such as visitor country, IP address, or HTTP request headers. It replaces and enhances the functionality previously provided by Page Rules for host header and resolve overrides, enabling more complex routing scenarios for SaaS platforms, cloud storage integration, and A/B testing.
  295. Securing the Internet of ThingsThis post announces Cloudflare's new IoT Platform, which aims to secure IoT devices by integrating cellular connectivity provisioning, policy-based packet inspection, and Zero Trust security controls. It leverages existing Cloudflare products like API Shield, Workers, Gateway, and Pub/Sub, and introduces new capabilities for device management, analytics, and anomaly detection. The platform will allow for granular control over device network access, locking devices to specific geographies or IMEIs, and offloading compute to Cloudflare Workers to reduce on-device complexity and cost. It also highlights the use of emerging standards like IoT SAFE for secure credential storage on SIM cards.
  296. Cloudflare Zaraz supports Managed Components and DLP to make third-party tools privateThis post introduces Cloudflare Zaraz's new capabilities: Managed Components and Data Loss Prevention (DLP). Managed Components provide an isolated environment for third-party tools, requiring explicit permission grants and allowing granular control over data exposure. DLP features scan data flowing to components for PII, offering actions like reporting, masking, and removal. The post also highlights the open-source nature of Managed Components and invites users to a closed beta for advanced DLP features.
  297. API Endpoint Management and Metrics are now GAThis post announces the General Availability (GA) of API Endpoint Management and Performance Metrics within Cloudflare's API Shield. Key contributions include: 1. GA of Endpoint Management: Allows saving, updating, and deleting API endpoints, supporting both auto-discovered and manually added endpoints. 2. GA of Performance Metrics: Collects and displays metrics like latency, error rate (4xx/5xx), request count, and response size for managed endpoints. Includes sparklines for relative performance comparison and anomaly detection. 3. API Discovery enhancements: Now accepts cookies in addition to authorization headers for session identification. 4. Schema Validation enhancement: Allows validation of request bodies against OpenAPI schemas, in addition to existing header/cookie validation.
  298. Protests spur Internet disruptions in IranThis post details how Cloudflare's network monitoring capabilities, a facet of its broader threat management and visibility, were utilized to track and report on government-imposed internet disruptions in Iran. It specifically highlights the impact of these disruptions on internet traffic and DNS resolution, including the blocking of social media platforms and DNS-over-HTTPS/TLS, showcasing Cloudflare's role in observing and documenting censorship events.
  299. Regional Services comes to India, Japan and AustraliaThis post announces the general availability of Regional Services in India, Japan, and Australia, expanding the feature's coverage to the Asia Pacific region. It reiterates the core functionality of Regional Services, which allows customers to control where their traffic is decrypted and inspected, and explains how the anycast network is adapted to respect these regional boundaries by forwarding traffic to data centers within the selected region if the initial point of contact is outside it.
  300. Isolate browser-borne threats on any network with WAN-as-a-ServiceThis post introduces the integration of Cloudflare Browser Isolation with Magic WAN. It details how customers with networks protected by Magic WAN can now enable Browser Isolation through HTTP policies. The technical steps involve connecting on-premise networks to Cloudflare via IPsec or GRE tunnels, creating an isolation policy in the Zero Trust dashboard, and enabling non-identity on-ramp support. This allows for the transparent interception and remote execution of traffic matching isolation criteria, providing enhanced security against browser-borne threats without endpoint software.
  301. Cloudflare Data Loss Prevention now Generally AvailableThis post announces the General Availability of Cloudflare's Data Loss Prevention (DLP) product. It details how DLP works by inspecting HTTP traffic for sensitive data using regex matches and algorithmic validation (e.g., Luhn's algorithm for credit card numbers). It explains how to configure DLP profiles and apply them to Gateway HTTP policies to block or allow traffic based on detected sensitive data, such as PII, intellectual property, or financial information. The post also highlights DLP's integration with other Cloudflare Zero Trust services for comprehensive data protection.
  302. Detect security issues in your SaaS apps with Cloudflare CASBThis post announces the General Availability of Cloudflare CASB (Cloud Access Security Broker), a new addition to the Zero Trust platform. CASB allows IT and security administrators to connect, scan, and monitor third-party SaaS applications for security issues such as data exposure, file oversharing, misconfigurations, insecure settings, and Shadow IT. It integrates with Google Workspace, Microsoft 365, Slack, and GitHub via their APIs to identify these issues. The post highlights the problem of SaaS sprawl and the need for better visibility into SaaS app security and DLP posture, positioning CASB as a solution that provides data-at-rest visibility and access control.
  303. Introducing Advanced DDoS AlertsIntroduced Advanced DDoS Alerts, offering customizable notifications for HTTP and L3/4 DDoS attacks. Users can now define specific Internet properties (zones, hostnames, IP prefixes), minimum attack thresholds (RPS, PPS, Mbps), and protocols to monitor, addressing noise from standard alerts and allowing for more targeted verification of mitigation effectiveness.
  304. Introducing Cloudflare Adaptive DDoS Protection - our new traffic profiling system for mitigating DDoS attacksIntroduced Adaptive DDoS Protection, a new traffic profiling system that learns unique traffic patterns by analyzing maximal traffic rates over the past seven days using various dimensions (source country, user agent, IP protocol, destination ports). It uses the 95th percentile to discard outliers and integrates with ML-generated Bot Scores to distinguish legitimate traffic spikes from automated attacks. This system is available for Enterprise customers on specific plans and complements existing DDoS defenses.
  305. Account WAF now available to Enterprise customersIntroduces Account WAF for Enterprise customers, enabling a single WAF configuration to be deployed across multiple domains. This feature allows for the management of Managed, Firewall, and Rate Limiting rulesets from a single interface, using Wirefilter syntax to define deployment filters based on hostnames or groups of domains. This significantly simplifies security management for organizations with a large number of domains.
  306. How we built Pingora, the proxy that connects Cloudflare to the InternetThis post introduces Pingora, a new in-house HTTP proxy built with Rust, designed to replace NGINX and handle Cloudflare's massive scale of over a trillion requests per day. It addresses architectural limitations of NGINX, such as its worker process model and per-worker connection pools, which previously hindered performance and connection reuse. Pingora's multithreading and work-stealing approach, combined with a custom HTTP library and an event-based programmable interface, significantly improves performance (reducing TTFB and handshake time) and enables faster development of new features, including HTTP/2 upstream support and gRPC, which directly benefit Cloudflare's security and performance products.
  307. Cloudflare named a Leader by GartnerThis post announces Cloudflare's recognition as a Leader in Gartner's Magic Quadrant for Web Application and API Protection (WAAP). It details the components of Cloudflare's WAAP portfolio: DDoS protection, WAF, Bot Management, API Gateway, and Page Shield. It highlights the scale of traffic processed (36 million HTTP requests/sec), the percentage of traffic mitigated at the edge (1 in 10 HTTP requests), and the increasing importance of API security. It also mentions the new Security Center as a unified view for WAAP products and lists recent innovations like API Shield Schema Protection, API Abuse Detection, a new WAF, customizable DDoS Managed Rules, Security Center, and Page Shield.
  308. Improving the accuracy of our machine learning WAF using data augmentation and samplingThis post details the challenges in acquiring high-quality labeled data for machine learning-based WAFs, including privacy constraints, heterogeneity of samples, sample difficulty, and noisy labels. It introduces data augmentation as a strategy to overcome these challenges, focusing on generating heterogeneous negative samples by mutating benign content and creating pseudo-random noise samples with increasing complexity. This approach aims to reduce false positives and improve the robustness and overall properties of the ML WAF.
  309. Introducing thresholds in Security Event Alerting: a z-score love storyIntroduced a threshold-based alerting mechanism for Security Event Alerts, complementing the existing z-score methodology. This new approach addresses the issue of zero-event domains triggering false positives by ensuring that alerts are only sent when the number of security events exceeds a predefined static threshold (200) AND crosses a z-score of 3.5. This hybrid approach aims to improve the accuracy and relevance of security alerts.
  310. The mechanics of a sophisticated phishing scam and how we stopped itThis post details a sophisticated phishing attack targeting Cloudflare employees, including the mechanics of the attack (SMS phishing, fake Okta login page, real-time TOTP relay) and Cloudflare's response. It highlights the effectiveness of FIDO2 security keys in preventing compromise despite credential leakage, and the use of Cloudflare Gateway to block malicious domains. The post also outlines steps taken to identify and take down attacker infrastructure, update detections, and audit logs. Lessons learned include enhancing access controls for newly registered domains, implementing browser isolation for suspicious sites, and leveraging Area 1's phish-identification technology.
  311. A story about AF_XDP, network namespaces and a cookieThis post details a debugging journey and fix for a crash in flowtrackd, a DoS defense mechanism, that occurred when using AF_XDP with network namespaces. It highlights an issue where AF_XDP was not network namespace aware, leading to crashes when interface index numbers were the same across different namespaces. The post also touches upon the performance improvements gained by using AF_XDP shared UMEM for a single flowtrackd instance to handle multiple customer accounts, and the network setup involving veth pairs and network namespaces for packet forwarding.
  312. Mantis - the most powerful botnet to dateThis post details the analysis and mitigation of the 'Mantis' botnet, responsible for the largest HTTPS DDoS attacks observed. It highlights Mantis's evolution from the Meris botnet, its use of hijacked VMs and powerful servers, and its ability to launch 26 million requests per second attacks with an average of 5,200 HTTPS RPS per bot. The post also provides insights into the industries and geographic locations targeted by Mantis and reiterates Cloudflare's automated DDoS protection and WAF/CDN capabilities for mitigation.
  313. Waiting Room Event Scheduling protects your site during online eventsThis post introduces Waiting Room Event Scheduling, a significant enhancement to the existing Waiting Room feature. It allows enterprise customers to proactively schedule changes to their waiting room's settings and custom queueing pages for online events. New queuing methods, Reject and Passthrough, are introduced for more granular traffic control. The post also details the concept of pre-queuing to manage traffic before an event starts and provides a walkthrough of the event creation workflow, emphasizing ease of use and customization.
  314. Introducing Location-Aware DDoS ProtectionIntroduces Location-Aware DDoS Protection, a new feature that leverages traffic origin (client country and region) and machine learning models to identify and mitigate DDoS attacks. It allows Enterprise customers subscribed to Advanced DDoS to customize sensitivity levels and enable the feature as an HTTP DDoS Managed rule, setting actions to Managed Challenge or Block.
  315. New WAF intelligence feedsThis post introduces four new managed IP lists (VPNs, Botnets, Command and Control Servers, Malware, and Anonymizers) that can be used within Cloudflare's WAF and Advanced Rate Limiting. These lists are maintained by Cloudflare based on threat intelligence feeds collected from analyzing internet patterns and behaviors across the Cloudflare network, combined with curated open-source data and partnerships. The post also details the integration of IP category annotations directly into the Cloudflare dashboard for WAF events, providing contextual information about the source IP's classification.
  316. DDoS attack trends for 2022 Q2This post details DDoS attack trends observed in Q2 2022, including the largest attacks seen, ongoing attacks against Ukraine and Russia, and the emergence of Ransom DDoS attacks. It provides insights into application-layer and network-layer DDoS attack volumes, targeted industries (Aviation & Aerospace, BFSI, Gaming/Gambling, Telecommunications, IT), and geographical distribution of attacks (US, Cyprus, Hong Kong, China, Singapore, Germany). It also discusses the methodology for measuring DDoS activity and the role of automated mitigation systems and customer surveys.
  317. Making Page Shield malicious code alerts more actionableIntroduced script status filtering (`active`, `infrequent`, `inactive`, `cdn-cgi`) in the Page Shield dashboard to prioritize active threats and reduce noise. Enhanced enterprise alerts with script location, ML score breakdown (obfuscation, data exfiltration), threat feed categorization, WHOIS data, and SSL certificate transparency information. Improved dashboard links to direct users to specific script details. Outlined future work on Magecart-style attack detection, CSP policy generation, and granular script permission blocking.
  318. Managed Transforms: templated HTTP header modificationsIntroduced Managed Transforms, a new feature within Transform Rules that offers one-click HTTP header modifications for common use cases. This simplifies adding bot management information (bot score, JA3 hash) and security headers (HSTS, CSP, Permission-Policy) to HTTP requests and responses, reducing manual configuration and improving security posture.
  319. Internet Explorer, we hardly knew yeThis post analyzes the usage trends of Internet Explorer 11 and older versions as the browser approaches its retirement date. It examines the decline in usage, geographical distribution, and the significant proportion of bot traffic masquerading as Internet Explorer. The analysis uses Cloudflare's traffic data, bot scoring, and WAF mitigation percentages to provide insights into the residual usage patterns and the prevalence of automated traffic.
  320. Live-patching security vulnerabilities inside the Linux kernel with eBPF Linux Security ModuleThis post introduces the use of eBPF (extended Berkeley Packet Filters) as a Linux Security Module (LSM) to implement granular security policies directly within the Linux kernel. Specifically, it demonstrates how LSM BPF can be used to prevent privilege escalation by blocking unprivileged users from creating new user namespaces via the `unshare` syscall, a vulnerability that has been difficult to address in the mainline kernel. This represents an advancement in Cloudflare's ability to dynamically enforce security policies and patch vulnerabilities without requiring kernel modifications or custom kernel modules, thereby enhancing its threat management capabilities.
  321. HTTP/3 inspection on Cloudflare GatewayThis post announces the upcoming support for HTTP/3 inspection within Cloudflare Gateway. It details the technical challenges of inspecting HTTP/3 traffic due to its reliance on QUIC over UDP, contrasting it with legacy TCP-based protocols. The post outlines how Cloudflare Gateway will enable full visibility and security policy application (AV-scanning, DLP, filtering) to HTTP/3 traffic by proxying UDP traffic and enabling TLS decryption.
  322. Verify Apple devices with no installed softwareThis post introduces support for Private Access Tokens within Cloudflare Access. This allows security teams to verify the health and integrity of a user's device, specifically Apple devices in this initial rollout, without requiring any software installation on the client. It leverages the Privacy Pass Protocol and involves an Origin (Cloudflare), Client (user's device), Attester (Apple), and Issuer (Cloudflare) to issue anonymous, unforgeable tokens that attest to device health attributes like OS version and jailbreak status.
  323. Next generation intrusion detection: an update on Cloudflare’s IDS capabilitiesThis post announces the private beta of Cloudflare's Intrusion Detection System (IDS) capabilities. It details how the IDS operates across all network traffic (IP port or protocol), leveraging Cloudflare's global Anycast network for software-based deployment, thus removing hardware constraints like capacity planning, location planning, and maintenance downtime. The system integrates threat intelligence from open-source feeds (e.g., Suricata) and Cloudflare's network vantage point, with further augmentation from the new Threat Intel team. The goal is to provide comprehensive threat monitoring without performance bottlenecks or alert fatigue.
  324. Introducing browser isolation for email links to stop modern phishing threatsIntroduces the integration of Cloudflare Area 1 email security with Cloudflare One platform, enabling Remote Browser Isolation (RBI) for email links. This feature rewrites suspicious URLs to a custom prefix, and upon click, redirects users to a remote browser instance on the Cloudflare Global Network. This isolates potentially malicious content, preventing device infection and credential compromise. The implementation leverages Network Vector Rendering (NVR) technology for efficient and secure draw command transmission. The post details how this addresses deferred phishing attacks by isolating suspicious links at the time of click, offering various mitigation options like splash warning pages, read-only mode, and restricted file operations.
  325. Bring your own license and threat feeds to use with Cloudflare OneThis post introduces the capability for customers to integrate third-party threat intelligence feeds (Mandiant, Recorded Future, VirusTotal) into Cloudflare One products by uploading API keys. This allows for enriched threat investigations and the creation of custom security rules based on external data.
  326. Launching In-Line Data Loss PreventionIntroduced Data Loss Prevention (DLP) as a native feature within the Cloudflare One platform. This involves the creation of DLP Profiles for defining sensitive data (keywords, regexes) and Gateway HTTP policies to scan and control the transmission of this data. This enhances Zero Trust by adding a layer of protection based on the content of the data itself, complementing existing identity, device posture, content category, and application configuration checks.
  327. Area 1 threat indicators now available in Cloudflare Zero TrustThis post details the integration of Area 1's threat indicator data into Cloudflare's Zero Trust products, specifically enhancing phishing detection. It describes how Area 1's data pipeline, focused on identifying new and active phishing threats, supplements the existing Phishing category in Gateway. The post outlines the combined approach of Cloudflare and Area 1 in identifying phishing threats through web crawling, threat modeling, machine learning, and analysis of mail exchange server data. It emphasizes the benefit of this combined dataset for proactive threat filtering and improving phishing detection across various entry points.
  328. Cloudflare mitigates 26 million request per second DDoS attackThis post details the automatic detection and mitigation of a 26 million requests per second HTTPS DDoS attack, the largest on record. It analyzes the attack's origin from a botnet of hijacked virtual machines and powerful servers, contrasting its efficiency with larger, less powerful botnets. The post also discusses the increased computational cost of HTTPS DDoS attacks and provides statistics on the attack's origin countries and networks. It highlights the importance of automated, always-on DDoS protection services.
  329. Exam time means Internet disruptions in Syria, Sudan and AlgeriaThis post details how countries like Syria, Sudan, and Algeria are implementing internet shutdowns or targeted website blocking during exam periods to prevent cheating. It showcases Cloudflare Radar data illustrating these disruptions and analyzes the asymmetric nature of Syria's shutdowns. The post also highlights Algeria's shift from full shutdowns to content blocking, using Network Error Logging (NEL) data to demonstrate the impact. This contributes to the understanding of how network-level controls, even if state-sponsored and for non-malicious reasons, can impact internet availability and require monitoring.
  330. Private Access Tokens: eliminating CAPTCHAs on iPhones and Macs with open standardsIntroduced Private Access Tokens (PATs) as a new method for validating human users without CAPTCHAs. PATs leverage an open standard (extension of Privacy Pass protocol) and involve collaboration between device vendors (Attesters) and token issuers (like Cloudflare) to generate anonymous, unforgeable tokens. This significantly improves privacy by validating device authenticity without collecting or storing sensitive user data, and enhances the user experience by removing CAPTCHAs, especially on mobile and API contexts.
  331. In Ukraine and beyond, what it takes to keep vulnerable groups onlineThis post provides a detailed analysis of cyberattack trends against organizations protected under Project Galileo, with a specific focus on attacks targeting Ukraine. It quantifies the increase in DDoS and WAF-mitigated traffic, categorizes attack methods by region and organization type, and highlights the prevalence of SQL injection and HTTP anomalies. It also details the application growth for Project Galileo during the conflict and the types of organizations that saw increased traffic.
  332. Cloudflare observations of Confluence zero day (CVE-2022-26134)This post details Cloudflare's observations and response to the Confluence zero-day vulnerability (CVE-2022-26134). It covers the immediate engagement of WAF teams to deploy mitigation rules, analysis of exploit attempts in the wild (including pre-advisory activity), and the identification of specific malicious payloads and URLs. The post also outlines Cloudflare's internal response, including log reviews and security checks, and provides recommendations for on-premise Confluence users, including enabling Cloudflare Access and WAF protection, and checking for indicators of compromise.
  333. Cloudflare customers are protected from the Atlassian Confluence CVE-2022-26134This post details the emergency release of a WAF rule (IDs 100531 and 408cff2b) to mitigate CVE-2022-26134, a critical RCE vulnerability in Atlassian Confluence. It explains that Cloudflare customers using WAF or Access are already protected. The WAF rule was deployed on June 2, 2022, at 23:38 UTC with a default BLOCK action. It also highlights that Cloudflare Access protects against unauthenticated exploitation attempts by verifying user authentication before requests reach the Confluence server.
  334. Gaining visibility in IPFS systemsThis post details the development and use of the IPFS Gateway monitor, an observability tool designed to measure the performance and reliability of IPFS gateways. It outlines the tool's architecture, including its measurement binaries and Prometheus exporter, and presents findings from various IPFS content retrieval scenarios (immutable content, IPNS names, DNSLink websites). The monitor helps inform design decisions for Cloudflare's IPFS gateway by providing insights into retrieval times, cache performance, and the impact of IPFS's distributed nature on content discovery.
  335. How we built config staging and versioning with HTTP applicationsThis post introduces HTTP Applications and Routing Rules, a new system for managing L7 Cloudflare configuration. It details how HTTP Applications allow for versioning of settings (Page Rules, Firewall Rules, cache settings) independent of hostnames. Routing Rules, powered by the Ruleset Engine, map hostnames to specific HTTP Application versions. The system supports staging configurations by routing traffic to specific IPs for testing before production deployment, and allows for quick rollbacks. The underlying mechanism involves an additional lookup after the account/config pair to determine the correct configuration ID (zone vs. HTTP Application version).
  336. The Cloudflare Bug Bounty program and Cloudflare PagesThis post details six security vulnerabilities discovered in Cloudflare Pages' CI/CD build pipeline and publishing process by security researchers. It describes command injection flaws in `CLONE_REPO` and `PUBLISH_ASSETS`, API key disclosure due to incorrect file permissions, bash path injection, an Azure pipelines escape via the docker socket, and a Kubernetes API access issue due to a missing iptables rule. The post outlines the remediation steps taken, including input validation fixes, secret rotation, permission adjustments, architectural changes (adopting gVisor, migrating to Kubernetes), and customer notifications. It highlights the importance of the bug bounty program in identifying and fixing these issues.
  337. Cloudflare blocks 15M rps HTTPS DDoS attackThis post details the technical specifics of a 15.3 million rps HTTPS DDoS attack mitigation. It describes the attack's origin from data centers and a botnet of ~6,000 bots across 112 countries, with traffic originating from specific ASNs like Hetzner and OVH. It explains Cloudflare's autonomous DDoS protection system, including asynchronous traffic sampling, out-of-path analysis, data streaming algorithms for request analysis, conditional fingerprint matching, real-time signature creation with dynamic masking, and the compilation of mitigation rules when activation thresholds are met. It also references a deep-dive technical blog post on autonomous edge DDoS protection.
  338. Cloudflare partners with Kentik to enhance on-demand DDoS protectionThis post announces a partnership with Kentik to integrate their network observability with Cloudflare's Magic Transit for on-demand DDoS protection. It details three procurement modes for Magic Transit: Always On, On Demand, and On Demand + Flow-based Monitoring. The integration leverages Kentik's flow-based monitoring to trigger Magic Transit's DDoS mitigation when attacks are detected, simplifying procurement and provisioning for customers.
  339. DDoS Attack Trends for 2022 Q1This post provides a detailed analysis of DDoS attack trends observed in Q1 2022, highlighting a massive spike in application-layer DDoS attacks and a decrease in network-layer attacks. It introduces new data points on volumetric attacks, zero-day reflection attacks, and geographical attack patterns in Russia and Ukraine. The post also details trends in ransom DDoS attacks and shifts in the primary sources and targets of application-layer attacks, particularly noting the US's emergence as a leading source. This contributes to the ongoing narrative of Cloudflare's threat intelligence and mitigation capabilities by providing specific, time-bound data on the evolving DDoS landscape.
  340. The end of the road for Cloudflare CAPTCHAsIntroduced the 'Managed Challenge' platform as a replacement for traditional CAPTCHAs. This platform uses a series of non-interactive JavaScript challenges, machine learning models, and other signals to assess visitor behavior. It defers visual puzzles to a later stage, only serving them when signals are weak. The platform has reduced CAPTCHA usage by 91% and aims to reduce it to less than 1% by year-end, significantly improving user experience by reducing challenge time from 32 seconds to 1 second.
  341. WAF mitigations for Spring4ShellThis post details the deployment of new managed mitigation rules for the Spring4Shell vulnerabilities (CVE-2022-22947, CVE-2022-22950, CVE-2022-22963, CVE-2022-22965) to protect customers using Java Spring and related software components. Specific WAF rule IDs and legacy IDs are provided for: Managed Rule 'Spring - CVE:CVE-2022-22947', Managed Rule 'PHP - Code Injection' (blocking PoCs for CVE-2022-22950 and CVE-2022-22963), Managed Rule 'Plone - Dangerous File Extension' (blocking PoCs for CVE-2022-22963 and CVE-2022-22965), and Managed Rule 'Spring - Code Injection' (deployed for additional variations of CVE-2022-22963 and CVE-2022-22965). It also recommends using the OWASP Core Ruleset with default or high sensitivity settings.
  342. Future-proofing SaltStackThis post details Cloudflare's work in making SaltStack, an internal infrastructure management tool, quantum-secure. It chronicles the discovery and patching of several security vulnerabilities (CVE-2022-22934, CVE-2022-22935, CVE-2022-22936) in SaltStack's custom cryptographic protocol. Furthermore, it proposes and demonstrates the feasibility of migrating SaltStack's communication to a mutually authenticated TLS (mTLS) based transport as a path towards post-quantum security and improved overall security posture.
  343. Optimizing Magic Firewall’s IP listsThis post details the optimization of Magic Firewall's IP lists by migrating from nftables sets to eBPF maps (BPF_MAP_TYPE_LPM_TRIE). This change significantly reduced memory consumption by allowing IP lists to be shared across network namespaces instead of being duplicated. The post also describes the necessary patch to the nftables project to enable direct integration of eBPF programs, allowing for atomic rule replacements and enhanced packet inspection capabilities.
  344. CVE-2022-1096: How Cloudflare Zero Trust provides protection from zero day browser vulnerabilitiesThis post details how Cloudflare's Zero Trust and Remote Browser Isolation (RBI) services provide proactive protection against zero-day browser vulnerabilities, specifically referencing CVE-2022-1096. It explains the layered defense strategy: traffic steering via a roaming client, inspection and filtering by a secure web gateway, and execution of website code in a remote browser. It highlights RBI's ability to isolate endpoints, destroy and reconstruct browsers, encrypt egress traffic, and log egress traffic for incident response. The post contrasts the manual patching of local browsers with the automatic patching of remote browsers on Cloudflare's network.
  345. Cloudflare’s investigation of the January 2022 Okta compromiseThis post details Cloudflare's internal Security Incident Response Team (SIRT) process in response to a compromise of Okta, their identity provider. It outlines the timeline of investigation, actions taken (suspending accounts, forcing password resets), and the technical details of how Cloudflare uses Okta integrated with Cloudflare Access, including the use of hardware tokens and independent log storage for enhanced security. It also provides recommendations for Okta customers.
  346. Application security: Cloudflare’s viewThis post provides a data-driven overview of application security trends observed on the Cloudflare network between December 2021 and March 2022. It quantifies the volume of mitigated traffic (8% of total HTTP requests), breaking down mitigation sources by feature (Layer 7 DDoS, Custom WAF Rules, Rate Limiting, IP Threat Reputation, Managed WAF Rules). It details the most common attack vectors blocked by Managed WAF Rules, with HTTP anomalies being the most prevalent. The post also analyzes the fields used in custom WAF rules, highlighting the continued prevalence of IP addresses and standard HTTP request fields, while noting the shift towards Zero Trust approaches.
  347. Securing Cloudflare Using CloudflareThis post details the technical implementation of enforcing FIDO2 security keys as the only second factor for accessing internal and external applications protected by Cloudflare Access. It includes a Terraform code example demonstrating how to configure Cloudflare Access policies to require the 'swk' authentication method, which corresponds to logins using a security key. The post also presents a graph showing the reduction in soft token usage after this enforcement.
  348. Introducing SSH command loggingIntroduces SSH command logging as a new capability within Cloudflare Zero Trust, extending the Secure Web Gateway to inspect and log SSH traffic at the network layer. This feature provides full replay of commands run during SSH sessions, including across jump-hosts, without requiring software installation on individual machines. Logs are encrypted with customer-provided public keys, and an opt-in FIPS 140-2 mode is available. User authentication is handled via Cloudflare Short-Lived Certificates.
  349. Evolving our machine learning to stop mobile botsThis post details the evolution of Cloudflare's machine learning models for bot detection, with a specific focus on improving performance for mobile application traffic. It outlines the process of data gathering, feature selection, model building (using Catboost), offline and online monitoring, and deployment strategies. The key contribution is the identification and incorporation of new datasets representing legitimate mobile app traffic, which were previously under-represented, leading to significant reductions in false positive rates for mobile applications.
  350. Clientless Web Isolation is now generally availableThis post announces the general availability of Clientless Web Isolation, a new on-ramp for Browser Isolation. It integrates Zero Trust Network Access (ZTNA) with remote browsing, allowing users to securely access any website, internal app, or SaaS application from any device without installing software or configuring certificates. It simplifies connections via a hyperlink, enables deep linking into isolated browsing for suspicious content, integrates with third-party secure web gateways, and provides secure access on BYOD devices, offering an alternative to VDI for browser-based applications.
  351. Packet captures at the edgeThis post introduces on-demand packet captures from Cloudflare's global network, a new capability for customers using Magic Transit and Magic WAN. This feature provides granular visibility into network traffic by allowing users to request and analyze packet capture files. It addresses the challenge of fragmented visibility in modern networks by centralizing packet capture capabilities at the edge. The post details the technical implementation using nftables and tcpdump, and highlights its utility for both network troubleshooting and security analysis, directly contributing to the ability to identify and mitigate threats.
  352. Cloudflare and Aruba partner to deliver a seamless global secure network from the branch to the cloudThis post announces a partnership with Aruba to integrate Cloudflare One's security services (Secure Web Gateway, Magic Firewall) with Aruba's EdgeConnect SD-WAN solution. This integration allows organizations to leverage their existing SD-WAN infrastructure to route corporate traffic through Cloudflare's global network for enhanced security and control, without requiring a rip-and-replace approach. It extends Cloudflare's security perimeter to the branch office and enables granular policy management for both internet-bound and inter-branch traffic.
  353. Cloudflare and CrowdStrike partner to give CISOs secure control across devices, applications, and corporate networksThis post details the integration of Cloudflare's Zero Trust services (Access and Gateway) with CrowdStrike's Falcon Zero Trust Assessment (ZTA). It explains how customers can use CrowdStrike's real-time device posture assessments to build conditional access policies, requiring a minimum ZTA score or version before granting access. The technical implementation involves adding CrowdStrike as a device posture provider in the Cloudflare Zero Trust dashboard, requiring API credentials, and then creating device posture checks and incorporating them into Access and Gateway policies. Future work will involve correlating Cloudflare logs with Falcon telemetry.
  354. Announcing the Cloudflare API GatewayThis post introduces the Cloudflare API Gateway, a new major capability that extends Cloudflare's security and management offerings to API-driven applications. It details features such as API Discovery to identify shadow APIs, Schema Validation to enforce API structure, Abuse Detection for rate limiting and scraping prevention, mTLS for device authentication, and enhanced Authentication (API keys, JWT, OAuth 2.0) and Routing capabilities leveraging Cloudflare Workers and Transform Rules. This significantly expands the scope of website security and threat management to include the critical area of API security.
  355. Envoy Media: using Cloudflare's Bot Management & MLThis post details how Envoy Media Group uses Cloudflare's Bot Management product, specifically the bot score generated by machine learning, to filter automated traffic. Envoy ingests the bot score as a custom header into their Revstr rules engine to dynamically adjust user experiences (e.g., longer forms for suspicious traffic). They also feed the bot score into their data warehouse for media buyers to analyze traffic sources and into their ML models to predict conversion rates and lifetime value, leading to a 15% increase in precision for their conversion rate prediction model.
  356. Announcing Friendly BotsIntroduced 'Friendly Bots', a new feature that allows customers to auto-validate non-malicious bots using IP lists, rDNS, and machine learning. This feature aims to reduce false positives in bot management, improve crawlability, and provide more granular control over bot traffic through custom policies. It also introduces downstream benefits like easier verification of emerging bots, instant feedback on validation data, and the ability for users to register bots they don't directly own.
  357. Introducing Advanced Rate LimitingIntroduced Advanced Rate Limiting, a new capability integrated with the WAF and Firewall Rules. This feature allows for defining rate limiting rules based on a wide range of HTTP request characteristics (URI, method, headers, cookies, body fields, bot score, JA3 fingerprint) and counting requests based on various dimensions (IP, country, header, cookie, ASN, query parameter value, bot fingerprint). It also enables separating the mitigation expression from the counting expression, allowing for more flexible blocking actions. The post details use cases for protecting web traffic and APIs, including counting based on session ID, request body content, and future support for complexity-based rate limiting.
  358. WAF for everyone: protecting the web from high severity vulnerabilitiesIntroduces a free Cloudflare WAF Managed Ruleset for all plans, including free tiers, to protect against high-severity vulnerabilities like Log4J and Shellshock. This ruleset is automatically deployed for new free zones and can be configured or disabled. It leverages the new Edge Rules Engine for performance and includes rules for common WordPress exploits. Updates will be published on the change log.
  359. Cloudflare Zaraz supports CSPThis post details how Cloudflare Zaraz was enhanced to support Content Security Policy (CSP). It explains the potential conflict between Zaraz's script injection and CSP's security measures, and how Zaraz resolves this by dynamically adding a nonce to the `script-src` directive. It also covers edge cases such as handling multiple CSP headers, the interaction with `unsafe-inline`, and the creation of a `script-src` policy when it's not explicitly defined. The post confirms that Zaraz will comply with CSP settings without additional user configuration.
  360. Security for SaaS providersThis post introduces 'WAF for SaaS', a significant extension of Cloudflare's WAF capabilities specifically tailored for Software-as-a-Service (SaaS) providers. It allows SaaS providers to create and deploy distinct sets of WAF rules for their individual customers, enabling segmented security based on varying requirements. The post also announces a free tier for Cloudflare for SaaS, offering 100 custom hostnames for free, and a substantial price reduction for custom hostnames, making advanced security more accessible to startups and growing SaaS businesses. It details how custom metadata can be associated with hostnames to dynamically trigger different security products like WAF, Firewall Rules, and Rate Limiting.
  361. Improving the WAF with Machine LearningIntroduces a new machine learning model for WAF detection that scores every request for SQLi and XSS attacks. The model is trained on existing WAF-classified traffic and augmented data. It provides three scores: a total score (`cf.waf.ml.score`), and specific scores for SQLi (`cf.waf.ml.score.sqli`) and XSS (`cf.waf.ml.score.xss`), ranging from 1 (malicious) to 99 (valid). These scores can be used in custom WAF/Firewall rules for mitigation. The system aims to identify bypasses and anomalies proactively and runs on all traffic with negligible latency. The post details the challenges in building a reliable dataset, scalable data labeling, model selection, and high-throughput execution.
  362. A new WAF experienceThis post details the redesign of the Cloudflare WAF user experience in the dashboard. It consolidates firewall rules, managed rules, and rate limiting rules under a new 'WAF' section within the 'Security' tab. This change is driven by customer feedback and aims to provide a more intuitive and unified approach to web application security. The post also announces upcoming features such as advanced rate limiting, free managed rules for all plans, and the migration of firewall rules to the Ruleset Engine.
  363. Investigating threats using the Cloudflare Security CenterThis post introduces the 'Investigate' portal within the Cloudflare Security Center, enabling customers to query threat intelligence data (IPs, hostnames, ASNs). It also details the rollout of contextual threat annotations within existing analytics dashboards, starting with WAF analytics, to provide actionable intelligence directly in the workflow. The post highlights how Cloudflare leverages its network scale and cross-product data (DNS, Certificate Transparency, Area 1 email security) to train ML models and improve threat detection, making this intelligence accessible to customers.
  364. Introducing: Backup CertificatesThis post introduces the concept and implementation of 'Backup Certificates' as a critical enhancement to Cloudflare's website security and TLS certificate management. It addresses the need for resilience against unforeseen events like key compromises and mass revocations by Certificate Authorities. The post details the challenges of scale and manual intervention in certificate re-issuance and outlines Cloudflare's deployment plan for backup certificates, starting with Universal Certificates for free customers and expanding to Enterprise and other certificate types. This significantly strengthens the robustness of Cloudflare's security offerings by ensuring immediate availability of secure connections even during large-scale certificate emergencies.
  365. How Cloudflare verifies the code WhatsApp Web serves to usersIntroduced a system where Cloudflare acts as a trusted third-party auditor for code integrity. This involves storing hashes of intended code (e.g., WhatsApp Web JavaScript libraries) and providing an audit endpoint for a browser extension (Code Verify) to compare against the locally computed hash of the executing code. This system automates the verification process, making it accessible at scale and enhancing user assurance against code tampering.
  366. CVE-2022-26143: A Zero-Day vulnerability for launching UDP amplification DDoS attacksThis post details the discovery and mitigation of CVE-2022-26143, a zero-day vulnerability in the Mitel MiCollab platform that enables UDP amplification DDoS attacks. It explains the exploit mechanism, Cloudflare's autonomous detection and mitigation systems, and provides specific instructions for Magic Transit customers to block the vulnerability using Magic Firewall rules. The post also highlights Cloudflare's commitment to providing unmetered and unlimited DDoS protection.
  367. CVE-2022-26143: TP240PhoneHome reflection/amplification DDoS attack vectorThis post details the analysis and mitigation of a novel DDoS attack vector leveraging Mitel's TP-240 VoIP processing interface cards. It explains how misconfigured devices expose a system test facility on UDP port 10074, allowing attackers to use them as DDoS reflectors/amplifiers. The post details the attack mechanism, including a single-packet initiation capability leading to extremely high amplification ratios (up to 4,294,967,296:1), the potential for sustained attacks of up to 14 hours, and the collateral impact on voice communications. Recommended actions include network reconnaissance for remediation, vendor coordination, implementing ingress/egress source address validation, and robust DDoS defense strategies.
  368. Internet traffic patterns in Ukraine since February 21, 2022This post significantly contributes to the understanding of Cloudflare's threat management by providing real-time data on internet traffic patterns and cyberattacks within Ukraine during a period of intense conflict. It details the impact of physical events on internet usage across different cities, highlights the surge in DDoS and layer 7 attacks against Ukrainian domains, and showcases Cloudflare's mitigation efforts. This data provides crucial context for the effectiveness and application of Cloudflare's security features in a high-stakes, real-world scenario.
  369. iCloud Private Relay: What Cloudflare Customers Need to KnowThis post details Cloudflare's role as a 'second relay' in Apple's iCloud Private Relay service, explaining how Cloudflare's network, QUIC/MASQUE support, and quiche library are utilized. It provides guidance for website operators on ensuring geolocation accuracy, delivering high-performance user experiences, and managing fraud/bot detection systems that rely on IP addresses, by accommodating shared IP addresses and keeping geolocation databases updated. For Cloudflare customers, it highlights that existing rate limiting and bot management capabilities are already equipped to handle this traffic.
  370. The post-quantum future: challenges and opportunitiesThis post introduces the challenge of post-quantum cryptography and its implications for website security and threat management. It highlights the need to protect confidentiality and authentication against quantum adversaries, discusses the complexities of migrating TLS and other foundational internet protocols to quantum-resistant algorithms, and emphasizes the opportunity to rethink and improve the Public Key Infrastructure (PKI) to better handle these future threats.
  371. Post-quantumify internal services: Logfwrdr, Tunnel, and gokeylessThis post details Cloudflare's ambitious initiative to 'post-quantum-ify' its internal connections, starting with TLS. It outlines the challenges of migrating dozens of services across various programming languages to use post-quantum cryptography, focusing on the confidentiality aspect of TLS. The post explains the adoption of a 'hybrid' mechanism combining classical and post-quantum algorithms (Kyber-512 with P-256) for TLS 1.3 key exchange, ensuring security and compliance. It also touches upon the reasons for not immediately migrating the authentication phase of TLS and the services targeted for this initial migration.
  372. Why we are acquiring Area 1This post announces the acquisition of Area 1 Security, a company specializing in cloud-native email security. Area 1's technology uses machine learning models trained on nine years of threat intelligence data to identify and block phishing and other email-borne threats. Cloudflare plans to integrate this technology into its Zero Trust platform, aiming to provide a more complete security solution that combines network, web, and email threat intelligence. The company highlights its own use of Area 1's technology to significantly reduce reported phishing attempts.
  373. Making protocols post-quantumThis post introduces the challenge of making cryptographic protocols, specifically TLS, post-quantum resistant. It details the need to replace current public-key cryptography algorithms (like ECDH and digital signatures) with quantum-resistant alternatives due to the threat posed by quantum computers. The post analyzes various post-quantum KEM and signature schemes, discussing trade-offs between speed, key size, and signature size, and explores potential protocol redesigns, such as using KEMs for authentication, to adapt to these new cryptographic realities.
  374. The post-quantum state: a taxonomy of challengesThis post introduces the concept of post-quantum cryptography as a future threat to current cryptographic protocols used in website security and threat management. It proposes a taxonomy of challenges (Protocolla, Implementa, Regulae, Communitates, Investigationes) and discusses the implications for protocols like TLS, IPsec, and DNSSEC. It highlights past experiments with post-quantum TLS key exchange and ongoing research into post-quantum signature algorithms for authentication, indicating a proactive approach to securing future internet infrastructure.
  375. Detecting Magecart-Style attacks with Page ShieldThis post details the technical implementation of Page Shield for detecting Magecart-style attacks. It explains how the system analyzes JavaScript Abstract Syntax Trees (ASTs) and data flow graphs to identify PII reads and exfiltration attempts. It also describes two ML models: one for 'clean' scripts and another for obfuscated scripts, differentiating between malicious and benign content. The post elaborates on techniques like analyzing data flow properties, identifying connected paths between PII reads and exfiltration calls, normalizing obfuscated content, and detecting arbitrary string transformations.
  376. Production ready eBPF, or how we fixed the BSD socket APIThis post introduces 'tubular', an open-sourced eBPF-based tooling for managing network traffic at the kernel level. It addresses limitations of the traditional BSD socket API by enabling advanced features like handling millions of IPs, coexisting multiple services on the same IP addresses, and managing dynamic service addresses. This significantly enhances Cloudflare's ability to manage and secure its network infrastructure, particularly for products like Spectrum, by providing more granular control and robustness beyond standard OS capabilities.
  377. Cloudflare acquires Vectrix to expand Zero Trust SaaS securityThis post announces the acquisition of Vectrix and its integration into the Cloudflare Zero Trust platform. Vectrix provides API-driven CASB functionality to detect security issues within SaaS applications, focusing on data security, user activity, misconfigurations, compliance, and shadow IT. This capability will be integrated with Cloudflare's existing Zero Trust offerings like Access, Gateway, and Browser Isolation to provide a unified platform for securing SaaS applications.
  378. Announcing the public launch of Cloudflare's bug bounty programCloudflare has launched a public bug bounty program, transitioning from a vulnerability disclosure policy and a private bounty program. This move aims to incentivize higher quality reports and deeper security research by offering cash bounties. The program has improved its signal-to-noise ratio to 68% through better documentation, a dedicated testing playground (CumulusFire), and a streamlined vulnerability management process with automated ticketing and SLA-driven remediation. The company has paid out over $211,512 in bounties through its private program and is now expanding to a public offering.
  379. Incorrect proxying of 24 hostnames on January 24, 2022This post details an incident where a product migration for Cloudflare for SaaS resulted in 24 hostnames, including www.cloudflare.com, being incorrectly proxied to the wrong origin (clickfunnels.com). It highlights a critical failure in the migration process for 'blocked' hostnames, leading to unintended traffic redirection. The post outlines the immediate remediation steps, the scale of the impact, and crucial procedural and technical follow-ups to prevent recurrence, such as stricter validation for blocked hostnames and enhanced monitoring during migrations.
  380. Cloudflare customers on Free plans can now also get real-time DDoS alertsThis post extends the availability of real-time DDoS alerts to Cloudflare's Free plan users. It details how these alerts are configured via notification policies in the Cloudflare dashboard and reiterates Cloudflare's unmetered DDoS mitigation commitment and the underlying network infrastructure and analysis mechanisms used for detection and mitigation.
  381. DDoS Attack Trends for Q4 2021This post details the DDoS attack trends observed on the Cloudflare network during Q4 2021 and the full year. It highlights the increase in ransom DDoS attacks, application-layer DDoS attacks (particularly against the Manufacturing industry), and network-layer DDoS attacks, including terabit-strong attacks. It also identifies key attack origins (China for application-layer, Moldova for network-layer) and common attack vectors (SYN floods, UDP floods). The post also mentions the emergence of the Meris botnet and the impact of the Log4j2 vulnerability.
  382. From 0 to 20 billion - How We Built Crawler HintsThis post introduces 'Crawler Hints,' a new capability aimed at reducing the environmental impact of web searches by informing search indexers about content changes. It details the engineering challenges and solutions involved in building this system, including leveraging cache misses as a signal, using Kafka for data pipelines, Redis for distributed buffering and deduplication, and a 'Hinter' interface for dispatching signals to search partners. The post emphasizes customer opt-in, monitoring, and system resilience as key aspects of its rollout.
  383. Protection against CVE-2021-45046, the additional Log4j RCE vulnerabilityThis post details the immediate mitigation of CVE-2021-45046, a second Log4j RCE vulnerability, by updating existing WAF rules (Rule IDs 100514/6b1cc72dff9746469d4695a474430f12, 100515/0c054d4e4dd5455c9ff8f01efe5abb10, 100516/5f6744fa026a4638bda5b3d7d5e015dd) to block exploit attempts targeting HTTP headers, body, and URL. It also introduces a fourth, advanced rule (Rule ID 100517/2c5413e155db4365befe0df160ba67d7) for broader protection with a higher false positive rate, which is disabled by default. The post emphasizes updating Log4j to version 2.16.0 as the primary solution.
  384. Exploitation of Log4j CVE-2021-44228 before public disclosure and evolution of evasion and exfiltrationThis post details the observed evolution of WAF evasion techniques and exfiltration attempts in response to the Log4j CVE-2021-44228 vulnerability. It analyzes the shift from simple attack strings to complex obfuscation methods using Log4j's built-in lookups (e.g., `${lower}`, `${env}`, `${sys}`) and demonstrates how these techniques are used to bypass WAF rules and exfiltrate sensitive data. The post also provides trend data on exploitation attempts and highlights instances of pre-disclosure exploitation, underscoring the need for continuous WAF adaptation and prompt patching.
  385. Sanitizing Cloudflare Logs to protect customers from the Log4j vulnerabilityIntroduced a new Logpush job option (`CVE-2021-44228=true`) to automatically redact the `${` token (replacing it with `x{`) in logs sent to customers. This mitigation is specifically designed to protect customers whose log consumption software uses Log4j and is vulnerable to CVE-2021-44228, preventing exploit attempts via log data. The redaction is necessary due to the expressiveness of Log4j's templating language and the observed obfuscated variants of the exploit pattern.
  386. Maximum redirects, minimum effort: Announcing Bulk RedirectsThis post introduces 'Bulk Redirects', a new product that allows administrators to upload and manage hundreds of thousands of URL redirects via the dashboard without writing code. This significantly expands the capabilities beyond the previous Page Rule limit of 125 redirects and offers a more user-friendly alternative to custom Cloudflare Workers for implementing redirects. It addresses common use cases like website migrations, vanity URLs, and security enforcement (e.g., forcing HTTPS).
  387. Version and Stage Configuration Changes with HTTP Applications in BetaIntroduced HTTP Applications and Routing Rules to manage edge configuration by use case rather than by hostname. HTTP Applications allow for versioning of configurations, with each version representing a snapshot of settings. Routing Rules map hostnames to specific versions of HTTP Applications, enabling safe testing and deployment of changes. Staging rules allow for testing with specific edge IPs, while production rules apply validated changes to all customers. This addresses issues of manual configuration effort, risk of drift between production and staging, and error-prone manual change reproduction.
  388. What’s new with Notifications?This post significantly enhances the 'Website Security & Threat Management' thread by detailing the evolution of Cloudflare's notification system. It highlights the shift from email-only notifications to robust webhook support for various messaging and monitoring platforms (Slack, Teams, Discord, DataDog, Splunk, etc.), enabling real-time alerts directly within customer workflows. Furthermore, it introduces notification history, providing a crucial log of past alerts for 30-90 days, addressing the issue of lost or missed notifications and improving overall system observability and recovery capabilities.
  389. How Cloudflare security responded to Log4j 2 vulnerabilityThis post details Cloudflare's internal response to the Log4j2 vulnerability (CVE-2021-44228). It outlines the process of identifying vulnerable systems (ElasticSearch, LogStash, Bitbucket), applying mitigation strategies (removing JndiLookup class, setting system property), and reviewing external reports. It also describes the internal investigation using asset inventory, code scanning, log analysis, network analytics, and endpoint analysis to confirm no compromise. The post highlights the effectiveness of defense-in-depth strategies like restricting outbound traffic and using Cloudflare Access for internal services.
  390. Secure how your servers connect to the Internet todayThis post details the immediate response to the Log4j vulnerability (CVE-2021-44228) by updating Cloudflare's WAF to block malicious strings. It also introduces and elaborates on the use of Cloudflare Gateway for protective DNS filtering and logging, and Cloudflare One's network firewall for securing outbound network traffic (Layers 3-5) via GRE, IPsec, direct connections, or device clients. Additionally, it describes the Secure Web Gateway for HTTP inspection, virus scanning, and logging of outbound HTTP requests, emphasizing a defense-in-depth strategy with positive security models (allow-listing).
  391. Actual CVE-2021-44228 payloads captured in the wildThis post details the actual payloads and statistics observed in the wild during the exploitation of the Log4j vulnerability (CVE-2021-44228). It analyzes blocked exploit requests, the IP addresses originating them, and the geographical distribution of attacks. Specific examples of reconnaissance payloads using LDAP and DNS, as well as evasion techniques like using `${lower}` to bypass simple string blocking, are provided. The post highlights the ongoing nature of these attacks and Cloudflare's continuous efforts to update WAF and firewall rules.
  392. Inside the Log4j2 vulnerability (CVE-2021-44228)This post details the Log4j2 vulnerability (CVE-2021-44228), a critical Remote Code Execution (RCE) flaw in the Java logging package. It explains the vulnerability's history, how it was introduced via the JNDI Lookup plugin, and how attackers can exploit it by controlling LDAP URLs logged by applications. Cloudflare's immediate response involved rolling out WAF rules to block `jndi` lookups in common HTTP request locations to protect customers. The post also provides mitigation steps, including upgrading Log4j or removing the JndiLookup class.
  393. Introducing Cloudflare Domain Protection — Making Domain Compromise a Thing of the PastThis post introduces Cloudflare Domain Protection, a new service for Enterprise customers that aims to prevent domain compromise. It details the common attack vectors for domain hijacking (unauthorized transfers, name server updates, suspensions/deletions) and outlines Cloudflare's 'triple-locked' approach to securing domains, which includes EPP Registrar Locks, internal API locks, and Registry Locks. The service is offered for free to eligible Enterprise customers, including registration and renewal fees, and builds upon existing offerings like Cloudflare Registrar and Custom Domain Protection.
  394. CVE-2021-44228 - Log4j RCE 0-day mitigationDeployed three new WAF rules (IDs 100514/6b1cc72dff97464695a474430f12, 100515/0c054d4e4dd5455c9ff8f01efe5abb10, 100516/5f6744fa026a4638bda5b3d7d5e015dd) to mitigate the Log4j RCE vulnerability (CVE-2021-44228). These rules inspect HTTP headers, body, and URL for exploit patterns and are configured with a default BLOCK action. The update indicates that these rules have been further hardened with a default action of BLOCK.
  395. Introducing Cloudflare Security CenterThis post introduces Cloudflare Security Center, a new unified solution for attack surface management. It integrates existing security products and Internet intelligence to help customers map their attack surface, identify risks, and mitigate them. Key features include Security Insights for reviewing and managing security risks and vulnerabilities, and an Infrastructure view for inventorying IT assets on Cloudflare. The service performs regular scans to identify potential issues and allows for direct resolution of insights within the dashboard. The goal is to make attack surface management accessible and actionable for all organizations.
  396. Magic Firewall gets SmarterMagic Firewall now supports threat intelligence integration, allowing rules to match against managed lists (Malware, Anonymizer, Botnet C&C) and custom IP lists. It also adds geo-blocking capabilities, enabling rules to match on country of origin or destination. Additionally, packet capture functionality has been introduced at the edge, allowing users to capture and filter network traffic using Wireshark syntax.
  397. Why Cloudflare Bought ZarazThis post announces the acquisition of Zaraz by Cloudflare. Zaraz's technology provides a sandboxed environment for third-party scripts, allowing for strict control over their access and behavior. This mitigates security risks associated with compromised third-party scripts, preventing them from accessing sensitive data or causing performance issues. The acquisition aims to integrate Zaraz's capabilities into Cloudflare's platform to ensure all scripts running on customer sites meet modern security, reliability, and performance standards.
  398. Cloudflare acquires Zaraz to enable cloud loading of third-party toolsThis post announces the acquisition of Zaraz and the launch of Cloudflare Zaraz (beta), a product that manages and loads third-party tools in the cloud. It addresses the problems of third-party bloat, performance degradation (average 40% slowdown), and security/privacy risks associated with traditional tag managers. Zaraz aims to improve website speed, privacy, and security by running third-party scripts in the cloud instead of the browser. It offers backward compatibility with Google Tag Manager's dataLayer and includes a library of 18 third-party tools. The post highlights Instacart's success with Zaraz, achieving 0 ms Blocking Time and increased security by proxying requests through their own subdomain using Cloudflare Workers.
  399. Introducing Clientless Web IsolationIntroduced clientless web isolation as a beta feature for Cloudflare for Teams subscribers with Browser Isolation. This capability allows users to access remote browsers via a hyperlink, integrating with Cloudflare Access and Gateway for Zero Trust Network Access (ZTNA). It protects endpoints from malicious code by executing browsing in a remote data center, resetting to a clean state after use. This model supports both managed and unmanaged devices, offering data protection controls like restricted printing, clipboard access, and file transfers.
  400. Page Shield is generally availableThis post announces the General Availability (GA) of Page Shield, a new client-side security product. Page Shield leverages Cloudflare's network position to monitor JavaScript files loaded by web applications. It uses Content Security Policy (CSP) report-only directives to collect information about loaded scripts from the browser. This data is then analyzed against threat feeds and a custom classifier to detect malicious behavior, such as Magecart attacks, cryptomining, and adware. The product provides visibility into scripts, detection of malicious activity, and plans for future prevention and mitigation capabilities. Alerts can be configured for script change events.
  401. Control input on suspicious sites with Cloudflare Browser IsolationIntroduced Cloudflare Browser Isolation as a new capability within the Secure Web Gateway and Zero Trust Network Access services. This feature allows administrators to define Zero Trust policies to prohibit keyboard input and file transmission during high-risk browsing activity, thereby protecting against phishing attacks and credential theft on unknown or high-risk websites. It shifts the risk of executing untrusted code from the user's endpoint to a remote browser hosted in a Cloudflare data center.
  402. Replace your hardware firewalls with Cloudflare OneThis post introduces Cloudflare One as a cloud-native firewall solution designed to replace hardware firewalls. It details the historical evolution of firewalls from stateless packet filtering to stateful inspection, deep packet inspection, and next-generation firewalls (NGFWs) with application awareness. It highlights the shift towards Zero Trust principles and the integration with identity providers. The core contribution is the description of Cloudflare One's capabilities, including flexible on-ramps, global network scalability, comprehensive policy configuration (layers 3-7), integration with Zero Trust attributes, managed lists, deep packet inspection, programmable packet filtering, protected DNS, application/content categories, and remote browser isolation.
  403. How We Used eBPF to Build Programmable Packet Filtering in Magic FirewallThis post details the integration of eBPF with nftables within Cloudflare's Magic Firewall. It explains how eBPF programs can be loaded and executed within the kernel to provide advanced packet parsing and content matching capabilities beyond what nftables alone can offer. The post covers the technical challenges of bridging iptables' xt_bpf extension with nftables, the structure of netlink/netfilter messages required, and the process of compiling and loading eBPF programs using libraries like cilium's ebpf. This enables more sophisticated firewall rules for protocol validation and advanced field matching.
  404. Announcing Anycast IPsec: a new on-ramp to Cloudflare OneThis post introduces IPsec as a new on-ramp to Cloudflare One, enabling customers to securely connect their networks and devices to Cloudflare's global network using a widely supported encryption protocol. It addresses the limitations of traditional IPsec architectures (hub-and-spoke, mesh) by leveraging Cloudflare's Anycast network to provide a single, globally distributed IPsec tunnel. This enhances security by encrypting all traffic, including legacy applications, and improves performance by eliminating latency associated with centralized hubs. The implementation integrates deeply with the Cloudflare One suite, offering unified security, performance, and reliability.
  405. The Grinch Bot is Stealing Christmas!This post introduces the concept of 'Grinch Bots' as a specific type of seasonal bot attack targeting online inventory during the holiday season. It details the scale of bot traffic observed during Black Friday and Cyber Monday, highlighting that nearly 44% of internet traffic comes from bad bots. The post explains how Cloudflare's Bot Management and Bot Fight Mode are used to combat these threats, including the use of JS Challenges and the impact on bot operators. It also mentions the detection of over 300 billion bots attempting to 'add to cart' and 71% of login traffic originating from bots.
  406. Get notified when your site is under attackIntroduced proactive security event notifications for Business and Enterprise customers, enabling alerts via email, PagerDuty, or webhooks. This includes a 'Security Events Alert' for all firewall events and an 'Advanced Security Events Alert' for specific services. The alerting mechanism for security events utilizes Z-score calculations to detect anomalies in firewall event data, with an initial threshold of 3.5.
  407. Attack Maps now available on RadarThis post introduces Cloudflare Radar Maps, which provide near real-time geographical visualizations of application-level attack origins and targets, and Sankey diagrams illustrating attack flows. This significantly enhances the visibility and understanding of cyber threats, building upon existing threat management capabilities by offering a new way to consume and analyze attack data at a global scale.
  408. Modifying HTTP response headers with Transform RulesIntroduced a new action within Transform Rules: "HTTP Response Header Modification". This allows users to set or remove HTTP response headers as traffic returns to the client, providing an easier alternative to Cloudflare Workers for this functionality. It supports setting dynamic values (e.g., bot score, visitor country) and static literal strings, as well as removing headers. Cloudflare functions like concat(), regex_replace(), to_string(), and lower() can be used within 'set dynamic' modifications. The rule builder offers filtering based on various parameters like visitor country, bot score, user agent, etc.
  409. Cloudflare blocks an almost 2 Tbps multi-vector DDoS attackThis post details the mitigation of a nearly 2 Tbps multi-vector DDoS attack combining DNS amplification and UDP floods. It explains Cloudflare's out-of-path traffic analysis for sub-second detection, real-time signature generation, and ephemeral rule propagation to the edge. Specifically, it highlights the use of eBPF/XDP in the Linux kernel for wirespeed packet dropping of attack traffic.
  410. A Brief History of the Meris BotnetThis post details the analysis of the Meris botnet, a significant threat that exploits MikroTik router vulnerabilities (CVE-2018-14847) to launch large-scale DDoS attacks. It describes the botnet's characteristics, attack vectors (HTTP pipelining, SOCKS proxies), targets (industries and countries), and compares it to the Mirai botnet. Cloudflare's existing DDoS protection systems automatically detect and mitigate these attacks, with additional rules deployed for more comprehensive mitigation and threat intelligence gathering. The post also highlights the use of Cloudflare Radar for visualizing attack data.
  411. Sizing Up Post-Quantum SignaturesThis post introduces the challenge of post-quantum cryptography (PQ) for TLS security, specifically focusing on digital signatures. It highlights the need to transition to PQ signatures due to the threat posed by quantum computers and discusses the performance and size trade-offs of various PQ signature schemes (Dilithium, Falcon, Rainbow) compared to current standards (RSA, ECDSA). The post details Cloudflare's experimental approach to testing the impact of larger signatures on TLS handshakes by using dummy certificates, aiming to gather real-world data on client compatibility and performance.
  412. DDoS Attack Trends for Q3 2021This post provides a detailed analysis of DDoS attack trends observed in Q3 2021, categorizing them into application-layer (L7) and network-layer (L3/4) attacks. It highlights the emergence of the Meris botnet and its role in large HTTP DDoS attacks, as well as the resurgence of Mirai-variant botnets responsible for terabit-scale network-layer attacks. The post also details geographical trends in attack origins and targets, industry-specific targeting, and the evolution of attack methodologies, including a significant increase in DTLS amplification attacks and larger packet rate attacks.
  413. Traffic Sequence: Which Product Runs First?This post introduces 'Traffic Sequence', a new dashboard feature that visually illustrates the execution order of Cloudflare products for a given HTTP request. It addresses the growing complexity of Cloudflare's product ecosystem and the difficulty users face in understanding how different features like Firewall Rules, Workers, and Transform Rules interact. The post details the development of Traffic Sequence from a 'napkin idea' to a fully integrated feature, highlighting its benefits for customer understanding, product discoverability, and navigation. It also provides a concrete example of how understanding traffic sequence is crucial for effective configuration, particularly with the interplay between URL rewriting and Firewall Rules.
  414. Crawler Hints Update: Cloudflare Supports IndexNow and Announces General AvailabilityThis post announces the general availability of Cloudflare Crawler Hints and its support for the IndexNow protocol. Crawler Hints aims to reduce wasted crawl traffic by signaling to search engines when content has been created, updated, or deleted. This is achieved by leveraging Cloudflare's position as a CDN to provide change event signals to search engines like Bing and Yandex. The feature is available for free to all Cloudflare customers via a one-click opt-in in the Cache tab of the dashboard. The post highlights the environmental benefits of reduced crawl traffic and improved search result freshness.
  415. “Look, Ma, no probes!” — Characterizing CDNs’ latencies with passive measurementThis post details a novel method for characterizing CDN latencies using passive network measurements, specifically by leveraging Cloudflare's own RTT measurements as a proxy for estimating latency between clients and other CDNs. It outlines a two-step process: 1) Predicting Anycast Catchments by compiling network footprints of CDNs using data from ISPs, PeeringDB, IXP databases, and BGP data, and 2) Predicting CDN Path Latencies by utilizing passive RTT measurements from Cloudflare's infrastructure. The post emphasizes the limitations of active measurements and the value of passive measurements for understanding performance and validating models.
  416. Multi-User IP Address DetectionThis post introduces 'multi-user IP address detection' as a new capability within Cloudflare's security offerings. It explains the challenges posed by shared IP addresses due to NAT and CG-NAT, where a single IP can represent multiple users. The post details the technical approach to identifying these multi-user IP prefixes by analyzing distinct source ports and user agents, and leveraging external data sources like PeeringDB and IRR. This feature allows customers to make more informed security decisions, reducing false positives and improving the accuracy of threat detection by differentiating between legitimate traffic from shared IPs and potentially malicious automated traffic.
  417. Geo Key Manager: Setting up a service for scaleThis post details the evolution and scaling challenges of Geo Key Manager, a service allowing customers to control the geographic storage of their TLS certificate private keys. It describes how the service, initially a research project leveraging Keyless SSL and identity-based encryption, faced performance issues and TLS handshake failures due to increased scale and trans-pacific latency. The post delves into the technical architecture of TLS termination, the roles of services like keynotto and gokeyless, and the performance implications of head-of-line blocking and remote key signing. It also includes a comparative analysis of Go vs. Rust for cryptographic operations, highlighting the performance benefits of Rust in keynotto for CPU and memory consumption.
  418. Research Directions in Password SecurityThis post details Cloudflare Research's exploration into advanced authentication methods to combat password reuse and credential stuffing attacks. It introduces Password Authenticated Key Exchanges (PAKEs), specifically focusing on Strong Asymmetric PAKEs (saPAKEs) like OPAQUE, which aim to establish secure keys without revealing plaintext passwords to the server. It also highlights the rollout of the Exposed Credential Checks feature in the WAF, powered by the Might I Get Pwned (MIGP) protocol, which detects compromised credentials and variants by using a private membership test protocol and generating password variants.
  419. Exported Authenticators: The long road to RFCThis post introduces Exported Authenticators (EAs) as a new extension to TLS. EAs enable application-layer authentication that is as strong as TLS authentication and can be tied to the TLS channel via channel binding. This allows for advanced authentication possibilities such as TLS connections with multiple certificates and logging into websites without revealing passwords. The design of EAs closely follows the TLS 1.3 handshake to ensure security and leverages existing cryptographic primitives.
  420. Introducing SSL/TLS RecommenderThis post introduces the SSL/TLS Recommender tool, which guides users to stronger configurations for the backend connection from Cloudflare to origin servers. It explains the importance of securing this connection, detailing the different SSL/TLS encryption modes (Off, Flexible, Full, Full (strict), Strict) and the challenges in detecting and enforcing HTTPS support on origin servers. The post highlights how this tool builds upon the earlier initiative of Universal SSL to further enhance website security by ensuring encrypted communication between Cloudflare's edge and customer origins.
  421. Handshake Encryption: Endgame (an ECH update)This post details the initial deployment of TLS Encrypted Client Hello (ECH), an extension to TLS that encrypts sensitive metadata in the ClientHello message. It explains the privacy benefits of ECH by preventing the visibility of target server names to network observers, contrasting it with DNS-over-HTTPS (DoH). The post also delves into the evolving threat model for ECH, discussing active and passive attacks and how ECH's design aims to mitigate them, particularly concerning the anonymity set and preventing domain fronting.
  422. Privacy Pass v3: the new privacy bitsThis post announces Privacy Pass Extension v3.0, detailing significant refactoring of the browser extension for improved maintainability and extensibility. Key technical changes include implementing the extension in TypeScript, using a module bundler, refactoring the API for cryptographic primitives, and treating provider-specific code as encapsulated modules rather than configuration properties. This modular approach allows for easier integration of future service providers by enabling provider-specific WebRequest API event listeners and moving from configuration files to programmable modularization. The post also discusses the evolution of the Privacy Pass protocol, its standardization at IETF, and future work on metadata to address hoarding attacks, including exploring key rotation as a potential solution.
  423. Helping Apache Servers stay safe from zero-day path traversal attacks (CVE-2021-41773)This post details the CVE-2021-41773 path traversal vulnerability in Apache HTTP Server, explaining how it works by exploiting missing path normalization logic and the impact of percent-encoded characters. It highlights that Cloudflare customers with 'normalize URLs to origin' enabled are protected, and provides specific WAF rule IDs (`1c3d3022129c48e9bb52e953fe8ceb2f`, `ca955959c4ab4b1f84f681a4d0a5c982`, `100045`, `100045A`) for additional protection. It also shows a graph of exploit attempts and lists commonly targeted file paths.
  424. Waiting Room: Random Queueing and Custom Web/Mobile AppsThis post introduces Cloudflare Waiting Room's new 'random queueing' feature, offering an alternative to the existing FIFO (First-In-First-Out) queueing method. Random queueing provides a fairer distribution of access during high-demand events by selecting users randomly, regardless of their arrival time, thus encouraging users to stay on the site longer. The post also details the technical implementation of both FIFO and random queueing, explaining how cookies, bucket IDs, and available slots are managed, and how the system can seamlessly transition between queueing methods. Additionally, it announces the general availability of Waiting Room to Enterprise customers and its support for custom web/mobile applications.
  425. Update on recent VoIP attacks: What should I do if I’m attacked?This post details common attack patterns against VoIP infrastructure, including TCP floods targeting stateful firewalls, UDP floods and reflection targeting SIP infrastructure, and SIP protocol-specific application layer attacks. It recommends proactive deployment of always-on DDoS mitigation services like Cloudflare Magic Transit, enforcement of positive security models, custom mitigation strategy development with vendors, and employee education on ransom demands. It highlights Cloudflare's capacity and existing mitigations for these attacks.
  426. Staging TLS Certificates: Make every deployment a safe deploymentThis post introduces a new capability for Enterprise customers to stage custom uploaded TLS certificates in a staging environment before deploying them to production. This feature aims to de-risk certificate deployments by allowing users to test new certificates against staging IPs, verify hostname coverage, and ensure compatibility with certificate pinning configurations. It also provides a rollback mechanism in case of deployment issues and outlines future plans to extend staging capabilities to certificate renewals and TLS configuration changes.
  427. May I ask who’s calling, please? A recent rise in VoIP DDoS attacksThis post details the rise of VoIP DDoS attacks, explaining how attackers exploit UDP and SIP protocols to overwhelm VoIP servers. It highlights Cloudflare's Magic Transit service and its Anycast architecture for mitigating these attacks without impacting latency. The post also describes the use of XDP for wire-speed packet dropping and the development of specific mitigation rules for UDP traffic to identify and drop invalid SIP traffic, ensuring the protection of VoIP services.
  428. How Cloudflare helped mitigate the Atlassian Confluence OGNL vulnerability before the PoC was releasedThis post details Cloudflare's proactive mitigation of the Atlassian Confluence OGNL injection vulnerability (CVE-2021-26084) before a public Proof of Concept was released. It highlights the immediate review of the vulnerability, the preparation and emergency release of a WAF rule (IDs `100400` and `e8c550810618437c953cf3a969e0b97a`), and the protection offered to customers using Cloudflare WAF and Access. The post analyzes traffic patterns, showing that malicious scanning began days before the PoC, and details the types of attacks observed (command injection, request port anomalies, fake bot signatures, OWASP ModSecurity Core Ruleset triggers, and HTTP request anomalies) before the specific rule was deployed. It emphasizes the effectiveness of a layered security approach.
  429. Announcing Tenant Control in Cloudflare GatewayIntroduced Tenant Control in Cloudflare Gateway, allowing administrators to enforce corporate application usage and data boundaries. This is achieved by appending specific headers, including a tenant ID, to requests, which SaaS applications use to block consumer/personal usage or logins to accounts not part of the specified tenant. This feature leverages HTTP filtering policies within Cloudflare Gateway and integrates with corporate devices via the WARP agent, offering a more performant alternative to traditional VPN backhauling.
  430. Cloudflare thwarts 17.2M rps DDoS attack — the largest ever reportedThis post details the detection and mitigation of a record-breaking 17.2 million rps DDoS attack by Cloudflare's autonomous edge DDoS protection systems. It highlights the role of the 'dosd' daemon in analyzing traffic samples out-of-path, generating real-time mitigation rules, and propagating them to optimal stack locations (e.g., L4 iptables) for efficient mitigation. The post also discusses the resurgence of Mirai and other botnets, providing statistics on attack volumes and sources, and emphasizes the importance of always-on, automated protection for businesses and IoT devices.
  431. Introducing Shadow IT DiscoveryIntroduced Shadow IT Discovery feature within Cloudflare for Teams Gateway. This feature analyzes HTTP requests logged by Gateway to identify and categorize SaaS applications used by an organization. It allows administrators to review applications, mark them as approved or unapproved, and then apply Gateway rules to block unapproved applications. The feature also provides user count data for applications to aid in license management.
  432. More devices, fewer CAPTCHAs, happier usersThis post details the expansion of Cloudflare's Cryptographic Attestation of Personhood experiment to include support for biometric authenticators (Face ID, Windows Hello, Android Biometric Authentication) and FIDO Alliance certified hardware tokens. It also introduces the use of Zero Knowledge Proofs (ZKP) to enhance privacy by verifying the existence of a valid security key without disclosing additional information. The post highlights the privacy-preserving nature of the WebAuthn API and the on-device processing of biometric data.
  433. Helping Keep Governments Safe and SecureThis post details Cloudflare's partnership with Accenture Federal Services to deliver a protective DNS resolver solution to the Department of Homeland Security (DHS). This initiative leverages Cloudflare's extensive DNS query data, combined with Accenture's threat intelligence and AI/ML analysis, to block malicious hostnames and protect federal government agencies from cyberattacks. It highlights the application of Cloudflare's security expertise to a critical government sector, building on previous efforts like the Athenian Project.
  434. Cloudflare's Handling of an RCE Vulnerability in cdnjsThis post details Cloudflare's response to a Remote Code Execution (RCE) vulnerability discovered in cdnjs, a platform that utilizes Cloudflare's services. It highlights Cloudflare's rapid incident response, including blocking exploitation, revoking credentials, and investigating potential abuse. The post also outlines the remediation efforts, which involved fixing path traversal issues, implementing AppArmor profiles, and a complete redesign of the auto-update pipeline using a microservices architecture with sandboxed Docker containers to enhance security and prevent future vulnerabilities.
  435. AWS’s Egregious EgressThis post analyzes AWS's egress bandwidth pricing model, highlighting significant markups compared to wholesale costs and contrasting it with Cloudflare's Bandwidth Alliance, which waives egress fees for mutual customers. It details the 'stocks' vs. 'flows' pricing models and criticizes AWS for not passing on savings from peering agreements, suggesting it's a customer lock-in strategy. The post also notes the asymmetry in AWS charging for egress but not ingress, which is contrary to wholesale bandwidth pricing.
  436. Empowering customers with the Bandwidth AllianceThis post introduces the Bandwidth Alliance, a partnership of cloud providers and Cloudflare aimed at reducing egress fees for data transfer. It explains how Cloudflare's extensive network and private interconnects with partners enable cost-effective data transfer, thereby preventing vendor lock-in and offering customers greater choice and savings. The post highlights customer benefits through case studies and mentions integration with Microsoft Azure for discounted egress.
  437. DDoS attack trends for 2021 Q2This post details DDoS attack trends observed on Cloudflare's network during Q2 2021. It highlights a significant increase in HTTP DDoS attacks targeting government administration and consumer services, with China and the US being prominent sources and targets. Emerging threats include amplification attacks abusing QOTD and an increase in QUIC-based attacks. Network-layer DDoS attacks in the 10-100 Gbps range also saw an increase. The post provides detailed statistics on attack distribution by market industry, source country, target country, attack size (bit rate and packet rate), and duration, emphasizing the need for always-on, automated DDoS protection.
  438. Smart(er) Origin Service Level MonitoringThis post introduces Origin Error Rate notifications, a significant enhancement to website availability monitoring. It moves beyond simple 'origin down' alerts to sophisticated anomaly detection using Service Level Objectives (SLOs) and burn rate calculations. This allows for proactive notification of elevated 5xx errors from origin servers, even when they are not a complete outage, by analyzing error rates against user-defined SLOs and employing both short and long-term indicators to minimize false positives and ensure timely alerts.
  439. Transform Rules:"Requests, Transform and Roll Out!"This post introduces Transform Rules, a new feature that allows users to modify HTTP requests at the edge without writing Cloudflare Workers. It covers three main capabilities: URL Normalization (decoding encoded URLs to prevent security bypasses), URL Rewrite (static and dynamic modification of URL paths and query strings based on request attributes), and Header Modify (adding or removing static or dynamic headers, including bot scores, to requests sent to origin servers. This provides a more accessible way to manage request shaping for security and application optimization.
  440. Account Takeover Protection and WAF mitigations to help stop Global Brute Force CampaignsThis post details the immediate rollout of WAF mitigations and the expansion of the Exposed Credential Check feature to all paid plans in response to a global brute force campaign. New WAF rules (100197 and 100197B) are introduced to block reGeorg web shell variants. The Exposed Credential Check feature, previously in beta, is now generally available for Pro plans and above, providing a header (`Exposed-Credential-Check: 1`) to origin servers when compromised credentials are detected. It supports common application types like WordPress, Joomla, and Microsoft Exchange, and can be enabled via a support ticket for immediate activation. Additional recommended mitigations include MFA, account lockout, managed IP lists for open proxies, and Super Bot Fight Mode.
  441. Building Waiting Room on Workers and Durable ObjectsThis post introduces and details the Cloudflare Waiting Room feature, a new capability designed to manage extreme traffic spikes for web applications. It explains the functionality, configuration options (Total Active Users, New Users Per Minute, Session Duration), and the underlying technical implementation using Cloudflare Workers and Durable Objects. The post elaborates on how Waiting Room protects origin servers by creating an orderly queue, issuing encrypted cookies as tickets, and managing user slots across data centers using historical traffic data and a clustering mechanism for queue position tracking. It also details the structure of the user cookie and the concept of Waiting Room state management.
  442. Enable secure access to applications with Cloudflare WAF and Azure Active DirectoryThis post details the integration of Cloudflare's Web Application Firewall (WAF) with Azure Active Directory B2C (Azure AD B2C) for custom domains. It explains how customers can use Cloudflare's WAF to protect their Azure AD B2C authentication endpoints, leveraging Cloudflare's threat intelligence and rule engine alongside Azure AD B2C's native identity protection features. The integration allows for custom security rules, rate limiting, DDoS mitigation, and advanced bot management for B2C applications hosted on custom domains.
  443. Modify HTTP request headers with Transform RulesIntroduced HTTP Request Header Modification as a new action within Transform Rules, providing a no-code interface for administrators to modify HTTP request headers before they are sent to origin servers. This feature allows setting, removing, or dynamically populating headers using static values, Cloudflare functions (concat, regex_replace, to_string, lower), and dynamic values like Bot Score or visitor country. This offers an easier alternative to Cloudflare Workers for header manipulation.
  444. Cloudflare’s SOC as a ServiceThis post announces the general availability of Cloudflare SOC as a Service. This service augments customer security teams by providing 24x7x365 monitoring, triage, response, and mitigation of security threats and operational disruptions. It leverages Cloudflare's security products and a dedicated team of Security Operations Engineers. The service utilizes a proprietary, algorithm-based alerting system that baselines traffic patterns to minimize false positives and detect unmitigated events. It categorizes alerts as informational or actionable, prioritizing immediate response to actionable events. The service also offers integration with Managed Security Service Providers (MSSPs) who can provide hands-on-keyboard configuration updates, fine-tuning, and integration with third-party security tools and SIEM platforms.
  445. Humanity wastes about 500 years per day on CAPTCHAs. It’s time to end this madnessIntroduced Cryptographic Attestation of Personhood as a CAPTCHA alternative, leveraging WebAuthn and hardware security keys (like YubiKey) for user presence testing and cryptographic attestation. This system aims to replace traditional CAPTCHAs by providing a faster, more private, and accessible method for verifying human users, reducing wasted time and improving user experience.
  446. Designing the new Cloudflare Web Application FirewallThis post details the redesign of the Cloudflare Web Application Firewall (WAF) dashboard. It outlines the process of identifying customer tasks using Job Stories, prioritizing common workflows (like enabling the WAF with defaults), and refining the interface. Specific improvements include a single-click activation for the WAF, a 'Ruleset Action' to apply a single action to all rules within a ruleset, and the ability to select and modify multiple rules simultaneously in the Rule Browser. The design process utilized Figma and was informed by telemetry data showing that 76% of WAF users utilize default configurations.
  447. DDoS attack trends for 2021 Q1This post provides a detailed analysis of DDoS attack trends observed in Q1 2021. It breaks down application-layer attacks by industry, source country, and target country, and discusses ransom DDoS attacks. For network-layer attacks, it covers the number of attacks, size (bit rate and packet rate), duration, common attack vectors (SYN, RST, UDP, DNS amplification), and emerging threats like QUIC version negotiation floods and attacks targeting Jenkins and TeamSpeak3 servers. The post also highlights the underlying technologies used for detection and mitigation, such as the autonomous edge DDoS protection system and its asynchronous traffic analysis.
  448. A Boring Announcement: Free Tunnels for EveryoneThis post introduces Cloudflare Tunnel (formerly Argo Tunnel) as a free service for establishing secure, outbound-only connections from origin servers to Cloudflare. This significantly enhances Zero Trust security by eliminating the need to expose origin IPs or manage complex firewall rules, allowing all traffic to be inspected and controlled by Cloudflare. The post also details improvements to Tunnel's stability and persistence, including the removal of internal dependencies, migration to Cloudflare's edge load balancer Unimog, and the introduction of Named Tunnels for autonomous reconnection, further strengthening the security and reliability of origin connectivity.
  449. Announcing Cloudflare for SaaS for EveryoneThis post announces the evolution of 'SSL for SaaS' into 'Cloudflare for SaaS', making advanced security and performance features previously exclusive to Enterprise customers available to all SaaS providers. It highlights how Cloudflare for SaaS extends the benefits of Cloudflare's network (DDoS mitigation, WAF, performance optimizations) to SaaS providers and their customers, simplifying infrastructure management, certificate provisioning, and enabling custom domain support. The post also showcases how this integrates with Cloudflare Workers to provide a comprehensive platform for SaaS development.
  450. Dynamic URL Rewriting at the edge with CloudflareIntroduced Transform Rules, a new feature allowing URL rewriting at the edge. This includes static rewrites (e.g., `/index.php` to `/landing.php`) and dynamic rewrites using expressions (e.g., `regex_replace()`, `concat()`). Transform Rules execute early in the Cloudflare traffic flow to ensure predictability for subsequent products. Also introduced URL Normalization, enabled by default, to standardize URL encoding and prevent security bypasses. Page Rules were moved to a new 'Rules' section.
  451. End User Security: Account Takeover Protections with CloudflareIntroduced Open Proxy managed list for Firewall Rules, Super Bot Fight Mode for Pro/Business plans to combat credential stuffing, Exposed Credential Checks within WAF to warn users of compromised credentials using a privacy-preserving cryptographic protocol, Cloudflare Access integration with managed devices for device serial number verification, and Rate Limiting on failed logins to slow down brute-force attacks.
  452. A new Cloudflare Web Application FirewallIntroduced a new WAF engine written in Rust, adopting the wirefilter syntax. This engine replaces the previous LuaJIT implementation and aims to improve performance, security, and scalability. The post details enhancements to the WAF UI for better rule browsing and configuration, including one-click deployment, filtering by status/action/tag, bulk editing, and a review screen for changes. Updated rulesets, including the OWASP Core Ruleset to v3.3, with improved false positive rates and new features like paranoia levels and rule tags. Introduced global configuration capabilities for account-wide WAF deployments and native versioning/rollback for rulesets.
  453. Keyless SSL now supports FIPS 140-2 L3 hardware security module (HSM) offerings from all major cloud providersThis post announces the integration of Keyless SSL with FIPS 140-2 Level 3 validated HSMs from major cloud providers (AWS, Google Cloud, IBM Cloud, Microsoft Azure) and other PKCS#11 compliant HSMs. It details the architecture of Keyless SSL, the role of HSMs in cryptographic operations, and provides a step-by-step guide for setting up and using Microsoft Azure Managed HSM with the gokeyless daemon. This extends Cloudflare's ability to secure HTTPS connections for customers with strict key custody requirements.
  454. Heartbleed RevisitedThis post revisits the Heartbleed vulnerability from 2014, highlighting how Cloudflare has incorporated its lessons into its security posture. It details advancements in TLS/SSL key protection and management, including Keyless SSL, Geo Key Manager, Keyless Everywhere, and Delegated Credentials, which provide defense-in-depth against key compromise. It also discusses improvements in certificate revocation mechanisms, such as OCSP stapling and OCSP Must-staple, to mitigate the impact of future key compromises. The post contrasts the security landscape of 2014 with the present, showcasing Cloudflare's continuous innovation in TLS/SSL security.
  455. Introducing: Advanced Certificate ManagerThis post introduces Advanced Certificate Manager (ACM), a significant upgrade to Cloudflare's TLS certificate management capabilities. ACM allows for granular control over certificate validity periods (down to 14 days), custom cipher suite selection for TLS connections, and the generation of Certificate Signing Requests (CSRs) for customers who wish to use their own Certificate Authorities. It also expands the ability to issue multiple edge certificates per zone and offers flexibility in validation methods and CA choices, directly contributing to enhanced website security and customization.
  456. Introducing Super Bot Fight ModeIntroduced 'Super Bot Fight Mode' as an evolution of 'Bot Fight Mode'. This new feature provides enhanced bot detection and mitigation capabilities for Pro and Business plan users. Pro plans gain access to a real-time Bot Report, with options to challenge or block 'definitely automated' traffic and enable JavaScript Detections. Business plans receive Bot Analytics, the ability to target 'likely automated' traffic (identified by machine learning), and more granular control over challenges and blocks. Enterprise Bot Management continues to offer advanced features like API Abuse Detection.
  457. Announcing API Abuse DetectionIntroduced API Discovery and API Abuse Detection. API Discovery maps API endpoints by normalizing paths using unsupervised learning and cardinality. API Abuse Detection uses volumetric anomaly detection (adaptive rate limiting based on request frequency per endpoint) and sequential anomaly detection (using Markov Chains to model valid request flows and flag deviations) to identify malicious bot traffic targeting APIs.
  458. Mitigating Bot Attacks against CloudflareThis post details the evolution of Cloudflare's Bot Management product, highlighting its application in mitigating bot attacks against Cloudflare.com's own forms and dashboard (SEO spam, account signups). It introduces Super Bot Fight Mode for Pro and Business plans, emphasizing the role of ML models and anomaly detection in identifying and blocking automated traffic. The post also discusses the use of bot scores in payment fraud detection via Cloudflare Workers and the importance of global data scale for model training.
  459. Page Shield: Protect User Data In-BrowserIntroduced Page Shield, a client-side security product to detect attacks in end-user browsers, specifically targeting supply chain attacks via third-party JavaScript. The first feature, Script Monitor, alerts customers to new JavaScript dependencies by leveraging a Content-Security-Policy-Report-Only header. Future plans include code change detection and intelligent analysis of malicious JavaScript, with a negative security model for blocking scripts.
  460. Announcing Cloudflare’s Data Loss Prevention platformThis post introduces Cloudflare's Data Loss Prevention (DLP) platform as a new capability within Cloudflare One. It details how DLP leverages Cloudflare's network for inline inspection of all traffic to build Zero Trust controls over enterprise data. Key features include capturing and logging DNS queries, requests, and file uploads/downloads for audit trails, layering on the Secure Web Gateway for context, and building RBAC rules for SaaS applications. It also introduces WAF rules to scan and block responses containing sensitive data from external-facing applications and promises future capabilities to scan all traffic leaving devices and locations for data loss without performance compromise.
  461. Protecting your APIs from abuse and data exfiltrationThis post announces the general availability of Schema Validation for Enterprise customers, a managed IP List for blocking open proxies, enhanced client certificate lifecycle management (revocation/restoration), and the beta release of Data Loss Prevention (DLP) for egress traffic. Schema Validation now accepts OpenAPI v3 specifications and is deployable via the Cloudflare dashboard. DLP identifies sensitive data in response payloads and is released as a managed ruleset. The 'Cloudflare Open Proxies' managed IP list is now available for Firewall Rules. Certificate revocation is now a managed feature, removing the need for custom Workers KV solutions.
  462. Using Cloudflare for Data Loss PreventionThis post details how Cloudflare's existing products, including Access, Gateway, Browser Isolation, and API Shield, can be used to implement Data Loss Prevention (DLP) strategies. It highlights the use of Access for granular authorization and policy enforcement, Gateway for DNS-based malicious domain blocking and endpoint visibility, Browser Isolation for restricting user actions like downloads and copy-pasting, and API Shield for validating API schemas, restricting client certificates, and filtering traffic from untrusted sources. The post emphasizes a Zero Trust model and the multi-layered approach to preventing data exfiltration.
  463. Browser Isolation for teams of all sizesAnnounced Cloudflare Browser Isolation as an add-on to Cloudflare for Teams, making it available to teams of all sizes. Highlighted the reliability and speed benefits of the solution, built on Chromium and using Network Vector Rendering. Emphasized the ease of use and integration within the Cloudflare for Teams suite.
  464. Anatomy of a Targeted Ransomware AttackThis post details the evolution of targeted ransomware and Ransom DDoS attacks, including common initial compromise vectors (RDP/VPN compromise, unpatched vulnerabilities, spear-phishing). It highlights how Cloudflare's products like Access, WAF, Gateway (with AV scanning), and RBI can be used to prevent, detect, and respond to these threats. It also touches on the importance of multi-factor authentication and offsite backups.
  465. Announcing antivirus in Cloudflare GatewayIntroduced antivirus scanning for inbound file downloads within Cloudflare Gateway. This feature scans files at the edge, blocks malicious downloads, and logs details such as the download URL, SHA-256 hash, and the fact that the file was blocked due to malware. This adds an inline malware detection layer to complement existing DNS filtering and HTTP traffic inspection.
  466. Announcing Network On-ramp Partners for Cloudflare OneThis post announces the expansion of Cloudflare One's network connectivity options through new 'Network On-ramp Partnerships' with leading WAN and SD-WAN providers (VMware, Aruba, Infovista) and additional Network Interconnect partners. This allows customers to connect their existing infrastructure to Cloudflare's global network more easily and securely, leveraging features like Magic WAN and Magic Firewall. The post highlights the move away from MPLS and towards a more integrated, software-defined networking approach, with future plans for self-configuration and enhanced Zero Trust security integration.
  467. Magic WAN & Magic Firewall: secure network connectivity as a serviceThis post introduces Magic WAN and Magic Firewall as foundational components of Cloudflare One, extending network security and connectivity to the edge for entire corporate networks. It details how these services replace traditional, complex, and expensive solutions like MPLS and VPNs by providing secure, performant connectivity and centralized firewall policy enforcement as a service. The post highlights use cases for replacing MPLS between branches and data centers, and securing remote employee access, emphasizing the shift towards an edge-based, Zero Trust security model.
  468. Sophisticated Microsoft Spoof Targets Financial DepartmentsThis post details a sophisticated Microsoft 365 spoofing campaign that evaded native defenses and targeted financial departments. It highlights the use of Microsoft-themed sender domains, PDF/HTM/HTML attachments, and advanced phishing kits. The analysis of the campaign's techniques, including domain registration timing, compromised email accounts, and the use of JavaScript escape functions for credential harvesting sites, contributes to the understanding and detection of advanced Business Email Compromise (BEC) attacks.
  469. A deep-dive into Cloudflare’s autonomous edge DDoS protectionIntroduced an autonomous edge DDoS protection system powered by the 'dosd' daemon, deployed across all 200+ data centers. This system detects and mitigates L3-7 DDoS attacks in real-time using eBPF programs in L4Drop and iptables for wire-speed packet dropping. It complements existing core detection mechanisms like Gatebot by enabling faster, more localized attack detection and mitigation.
  470. Lessons Learned from Scaling Up Cloudflare’s Anomaly Detection PlatformThis post details the development and scaling of Cloudflare's Anomaly Detection platform, a key component of its Bot Management system. It explains the underlying technology (HBOS, ClickHouse, Redis, HyperLogLog), the platform's architecture (microservices), and the lessons learned during its evolution from a monolithic service to a highly scalable system capable of processing 500K requests per second. Key contributions include insights into optimizing Redis performance (PFMERGE, recency register, key encoding) and the strategic shift to a microservices architecture to improve resilience and reduce load on shared dependencies.
  471. Control web applications with two-clicks in Cloudflare GatewayIntroduced the ability to manage Cloudflare Gateway HTTP firewall rules based on pre-defined 'Applications' (collections of hostnames for specific cloud services like Salesforce) and 'App Types' (collections of applications like File Sharing). This significantly simplifies policy creation by allowing administrators to block or allow entire applications with a single rule, rather than manually managing hundreds of hostnames. Cloudflare maintains and updates these application collections.
  472. Protecting against recently disclosed Microsoft Exchange Server vulnerabilities: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065This post details the immediate deployment of Cloudflare WAF managed rules (specifically rule IDs 100179 and 100181 within the Cloudflare Specials ruleset) to protect customers against four critical, actively exploited vulnerabilities in Microsoft Exchange Server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065). It explains how these rules block the SSRF, insecure deserialization, and arbitrary file upload exploits, and recommends immediate patching of on-premise systems. It also provides guidance on disabling rules if false positives occur and references external analysis of the vulnerabilities.
  473. Cloudflare recognized as a 'Leader' in The Forrester Wave for DDoS Mitigation SolutionsThis post details Cloudflare's advanced DDoS mitigation techniques, including the use of eBPF rules deployed via XDP for L3-7 protection, flowtrackd for L3/L4 attack defense, and IP Jails for cost-efficient mitigation of volumetric attacks. It also highlights the release of Firewall Analytics and Network Analytics dashboards for improved visibility and real-time DDoS alerts.
  474. Flow-based monitoring for Magic TransitIntroduces flow-based monitoring for Magic Transit on-demand customers. This feature allows customers to send NetFlow or sFlow data from their routers to Cloudflare for analysis. Cloudflare can then detect volumetric DDoS attacks and notify customers via email, webhook, or PagerDuty. This enables customers to activate Magic Transit for protection, either manually or automatically, minimizing the time to mitigation.
  475. Using HPKE to Encrypt Request PayloadsThis post details the implementation of Hybrid Public Key Encryption (HPKE) to securely encrypt and store debugging data for Firewall Rules. It covers the selection of HPKE based on its performance and standardization, the choice of Rust for implementation with WebAssembly compilation for cross-platform use (edge, dashboard UI, CLI), and the user-facing key generation and decryption process. The post also explains how matched data is extracted from HTTP requests using Wirefilter, tagged, processed, encrypted, and stored, with a focus on ensuring that Cloudflare itself cannot decrypt the sensitive data.
  476. 2020 U.S. Election: Cybersecurity AnalysisThis post details Cloudflare's cybersecurity efforts surrounding the 2020 U.S. elections, highlighting the Athenian Project and Project Galileo. It discusses the protection of election-related websites and infrastructure from cyberattacks and traffic surges. While it mentions the success of cybersecurity preparations and the lack of major publicly reported incidents, it does not delve into specific technical implementations of how Cloudflare's systems were built, scaled, migrated, or debugged. The focus is on the *application* of existing security services to a specific event and the organizations protected, rather than the underlying engineering of those services.
  477. Count yourself in for a vaccine phish: new phishing campaign exploits concern over COVID-19 vaccine availabilityThis post details a specific phishing campaign that exploited concerns over COVID-19 vaccine availability. The campaign used sophisticated techniques including display name spoofing, SMTP HELO command spoofing, spoofing a domain without email authentication protocols that no longer resolved, and compromising a legitimate host with a benign IP address. The phishing website used a newly registered domain (NRD) and a compromised VPS in South Africa. The analysis also revealed an open directory on the phishing website containing the PHP script used to process victim information. Area 1 Security's advanced anti-phishing techniques, including early identification of attacker infrastructure, analysis of threat indicators like NRDs and look-a-like domains, real-time correlation with brand infrastructure, and lexical analysis, were instrumental in detecting and stopping this campaign.
  478. Introducing Project Fair Shot: Ensuring COVID-19 Vaccine Registration Sites Can Keep Up With DemandThis post introduces 'Project Fair Shot', a free offering of Cloudflare's new 'Waiting Room' service to government and medical organizations responsible for COVID-19 vaccine distribution. The Waiting Room service, previously in development for managing demand for scarce items, was rapidly deployed to prevent vaccine registration websites from crashing under high traffic loads. This demonstrates an extension of Cloudflare's traffic management capabilities to critical public services during times of high demand.
  479. Cloudflare Waiting RoomIntroduced Cloudflare Waiting Room, a new product built on Cloudflare's edge network and Workers. It protects origin servers from overwhelming demand by placing incoming requests into a virtual queue. The system leverages Workers and Durable Objects for a no-code setup, automatic enablement, and dynamic outflow. It syncs with global demand to determine when to activate the waiting room, ensuring low latency and accurate estimated wait times. The setup involves configuring a hostname, maximum active users, new users per minute, and session duration, with options for default or custom branding.
  480. Network-layer DDoS attack trends for Q4 2020This post details network-layer DDoS attack trends observed in Q4 2020. It highlights an increase in large DDoS attacks (over 500Mbps and 50K pps), a 3-10x increase in protocol-based attacks, and a significant rise in attack durations exceeding 24 hours. Specific attack vectors like NetBIOS, ISAKMP, and SPSS saw substantial increases. The post also analyzes global DDoS activity, noting higher percentages of attack traffic relative to non-attack traffic in Mauritius, Romania, and Brunei, and discusses potential geopolitical or societal factors influencing these trends. A unique 'Beat' attack, inspired by acoustics, is also detailed.
  481. Holistic web protection: industry recognition for a prolific 2020This post details the evolution of Cloudflare's web security capabilities in 2020, focusing on WAF, Bot Management, and DDoS mitigation. Key technical contributions include: decoupling WAF configuration from the zone/domain model for granular control, releasing IP Lists for referencing custom and third-party lists, upgrading the edge-logging framework to push real-time security logs to SIEMs, implementing HPKE for encrypting sensitive log payloads, introducing a data localization suite, re-implementing the Rate Limiting engine in Rust for improved performance and memory safety, adding HMAC functions and regex-based HTTP header/body inspection to the Firewall Rules engine, completing a total rewrite of the Machine Learning engine for Bot Management with nearly double the features, upgrading the behavioral analysis engine for Bot Management, developing a lightweight JavaScript element for browser fingerprinting and User Agent misrepresentation detection, rewriting the CAPTCHA challenge platform for speed and robustness, releasing dedicated Bot Management analytics, and deprecating the __cfduid cookie.
  482. Ransom DDoS attacks target a Fortune Global 500 companyThis post details the experience of a Fortune Global 500 company targeted by a Ransom DDoS (RDDoS) attack. It highlights the company's initial reliance on an on-demand DDoS protection service, which proved too slow to react, leading to significant network failures. Following this incident, the company onboarded to Cloudflare's Magic Transit, an automated always-on DDoS protection service for network infrastructure. The post emphasizes the benefits of automated, always-on protection over reactive, on-demand services and provides recommendations for organizations to prepare for similar attacks, including utilizing automated DDoS protection, building threat models with vendors, and educating employees.
  483. Beat - An Acoustics Inspired DDoS AttackThis post details the 'Beat' attack, a unique ACK DDoS attack inspired by acoustic beat phenomena, which targeted a Magic Transit customer. It explains the mathematical basis of the attack's wave-shaped packet rate, reverse-engineers the attacker's likely equation, and describes how Cloudflare's 'flowtrackd' system, a unidirectional TCP state tracking machine, detected and mitigated the attack by identifying out-of-state ACK packets. This highlights the challenge of stateful TCP attacks in asymmetric routing topologies and the necessity of custom software solutions like flowtrackd for effective mitigation.
  484. Configure identity-based policies in Cloudflare GatewayIntroduced identity-based policies in Cloudflare Gateway, allowing administrators to create rules based on user attributes (username, email, group name/email/ID) integrated with Cloudflare Access and identity providers. This enables fine-grained rule enforcement and user-level visibility in Gateway HTTP logs for auditing and incident investigations. Also announced integration with Cloudflare Isolated Browser for enhanced security against zero-day threats.
  485. A quirk in the SUNBURST DGA algorithmThis post details Cloudflare's analysis of the SUNBURST malware's Domain Generation Algorithm (DGA), uncovering a novel technique where hostnames are split across multiple DNS queries. Cloudflare identified how these fragmented queries are reassembled using XOR operations on their headers, revealing a previously unknown quirk in the malware's communication strategy. This analysis contributes to Cloudflare's ongoing efforts in threat intelligence and the development of advanced security measures to detect and neutralize sophisticated malware.
  486. Trend data on the SolarWinds Orion compromiseThis post details the analysis of DNS query traffic to malicious hostnames associated with the SolarWinds Orion compromise, observed through Cloudflare's 1.1.1.1 resolver. It highlights the use of Domain Generation Algorithms (DGAs) for C2 server discovery and data exfiltration, and the observed trends in query volume, subdomain generation, and geographic distribution of the attack. It also outlines Cloudflare Gateway's role in blocking these C2 domains and assisting customers in identifying potential compromises.
  487. Encrypting your WAF Payloads with Hybrid Public Key Encryption (HPKE)Introduced encrypted WAF matched payload logging, enabling customers to encrypt sensitive data within WAF events using Hybrid Public Key Encryption (HPKE) and their own private keys. This feature enhances security event visibility while preserving end-user privacy by ensuring only the customer can decrypt the matched payloads. The post details the implementation using HPKE, the generation of key pairs via a CLI utility, and the decryption process through the dashboard or CLI.
  488. Phishpoint back in full swing: an infamous Microsoft SharePoint spoof resumes with new tacticsThis post details a specific phishing campaign targeting Microsoft SharePoint credentials, leveraging new COVID-19 restrictions as a lure. It describes the campaign's tactics, including the use of cloud computing services (Azure, Google Storage, AWS) for hosting credential harvesters, VPS for sending messages, and SendGrid to bypass email authentication and SEGs. The analysis includes the spoofed login page's JavaScript, the method of credential exfiltration, and the error message displayed to victims. It highlights the limitations of traditional defenses against such sophisticated attacks and positions Area 1 Security's ML/AI technology as a solution for real-time, time-zero detection.
  489. Securing the post-quantum worldThis post introduces the emerging threat of quantum computing to internet security, specifically its potential to break current cryptographic algorithms like RSA. It highlights Cloudflare's proactive engagement in researching and preparing for post-quantum cryptography, including participation in NIST's standardization efforts, conducting TLS experiments with post-quantum algorithms, and developing high-speed implementations in their CIRCL library. The post signals Cloudflare's commitment to integrating post-quantum cryptography into its internal services and offering it to customers as standards emerge, thus extending its threat management capabilities to future cryptographic landscapes.
  490. Deprecating the __cfduid cookieThis post announces the deprecation of the __cfduid cookie, which was previously used as one signal in bot detection models. The company is transitioning away from this cookie to enhance privacy by not relying on end-user IP addresses for bot detection. This change is driven by experiments showing the possibility of running bot detection algorithms without the cookie, aiming to simplify the web and improve privacy. Customers are given notice to transition, and the bot management team is ensuring no decline in detection quality.
  491. Good-bye ESNI, hello ECH!Introduces Encrypted Client Hello (ECH) as a successor to Encrypted SNI (ESNI). ECH encrypts the entire TLS handshake, protecting sensitive metadata like SNI and ALPN from network observers. It builds upon the lessons learned from ESNI and TLS 1.3's handshake encryption attempts, addressing key distribution challenges and the need for handshake parameters essential for authentication to be sent in the clear. ECH aims to enhance privacy and lay the groundwork for future security and performance features in TLS.
  492. OPAQUE & PAKE Protocols | Securing the Login ProcessThis post introduces and explains the OPAQUE and PAKE cryptographic protocols as a solution to the inherent security vulnerabilities of traditional password-based authentication. It details the problems with password storage and transmission, including cleartext handling on servers, salted hashing, and rainbow tables. The post then elaborates on the principles of Password-Authenticated Key Exchange (PAKE) and its asymmetric variant (aPAKE), highlighting how OPAQUE enables password-based authentication without the server ever seeing plaintext passwords, thus improving security against data breaches.
  493. Network-layer DDoS attack trends for Q3 2020This post details network-layer DDoS attack trends observed in Q3 2020, noting a 4x increase in attacks compared to Q1. It highlights the dominance of SYN, RST, and UDP floods, alongside a surge in protocol-specific attacks like mDNS, Memcached, and Jenkins DoS. The analysis covers attack size (bit rate and packet rate), duration, common attack vectors, and geographical distribution, emphasizing the importance of automated, real-time defense mechanisms.
  494. Automated Origin CA for KubernetesThis post introduces the `origin-ca-issuer`, an extension for cert-manager that integrates with Cloudflare Origin CA. This allows for automated creation and renewal of TLS certificates for domains managed by Cloudflare, specifically for applications deployed within Kubernetes. This enhances the security and manageability of origin servers by simplifying TLS certificate lifecycle management, which is a crucial component of overall website security and threat management.
  495. Phishing campaign threatens job security, drops Bazar and Buer MalwareThis post details a specific phishing campaign that leverages social engineering tactics (threatening job security) to deliver Bazar and Buer malware, often distributed via Trickbot. It analyzes the campaign's lures, the use of cloud-based hosting (Google Docs, Constant Contact) to bypass detection, and the malware's execution flow including RC4 decryption and a custom packer. It also discusses the challenges in disrupting botnet operations due to decentralized infrastructure and the resilience of actors like the Trickbot gang.
  496. Announcing Spectrum DDoS Analytics and DDoS Insights & TrendsIntroduced DDoS Insights & Trends card for dynamic analysis of attack trends over time, including number of attacks, attack traffic percentage, maximum attack rates, mitigated bytes, main attack origin country, and attack duration. Added Group-by Filtering to the main time series chart, allowing users to customize the Y-axis by criteria such as IP protocols, TCP flags, and source country for easier identification of traffic anomalies. Expanded Network Analytics dashboard to Spectrum customers on Enterprise plan, providing visibility into Layer 3/4 traffic patterns and DDoS attacks for configured TCP/UDP applications, including attack size, vectors, source location, and permitted traffic. Introduced real-time alerts for DDoS attacks on configured services. Added CSV export, zoom-in feature for time series charts, drop-down view for average rate and total volume, increased Top N views for source and destination values, and addition of country and data center for source values.
  497. Introducing Bot AnalyticsIntroduced Bot Analytics, a new tool that visualizes automated traffic reaching a website. Bot Analytics provides insights into bot scores, distributions, sources (detection engines), and top requests by source attributes (IP, user agent, ASN). It allows users to set bot thresholds and identify bot attacks, such as aggressive content scraping, by analyzing traffic patterns and anomalies. Bot Analytics is included for customers with Bot Management and offers a snapshot for Enterprise sites without it.
  498. Bot Attack trends for Jan-Jul 2020This post analyzes bot attack trends from January to July 2020, providing a detailed breakdown of bot traffic composition (verified, definitely automated, likely automated, likely human) and its distribution across regions (North America, Europe, Asia). It examines hourly and weekly fluctuations in bot traffic, contrasting it with human traffic patterns, and highlights the significant contribution of North America to automated traffic. The post also touches upon the impact of the COVID-19 pandemic on global traffic and bot behavior, and introduces Cloudflare's bot scoring system and challenge platform.
  499. How a Customer's Trust in Cloudflare Led to a Big Win against BotsThis post details a customer success story where Cloudflare's Bot Management solution was implemented for an online property portal. The solution successfully addressed the customer's criteria: maintaining user experience, stopping more bad traffic, and significantly reducing false positives compared to a previous vendor. The post highlights the challenges of differentiating good and bad scraper bots and the importance of a low false positive rate for customer satisfaction.
  500. One more (Zero Trust) thing: Cloudflare Intrusion Detection SystemIntroduces Cloudflare Intrusion Detection System (IDS) as a new product integrated with Cloudflare One. IDS analyzes entire network traffic (internal and external) for suspicious behavior beyond static firewall rules, leveraging traffic shape and traffic inspection. It learns from global attack patterns and external threat feeds, offering offload of CPU-intensive IDS tasks to Cloudflare's network. Remediation is simplified via one-click blocking of detected intrusion attempts.
  501. Introducing Magic FirewallIntroduced Magic Firewall, a network-level firewall delivered through Cloudflare's global network to secure enterprise environments including remote users, branch offices, data centers, and cloud infrastructure. Magic Firewall integrates with Cloudflare One and Magic Transit, enabling self-service configuration of static Layer 3 & 4 mitigations using Wireshark syntax. It aims to replace on-premises firewall appliances by pushing filtering capabilities to Cloudflare's edge data centers, reducing latency and providing a unified view of network traffic.
  502. Introducing Cloudflare Browser Isolation betaIntroduced Cloudflare Browser Isolation, a new capability that runs browser sessions in sandboxed environments within Cloudflare data centers. This approach sends only draw commands to the user's device, enhancing security by preventing threats from reaching the endpoint. The service is designed to be low-latency and compatible with any HTML5 compliant browser.
  503. Introducing Cloudflare One IntelIntroduced Cloudflare One Intel, a platform that converts network data into actionable insights for network and security operations. This includes two new features within Cloudflare Gateway: DNS tunneling detection and domain insights. DNS tunneling detection uses machine learning to identify anomalous DNS request patterns and blocks associated hostnames. Domain insights provide administrators with a comprehensive breakdown of site information by linking to Cloudflare Radar Domain Insights.
  504. Cloudflare Gateway now protects teams, wherever they areIntroduced L7 HTTP traffic filtering capabilities to Cloudflare Gateway, allowing for granular policy enforcement based on URL, path, query string, HTTP method, response code, file type, MIME type, and security/content categories. Integrated Cloudflare Gateway with the Cloudflare WARP desktop client to provide secure, performant connections for distributed workforces, eliminating the need for backhauling traffic to a centralized security boundary. This enables enterprise-level security directly from the Cloudflare edge.
  505. Spike in Amazon phishing for Prime Day: a new day of deals means new phishing campaignsThis post details advanced phishing tactics targeting Amazon Prime Day shoppers, including sophisticated email spoofing, the abuse of legitimate services like Sniply for hosting malicious content, and the generation of dynamic URLs to evade detection. It highlights the use of Newly Registered Domains (NRDs) and advanced HTML/CSS coding to create convincing lures that traditional defenses often miss.
  506. PAC spoof drops Emotet: phishing campaign leverages stolen PAC content to drop EmotetThis post details a specific Emotet phishing campaign that leverages stolen Political Action Committee (PAC) content and compromised legitimate email accounts to bypass email authentication protocols (DMARC, DKIM, SPF). It analyzes the use of obfuscated VBA macros and PowerShell commands to download the Emotet malware from compromised WordPress sites. The post also highlights the challenges in detecting Emotet due to its polymorphic nature, anti-debugging capabilities, and evolving delivery tactics, emphasizing the need for advanced detection methods beyond signature-based approaches.
  507. Know When You’ve Been DDoS’dIntroduced real-time DDoS attack alerts for all Cloudflare customers on paid plans. Alerts are delivered via email (Pro, Business, Enterprise) and PagerDuty (Business, Enterprise). Two types of alerts are available: HTTP DDoS alerts (for WAF/CDN) and L3/4 DDoS alerts (for Spectrum, Spectrum BYOIP, Magic Transit, coming soon). Alert policies can be created in the Cloudflare dashboard, providing details on attack detection, mitigation time, type, max rate, and target, along with links to view the attack and provide feedback.
  508. Introducing API ShieldThis post introduces Cloudflare API Shield, a new offering that combines client certificate-based identity and schema-based validation for API security. It details the implementation of a positive security model, the process of issuing client certificates using CFSSL, and demonstrates a practical application using Cloudflare Workers and Workers KV for an IoT temperature sensor and an iOS mobile application. The post also announces the upcoming support for gRPC-based APIs.
  509. Announcing support for gRPCThis post introduces beta support for proxying gRPC traffic through Cloudflare. This involved changes to the request processing pipeline to identify gRPC traffic, adding functionality to the WAF to understand gRPC, and enabling HTTP/2 connections to customer origins for gRPC traffic. This allows Cloudflare's security, reliability, and performance features to be applied to gRPC APIs.
  510. Building even faster interpreters in RustThis post details performance optimizations made to the Wirefilter engine, which powers Cloudflare's Firewall Rules and other security products. Key contributions include: development of a performance measurement framework using hardware counters and the perf_event_open API; techniques to speed up benchmarking by deduplication, sampling, and partitioning of filters; and optimization of the `contains` operator by leveraging specialized string searching algorithms and exploring the use of Rust's regex library for fixed-string patterns. The post also discusses the trade-offs involved in these optimizations and the importance of measuring performance in a distributed environment.
  511. Are you GDPR-compliant? New phishing message harvests credentials with GDPR lureThis post details a new phishing campaign that uses GDPR compliance as a lure to harvest credentials. It analyzes the attacker's techniques, including spoofing sender addresses and using compromised websites for credential harvesting. It also provides recommendations for companies to protect themselves and highlights Area 1 Security's detection capabilities.
  512. Raking the floods: my intern project using eBPFIntroduced an open-source Go library, 'rakelimit', for UDP service flood mitigation. The framework utilizes eBPF socket filters to analyze traffic patterns, employing hierarchical heavy hitters and CountMin sketches to identify and rate-limit attack traffic based on source/destination addresses and ports. It addresses challenges of spoofed IPs and IPv6 scalability by using probabilistic algorithms and a two-dimensional hierarchical structure for addresses and ports. The implementation uses fixed-point arithmetic to overcome BPF's lack of floating-point support.
  513. Cloudflare’s Always Online and the Internet Archive Team Up to Fight Origin ErrorsThis post introduces a significant enhancement to website resilience by detailing the partnership between Cloudflare's Always Online service and the Internet Archive. It explains how Always Online, originally developed to combat frequent downtime for early customers, now leverages the Wayback Machine to serve archived content when an origin server is unreachable. This partnership not only improves the user experience during outages but also contributes to the Internet Archive's mission of preserving web content and expands the archive's reach.
  514. Moobot vs. Gatebot: Cloudflare Automatically Blocks Botnet DDoS Attack Topping At 654 GbpsThis post details the automatic detection and mitigation of a 654 Gbps UDP-based DDoS attack generated by the Moobot botnet, targeting a Magic Transit customer. It highlights the effectiveness of Cloudflare's Gatebot and dosd systems in mitigating volumetric attacks without human intervention, leveraging the global network capacity of over 42 Tbps and Anycast routing. The post also describes Moobot's self-propagation and synchronized attack capabilities, and the data collection methods used by Cloudflare's DDoS protection systems.
  515. Latest SBA phishing attempt: stealthy social engineering phish using newly registered domains attempts to gain bank detailsThis post details a specific phishing campaign impersonating the SBA, highlighting the use of newly registered domains (NRDs) and spoofed sender addresses as evasion techniques. It explains how attackers leverage these tactics to bypass traditional email security gateways and trick recipients into divulging sensitive financial information. The post also outlines Area 1 Security's advanced detection methods, including analysis of NRDs, domain obfuscation, look-alike domains, and lexical analysis of message content, to identify and thwart such sophisticated threats.
  516. “Face mask manufacturer” supplies Agent Tesla Malware: campaign employs Covid-19 lures and sophisticated evasion techniquesThis post details a sophisticated phishing campaign that leverages COVID-19 lures and the Agent Tesla malware. It describes the campaign's tactics, techniques, and procedures (TTPs), including spoofing legitimate businesses, rotating IP addresses, modifying malware hashes, and exploiting flaws in email authentication protocols (DMARC, SPF, DKIM). The post analyzes the malware's delivery mechanism via compressed executables disguised as PDFs, its information-stealing capabilities via SMTP exfiltration, and its anti-debugging and obfuscation techniques. It highlights the limitations of legacy security defenses and emphasizes the need for user awareness and advanced threat detection.
  517. Election Cybersecurity: Protecting the 2020 U.S. Elections.This post details the increasing threat landscape against election-related websites and political campaigns, highlighting the effectiveness of Cloudflare's Web Application Firewall (WAF) and rate limiting in mitigating DDoS attacks and SQL injection attempts. It emphasizes the importance of these protections for ensuring the reliability and security of online election infrastructure.
  518. Network-layer DDoS attack trends for Q2 2020This post details the significant increase and acceleration of network-layer (L3/4) DDoS attacks observed in Q2 2020, doubling from the previous quarter. It highlights the emergence of some of the largest attacks ever recorded on Cloudflare's network, increased attack vector diversity, and greater geographical distribution. The post also analyzes attack characteristics such as size (both bit and packet rates), duration, and common attack vectors like SYN floods, while emphasizing Cloudflare's automated mitigation capabilities through Gatebot and dosd.
  519. Introducing Cloudflare Network InterconnectThis post introduces Cloudflare Network Interconnect (CNI), a new capability that allows direct, private interconnection between customer on-premise networks and Cloudflare's global network. CNI enhances existing security and performance features by providing dedicated on-ramps to Cloudflare's network, bypassing the public internet. This improves performance for CDN and Workers, and significantly enhances security for Magic Transit and Cloudflare Access by reducing threat exposure and increasing reliability through private connectivity.
  520. Introducing IP ListsIntroduced IP Lists as a new data structure for managing IP addresses, ASNs, and countries at the Cloudflare edge. IP Lists allow for arbitrary prefix lengths, are stored at the account level for cross-zone use, and support bulk uploading via CSV or API. They integrate with the Firewall Rules engine, enabling more flexible and complex network-level security policies compared to legacy IP Access and Zone Lockdown rules. Planned enhancements include increased quotas, additional list types, expiring entries, and managed lists.
  521. Don’t trust that tweet…or that email from "Bill Gates"This post details the detection of a sophisticated phishing campaign that leveraged typosquatting to create a domain strikingly similar to the legitimate 'gatesfoundation.org' domain. It highlights the use of a newly registered malicious domain ('gatesfoundatlon[.]com') for a Bitcoin donation scam, shortly after a similar incident on Twitter. The post includes the malicious domain's WHOIS record, SPF record, and Bitcoin address, demonstrating the technical details of the attack infrastructure.
  522. flowtrackd: DDoS Protection with Unidirectional TCP Flow TrackingIntroduced flowtrackd, a new software-defined DDoS protection system for Magic Transit that implements unidirectional TCP flow tracking. This system uses a state machine to analyze ingress traffic and determine whether to forward or drop TCP packets based on connection state, enabling mitigation of complex TCP-based DDoS attacks that were previously challenging due to the lack of bidirectional visibility. This complements existing stateless and bidirectional stateful mitigation methods.
  523. Mitigating a 754 Million PPS DDoS Attack AutomaticallyThis post details the automatic mitigation of a 754 million PPS DDoS attack using Cloudflare's Gatebot and dosd systems. It explains the attack vectors (SYN floods, ACK floods, SYN-ACK floods) and the distinction between bit-intensive, packet-intensive, and request-intensive DDoS attacks. It highlights the use of BGP Anycast for global traffic distribution, kernel-level packet dropping for efficiency, and L4 load balancing with Unimog to handle massive packet rates without manual intervention.
  524. Sandboxing in Linux with zero lines of codeThis post introduces Linux seccomp as a powerful tool for sandboxing applications without writing code. It explains system calls and how seccomp allows applications to declare their intended system call usage to the kernel, with the kernel terminating or signaling violations. The post demonstrates this with a C code example, showing how to prohibit the 'uname' system call and return a custom error code, effectively preventing arbitrary code execution and enhancing security.
  525. CVE-2020-5902: Helping to protect against the F5 TMUI RCE vulnerabilityThis post details the deployment of a new managed WAF rule (100315) to protect Cloudflare customers against the CVE-2020-5902 RCE vulnerability in F5 BIG-IP's TMUI. It explains the vulnerability, provides mitigation details including a regex pattern, and outlines how to manage the rule within the Cloudflare WAF. It also highlights initial observed attack patterns and traffic volume.
  526. Making the WAF 40% fasterThis post details performance improvements to the Cloudflare WAF, primarily focusing on the transition from PCRE to RE2 for regular expression matching, which guarantees linear execution time and improves reliability. It also describes the implementation of memoization for expensive function calls within WAF rules, leading to significant execution time reductions (up to 95% for some rules). Rule rewriting and the addition of pre-filter checks further optimized performance. These changes resulted in a 40% decrease in average WAF request processing time at the edge, a 4.3% drop in CPU consumption, and an increase in cache hit percentage from 56% to 74%. The post also mentions the ongoing porting of the WAF to the wirefilter execution engine.
  527. Export logs from Cloudflare Gateway with LogpushIntroduces the ability to configure automatic export of logs from Cloudflare Gateway to third-party storage destinations (AWS S3, Google Cloud Storage, Sumo Logic, Microsoft Azure) or SIEM tools using the Cloudflare Logpush Service. This feature allows for detailed analysis and auditing of DNS queries and Gateway's allow/block decisions, addressing the limitations of the Cloudflare for Teams UI for large-scale deployments. The export occurs every five minutes and supports configurable fields and folder structures.
  528. Resolve internal hostnames with Cloudflare for TeamsIntroduced domain override functionality to Cloudflare Gateway, allowing administrators to configure specific hostnames to resolve to alternative IP addresses. This feature is enforced before allowed or blocked rules and is pushed to the network edge. It supports IPv4, IPv6, and DNS over HTTPS deployments, with a limit of 1,000 custom rules per organization. This feature aims to ease the transition to zero-trust models and split-horizon DNS setups.
  529. Network-Layer DDoS Attack Trends for Q1 2020This post analyzes network-layer DDoS attack trends for Q1 2020, noting a rise in smaller, shorter attacks (under 10 Gbps, under 1 million pps, 30-60 minutes duration) attributed to DDoS-as-a-service and the ROI for attackers. It also highlights the persistence of larger attacks (up to 550 Gbps) and a decrease in attacker persistence compared to Q4 2019. The analysis details top attack vectors (SYN, ACK, CLDAP) and observes an increase in attacks during the COVID-19 crisis, with a surge in large-sized attacks in late March. Cloudflare's mitigation strategies are discussed in relation to these trends, emphasizing rapid Time To Mitigate SLAs, distributed architecture, and massive network capacity.
  530. Cloudflare Bot Management: machine learning and moreThis post introduces the Cloudflare Bot Management platform, detailing its product and technical requirements. It defines key terms like 'Bot', 'Good bots', 'Bad bots', 'Bot Management', and 'WAF'. The core innovation presented is the 'Score', a unified metric (0-100) indicating the likelihood of a request being human-generated. This score is integrated into Firewall Rules via the `cf.bot_management.score` field, enabling flexible and real-time bot mitigation. The post also outlines the platform's architecture, highlighting its microservices, data stores (Kafka, ClickHouse, Postgres, Redis, Ceph), programming languages (Go, Rust, Python, Java, Bash), and containerization technologies (Docker, Kubernetes). It details the output of the edge Bot Management module, including firewall fields, cookies (cf_bm), and JS challenges.
  531. DDoS attacks have evolved, and so should your DDoS protectionThis post details the evolution of DDoS attacks, noting the rise of frequent, smaller network-level attacks (under 10 Gbps) and the continued prevalence of large volumetric attacks (over 500 Gbps). It highlights Cloudflare's massive network capacity (35 Tbps), globally distributed architecture with full DDoS mitigation in 200 cities, fast time to mitigation (under 10s), seamless integration with other security products, and unmetered/unlimited mitigation. It also references Gartner's report on DDoS Cloud Scrubbing Centers, where Cloudflare received the most 'High' ratings.
  532. Stream Firewall Events directly to your SIEMThis post introduces the ability to stream only Firewall Events directly to SIEMs via Logpush jobs, reducing the volume of data processed client-side and improving efficiency for security teams. It details the setup process using Terraform and Sumo Logic, including prerequisites, environment variable configuration, and the creation of Sumo Logic collectors and HTTP sources, as well as Cloudflare scoped API tokens.
  533. Deploying Gateway using a Raspberry Pi, DNS over HTTPS and Pi-holeThis post details the practical steps for deploying Cloudflare Gateway using DNS over HTTPS (DoH) on both individual browsers (Firefox with custom server support) and entire networks via a Raspberry Pi running Pi-hole and dnscrypt-proxy. It explains how to configure Gateway locations, generate DoH stamps, and set up static configurations in dnscrypt-proxy.toml to route traffic through Cloudflare Gateway. It also provides guidance on assigning static IP addresses to the Raspberry Pi and configuring browser settings.
  534. Cloudflare for SSH, RDP and MinecraftThis post introduces Cloudflare Spectrum as a way to extend DDoS protection and traffic acceleration to non-HTTP protocols like SSH, RDP, and Minecraft for Pro and Business plan customers. This marks an expansion of Cloudflare's security and performance offerings beyond traditional web traffic to include critical server management and gaming applications, addressing the need for reliable and performant access to these services, especially during periods of increased remote work and online gaming.
  535. Rolling With The Punches: Shifting Attack Tactics & Dropping Packets Faster & Cheaper At The EdgeThis post details the evolution of Cloudflare's DDoS mitigation strategies in response to shifting attack trends. It introduces 'dosd', a decentralized, edge-analyzed, edge-enforced DDoS mitigation system designed to detect and mitigate smaller, localized attacks rapidly (0-3 seconds). It also introduces 'IP Jails', a Gatebot capability that efficiently mitigates rate-intensive HTTP DDoS attacks by dropping connections at Layer 4 instead of Layer 7, significantly reducing CPU, memory, and bandwidth consumption. The post provides examples and metrics demonstrating the effectiveness of these systems in handling both L3/L4 and L7 DDoS attacks.
  536. Moving from reCAPTCHA to hCaptchaThis post details the migration from Google's reCAPTCHA to hCaptcha for Cloudflare's CAPTCHA challenges. The rationale for the migration includes privacy concerns related to Google's data collection practices, blocking issues in certain regions (like China), and the introduction of charges for reCAPTCHA by Google. The post highlights the benefits of hCaptcha, including its privacy-focused data handling, comparable or better performance, accessibility features, support for Privacy Pass, and responsiveness. Cloudflare is leveraging its Workers platform to reduce hCaptcha's operational costs and has entered into a paid agreement with hCaptcha. The post also breaks down the usage of CAPTCHAs across different Cloudflare features, with Firewall and Bot Rules being the largest consumer, followed by IP Firewall and Security Level. It also mentions the use of CAPTCHAs by automated systems like Gatebot for DDoS mitigation.
  537. Conntrack tales - one thousand and one flowsThis post delves into the intricacies of Linux's 'conntrack' subsystem, a critical component for stateful firewalling and network security. It explains how 'conntrack' tracks network connections and highlights the potential for performance degradation and packet loss when the 'conntrack' table becomes full. The post details experimental methods for testing 'conntrack' behavior, demonstrating that exceeding its capacity can lead to silent packet drops and even application errors like EPERM, without explicit firewall rules. This deep dive into low-level network behavior is crucial for understanding and optimizing the performance and reliability of Cloudflare's security infrastructure.
  538. Cloudflare now supports security keys with Web Authentication (WebAuthn)!This post introduces support for security keys as a two-factor authentication (2FA) method for Cloudflare user accounts, leveraging the Web Authentication (WebAuthn) protocol. It explains the WebAuthn protocol, its advantages over other 2FA methods (resistance to SIM swapping, phishing, and ease of use), and its privacy guarantees. The implementation allows users to register hardware security keys or use built-in biometrics for authentication.
  539. Using Cloudflare to secure your cardholder data environmentThis post announces that Cloudflare's Content Delivery Network, Cloudflare Access, and Time Service have been certified under PCI DSS. It details how these services help customers meet specific PCI DSS requirements: WAF for requirement 6.6, Access for requirement 8.1.8 (session timeouts), and Time Service for requirement 10.4.3 (accurate audit logging). It also highlights the support for TLS 1.3, exceeding requirement 4.1.
  540. Using Cloudflare Gateway to Stay Productive (and turn off distractions) While Working RemotelyThis post details the setup and usage of Cloudflare Gateway for blocking distracting websites. It covers configuring Gateway via the Cloudflare for Teams dashboard, setting up locations based on IP addresses, changing router DNS settings to Cloudflare's resolvers (172.64.36.1, 172.64.36.2), and creating 'Deep work' policies to block specific domains or content categories. It also demonstrates how to verify blocking through browser redirects and DNS REFUSED responses.
  541. Protect your team with Cloudflare GatewayThis post announces the general availability of secure DNS filtering capabilities in Cloudflare Gateway. It details the architectural challenges of legacy network security models, the benefits of Cloudflare's edge network for security and performance, and explains how secure DNS filtering works by checking queries against threat intelligence. It also highlights the support for DNS over HTTPS and future support for DNS over TLS.
  542. Pwned Passwords Padding (ft. Lava Lamps and Workers)Introduced padded responses to the Pwned Passwords API to prevent passive analysis of API response sizes. Padding is dynamically generated using Cloudflare Workers, leveraging the Web Crypto API for cryptographically sound random number generation and Math.random() for content generation. Entropy for CSPRNGs is sourced from lava lamps and other server-based sources. Responses are padded to a minimum of 800 hash suffixes with an additional 0-200 random entries.
  543. Addressing the Web’s Client-Side Security ChallengeThis post details how Cloudflare Workers can be used to deploy client-side website security solutions, specifically highlighting the integration with Tala. It explains that Tala's web module capabilities are integrated into Cloudflare Workers for serverless deployment. The post outlines the steps involved: Tala Service Worker parses HTML content, inserts security controls (CSP, SRI, etc.), and periodically checks for policy updates. It also mentions the use of Cloudflare's KV store for custom Tala security policies. The core technical contribution is the demonstration of using Workers to dynamically inject client-side security headers and page modifications based on content analysis.
  544. Helping mitigate the Citrix NetScaler CVE with Cloudflare AccessThis post details how Cloudflare Access can be used as an identity proxy to protect administrator portals of third-party devices like Citrix NetScaler, mitigating a specific CVE by preventing unauthenticated access to login pages and administrative interfaces. It highlights the use of Argo Tunnel for secure outbound connections and the integration with the Cloudflare WAF for layered security.
  545. Cloudflare + Remote Browser IsolationThis post announces Cloudflare's acquisition of S2 Systems Corporation and introduces their remote browser isolation (RBI) technology. It explains the inherent security risks of traditional web browsing and enterprise challenges with browser control and compliance. The post details how cloud-based RBI works by executing browsers remotely and streaming content to the endpoint, contrasting it with local isolation and pixel-pushing remoting technologies. It highlights S2 Systems' DOM reconstruction approach as a more scalable and cost-effective alternative to pixel pushing, while acknowledging its own security considerations.
  546. Announcing the CSAM Scanning Tool, Free for All Cloudflare CustomersIntroduced the CSAM Scanning Tool, a new feature available to all Cloudflare customers. This tool leverages fuzzy hashing (PhotoDNA) to automatically detect and block child sexual abuse material (CSAM) on customer websites. It provides automated notifications, blocks access with a 451 status code, and supports legal reporting obligations. The tool runs on Cloudflare's infrastructure, not distributed to users, and aims to balance detection accuracy with resource limitations by offering configurable thresholds for fuzzy hash comparison.
  547. New tools to monitor your server and avoid downtimeThis post introduces three new tools to enhance origin server reliability and avoid downtime: Standalone Health Checks for proactive monitoring of origin server health, Passive Origin Monitoring for automatic email notifications when origin downtime is detected, and Zero-Downtime Failover which automatically retries requests to an alternate origin server if the primary fails, improving availability without user intervention. These features complement existing security and traffic management capabilities by focusing on the availability and resilience of the origin infrastructure.
  548. Firewall Analytics: Now available to all paid plansThis post announces the general availability of Firewall Analytics to all paid plans, significantly increasing its accessibility. Key technical contributions include the implementation of adaptive sampling for improved query performance under load, a change in event logging to show all Firewall Events per rule (streamlining debugging and rule validation), and the introduction of the Challenge Solve Rate (CSR) metric to help tune challenge-based security rules. Exporting events and column customization are also new features for Business/Enterprise tiers.
  549. Introducing Flan Scan: Cloudflare’s Lightweight Network Vulnerability ScannerIntroduced Flan Scan, an open-source network vulnerability scanner built as a wrapper around Nmap. Key features include easy deployment via Docker, runtime configuration, pushing scan results to cloud storage (GCS/S3), and generating actionable reports structured around vulnerable services rather than individual IP addresses. The default scan includes ICMP ping, SYN scan, and service detection with banner grabbing, augmented by the 'vulners' NSE script for CVE mapping. Reports are generated in LaTeX for PDF conversion. Flan Scan was used to identify outdated Apache versions on FreeIPA nodes and a leftover vulnerable PostgreSQL instance, driving prioritized updates and contributing to a larger vulnerability management program.
  550. Even faster connection establishment with QUIC 0-RTT resumptionThis post introduces the concept of 0-RTT connection resumption for TLS 1.3 and QUIC, highlighting its potential for faster connection establishment by allowing application data to be sent before the handshake is complete. It details the associated risks, particularly replay attacks on non-idempotent requests, and explains Cloudflare's mitigation strategies, including rejecting certain request types and using the 'Early-Data: 1' header to signal origins. The post also announces the availability of a toggle on the Cloudflare dashboard to enable this feature.
  551. Log every request to corporate apps, no code changes requiredThis post introduces per-request logging for Cloudflare Access, allowing administrators to capture detailed audit logs of every request made to resources protected by Access. This enhances security by enabling session reconstruction in case of compromised accounts or devices, and provides standardized logs for SIEM integration. The feature leverages the Logpush platform to export these logs, including user identity via JWTs appended as request headers.
  552. Going Keyless EverywhereThis post details a multi-year project to enhance Cloudflare's resilience against memory disclosure vulnerabilities like Heartbleed and Cloudbleed. It explains the concept of process isolation and how these vulnerabilities exploit it. The core contribution is the 'Keyless Everywhere' initiative, which moves private keys out of internet-facing processes by using separate key servers (leveraging Keyless SSL and Geo Key Manager). This significantly reduces the risk of private key exposure, even if other memory disclosure bugs are found in web server applications. The post also touches on the technical implementation details, including the use of gokeyless-internal, lazy loading, and the tableflip package for graceful upgrades, and how this was applied to TLS 1.3 and Spectrum.
  553. Delegated Credentials for TLSIntroduced support for Delegated Credentials for TLS, a new cryptographic protocol developed with industry partners. This feature allows for short-lived authorization keys to be pushed to edge servers, enabling faster and more reliable TLS termination compared to pull-based systems like Keyless SSL. This reduces latency and improves availability by eliminating the need for remote key operations during every TLS handshake. The implementation also opens avenues for experimenting with new authentication algorithms and post-quantum cryptography.
  554. Cloudflare response to CPDoS exploitsThis post details Cloudflare's response to newly disclosed Cache Poisoning Denial of Service (CPDoS) vulnerabilities. It explains the three specific attacks (HTTP Header Method Override, Oversized HTTP Headers, and HTTP Meta Characters) and outlines Cloudflare's existing mitigations, which largely prevent customer impact. It also provides specific recommendations for customers running unpatched Microsoft IIS with request filtering enabled or those using Cloudflare Workers for forced caching of 400 responses. The post reinforces Cloudflare's commitment to maintaining caching integrity and proactively defending against emerging cache attack techniques.
  555. Dogfooding Magic Transit by DDoSing our Austin officeThis post details the dogfooding of Cloudflare's Magic Transit service by intentionally DDoS'ing the company's Austin office. It highlights how Magic Transit, by announcing IP prefixes via BGP and routing traffic to Cloudflare's global network edge, provides always-on DDoS mitigation and network acceleration for entire network infrastructures. The post demonstrates the effectiveness of the system's multi-layered protection, including XDP, eBPF, iptables, and dynamic rule generation by Gatebot and the newly deployed DoSD, in detecting and mitigating attacks in near real-time with minimal service degradation.
  556. Terraforming Cloudflare: in quest of the optimal setupThis post introduces the adoption of infrastructure-as-code (IaC) practices using Terraform and Terragrunt to manage Cloudflare configurations. It details the journey of implementing a modular and declarative approach for managing various Cloudflare resources like access rules, zone settings, account members, and rate limits across multiple domains and environments. The post highlights different strategies for resource implementation (static, parameterized, dynamic) and the benefits of using modules for code reusability and maintainability, thereby enhancing the overall management and consistency of Cloudflare's security setup.
  557. Talk Transcript: How Cloudflare Thinks About SecurityThis post details Cloudflare's internal security culture, emphasizing a blame-free approach to encourage reporting of security incidents, including lost devices and phishing attempts. It also describes the use of HackerOne and a private bug bounty program for external vulnerability discovery. The post highlights the critical importance of identity and authentication, detailing Cloudflare's migration to a unified system using Cloudflare Access, strong password policies, and mandatory two-factor authentication with YubiKeys and TOTP. It discusses the company's commitment to openness and transparency, exemplified by detailed public disclosures of incidents like Cloudbleed and a recent outage. Finally, it outlines the shift towards memory-safe languages like Go and Rust for new product development and the increased focus on monitoring system crashes, with the CSO reporting directly to the CEO to underscore security's top-down importance.
  558. Cloudflare’s protection against a new Remote Code Execution vulnerability (CVE-2019-16759) in vBulletinThis post details the deployment of a new rule (ruleId: 100166) within Cloudflare's Specials Rulesets to protect against CVE-2019-16759, a zero-day Remote Code Execution vulnerability in vBulletin. It explains the implications of RCE vulnerabilities, the CVSS score (9.8/10), and its relevance to OWASP Top 10 risk areas. The post also guides users on enabling Managed Rulesets and Cloudflare Specials in their firewall settings and provides information on applying the vBulletin patch directly for those not using managed rulesets.
  559. WARP is here (sorry it took so long)This post announces the public release of WARP, a mobile application designed to secure all of a phone's internet traffic using Cloudflare's global network and the WireGuard protocol. It details the technical challenges encountered during development, the rationale behind choosing WireGuard, and the privacy principles guiding the service. The post also introduces WARP+ as a premium offering that leverages Cloudflare's Argo network for enhanced speed and explains the referral program for earning WARP+ data.
  560. Cleaning up bad bots (and the climate)Introduced 'Bot Fight Mode' to the Firewall settings, which when enabled, applies three actions to detected bad bots: 1) Tarpitting with computationally intensive challenges to increase bot maker CPU costs, 2) Sharing bot IPs with Bandwidth Alliance partners for takedowns, and 3) Offsetting carbon emissions from bot activity by planting trees. Detailed the four components of Cloudflare's bot detection: identification of legitimate bots, handwritten rules, the Bot Activity Detector model, and the Trusted Client model. Also mentioned Gatebot for DDoS bot fingerprinting and Firewall Rules for granular blocking. Explained the carbon offsetting calculation based on server CO2 emissions and tree sequestration capacity.
  561. How Castle is Building Codeless Customer Account ProtectionThis post details Castle's integration with Cloudflare Workers, Apps for Workers, and Workers KV to provide a codeless, edge-based customer account protection solution. It highlights how Workers are used to access request/response interactions at the edge without introducing latency, how Apps for Workers distribute the security logic, and how Workers KV stores configurations and user sessions. The post also explains the data flow, including script injection (Castle.js), collection of contextual information (IP, headers), and an advanced routing engine for recognizing security events.
  562. Supercharging Firewall Events for Self-ServeThis post introduces a completely overhauled Firewall Event log for Free, Pro, and Business customers. Key improvements include a more user-friendly interface without modals, expanded details per event with 'Additional matches' for complex rule triggers, powerful freeform search capabilities across any field within an event, and the ability to scope searches to specific date and time windows. This significantly enhances self-serve capabilities for understanding and diagnosing firewall events.
  563. On the recent HTTP/2 DoS attacksThis post details Cloudflare's immediate protection of its customers against a set of newly disclosed HTTP/2 Denial of Service (DoS) vulnerabilities. It highlights Cloudflare's proactive security posture, rapid patching of its NGINX implementation, and the successful mitigation of these specific threats before they could impact customers. The post also serves as a notification to customers hosting services outside of Cloudflare to apply necessary security updates.
  564. Magic Transit: Network functions at Cloudflare scaleThis post introduces Magic Transit, a new capability that extends Cloudflare's network functions to operate at the IP layer for any IP traffic. It leverages Cloudflare's existing global network, anycast, and homogeneous server architecture to provide customers with DoS mitigation, firewalling, and routing at the edge. The implementation details highlight the use of network namespaces for isolation and control, and GRE tunneling over anycast for delivering traffic to customer networks, effectively making Cloudflare's edge their own network edge.
  565. Introducing Certificate Transparency MonitoringThis post introduces Certificate Transparency Monitoring, a new feature that leverages public Certificate Transparency logs to proactively alert customers about newly issued certificates for their domains. This adds a crucial layer of security by enabling early detection of potentially malicious or unauthorized certificate issuances, complementing existing WAF and threat management capabilities.
  566. Details of the Cloudflare outage on July 2, 2019This post details a significant outage caused by a poorly written regular expression in a WAF Managed Rule that led to CPU exhaustion across the global network. It describes the sequence of events, the impact on customers, and the internal response. Key takeaways include the identification of the root cause (excessive regex backtracking), the challenges faced in responding due to internal system dependencies (Access service, Jira, build system), and the eventual resolution by disabling the WAF globally and then re-enabling it after a fix was verified. The post also contrasts the deployment process for WAF rules with the more phased approach used for general software releases and discusses the need for improved internal access and bypass mechanisms.
  567. Cloudflare outage caused by bad software deploy (updated)This post details a global outage caused by a misconfigured WAF Managed Rule during a routine deployment. The rule contained a regular expression that caused CPU utilization to spike to 100% across the network, resulting in 502 errors for customers. The incident highlighted insufficient testing processes for WAF rules, leading to a global deployment in simulated mode that failed to catch the issue. The fix involved a 'global termination' of the ruleset, followed by rollback, testing, and re-enabling of the WAF Managed Rulesets. Changes to testing and deployment processes are being implemented to prevent future incidents.
  568. Securing Certificate Issuance using Multipath Domain Control ValidationThis post introduces a new tool for Certificate Authorities (CAs) to enhance the security of Domain Control Validation (DCV) for certificate issuance. It details two primary BGP hijacking attack vectors (Sub-Prefix Attack and Equally-Specific-Prefix Attack) that can be used to obtain fraudulent certificates. It also discusses DNS spoofing as another method to compromise DCV. The proposed solution involves multipath domain control validation, ensuring that DCV requests are validated through multiple, independent network paths to mitigate the risks posed by network-level adversaries.
  569. A free Argo Tunnel for your next projectThis post introduces a free tier for Argo Tunnel, a service that allows users to expose servers to the internet without opening ports by creating outbound tunnels to the Cloudflare network. This significantly simplifies server security and connectivity, especially for development and testing, by reducing the need for manual DNS, network, and firewall configuration. It makes a previously paid service accessible to anyone, enhancing the overall security posture by ensuring traffic is proxied through Cloudflare's network and its security features.
  570. Protecting Project Galileo websites from HTTP attacksThis post details the security events observed on Project Galileo websites between April 23, 2019, and May 23, 2019, showcasing the effectiveness of Cloudflare's security features. It quantifies the number of requests blocked by the WAF (over 4.5 million, matching over 130 rules), highlights the daily occurrence of malicious traffic on most sites, and illustrates the impact of WAF rules with heat maps. It also describes DoS mitigation, including Layer 3/4 blocking and Layer 7 protection by Gatebot (blocking over 1.6 million requests). Specific examples of Firewall Rules, Access Rules, and Zone Lockdown are provided, demonstrating their application in blocking specific IPs, filtering POST requests for WordPress sites, challenging visitors by country, and restricting access to admin panels. Rate Limiting is shown protecting a donation page, and the Security Level feature's role in mitigating 25% of blocked requests is emphasized. The post concludes by reinforcing the comprehensive and automated nature of Cloudflare's security for Project Galileo customers.
  571. Stopping SharePoint’s CVE-2019-0604This post details Cloudflare's rapid response to CVE-2019-0604, a critical RCE vulnerability in Microsoft SharePoint. It describes the discovery of the vulnerability's unauthenticated exploit path, the analysis of early reconnaissance probes and exploit attempts, and the decision to deploy a WAF rule (100157) in default block mode on May 13th, before a stable patch was widely available or exploits were fully weaponized. The post also provides technical details on the vulnerability's root cause, including the `DecodeEntityInstanceId` function and the XML deserialization payload, and analyzes the traffic patterns observed after the rule deployment.
  572. Announcing AMP Real URLThis post announces the launch of AMP Real URL, a feature that leverages Web Packaging and cryptographic signing to ensure that AMP content served from caches displays the original website's URL. It details how Cloudflare digitally signs content provided to crawlers, allowing browsers to verify authenticity and display the correct URL. The post also highlights the benefits for publishers, including brand protection, simplified analytics, and increased screen space, and mentions the sunsetting of older AMP products like Ampersand and Firebolt to focus on this new capability.
  573. Introducing WARP: fixing mobile Internet performance and securityThis post introduces WARP, a new technology integrated into the 1.1.1.1 app, which significantly enhances mobile internet security and performance. WARP acts as a VPN for all mobile traffic, encrypting unencrypted connections to Cloudflare's edge, improving performance through a UDP-based protocol optimized for mobile, and increasing reliability by recovering faster from network loss. It also addresses battery drain concerns by using an efficient protocol and minimizing radio usage. The free version of WARP is offered to make these improvements accessible, with a premium WARP+ version for enhanced speed.
  574. BoringTun, a userspace WireGuard implementation in RustThis post introduces BoringTun, a userspace implementation of the WireGuard protocol written in Rust. It highlights the need for a fast, cross-platform, and secure VPN solution, explaining the choice of Rust over C/C++ and Go for its memory safety and performance. BoringTun aims to provide a robust alternative to existing WireGuard implementations and contribute to the broader adoption of secure VPN technologies.
  575. Spectrum for UDP: DDoS protection and firewalling for unreliable protocolsThis post introduces Spectrum for UDP, extending Cloudflare's DDoS protection and IP firewalling capabilities to UDP-based services. It highlights the challenges of securing UDP applications and introduces a custom 'Simple Proxy Protocol' to enable origins to retrieve client IP information, similar to the Proxy Protocol for TCP. This expands the scope of Spectrum beyond TCP to encompass a wider range of applications, including gaming and custom protocols.
  576. Preventing Request Loops Using CDN-LoopThis post introduces the CDN-Loop header, a new standardized mechanism developed in collaboration with other CDNs to prevent request loops. It details the limitations of previous solutions like the Via header (performance issues) and ad-hoc methods using CF-Connecting-IP and X-Forwarded-For (lack of standardization, friction for valid looping). The post explains the syntax and implementation of CDN-Loop at Cloudflare, highlighting its benefits for granular loop detection and prevention of DoS attacks.
  577. Monsters in the Middleboxes: Introducing Two New Tools for Detecting HTTPS InterceptionThis post introduces MITMEngine, an open-source Golang library for detecting HTTPS interception by analyzing TLS Client Hello messages and comparing them against known browser signatures. It also introduces MALCOLM, a dashboard that displays metrics about observed HTTPS interception on Cloudflare's network. The post details the mechanics of HTTPS interception, including TLS-terminating forward proxies, antivirus/corporate proxies, malware proxies, and reverse proxies, and explains the security implications of interception.
  578. Stopping Drupal’s SA-CORE-2019-003 VulnerabilityThis post details Cloudflare's rapid response to the Drupal SA-CORE-2019-003 vulnerability. Upon announcement, Cloudflare analyzed the patch, identified the deserialization exploit vector, and developed WAF rules (specifically D0020) to mitigate it. The post showcases the speed of this process, from vulnerability disclosure to rule deployment and attack blocking, highlighting the effectiveness of Cloudflare's WAF in protecting customers against zero-day exploits. It also provides examples of malicious payloads observed, including those leveraging the 'guzzle/rce1' gadget and attempts to download backdoors.
  579. Building fast interpreters in RustThis post details the design of the wirefilter Rust library for parsing and executing Wireshark-like filters. It explains the choice of manual parsing over parser generators due to syntax ambiguities requiring contextual parsing. The execution engine was optimized by replacing HashMap lookups for field access with fixed-size arrays indexed by an IndexMap, leading to a ~2x speedup.
  580. How we made Firewall RulesThis post details the technical evolution leading to the creation of Cloudflare's Firewall Rules. It describes the limitations of previous single-attribute firewall features (IP Access Rules, ASN matching, CIDR blocking, GeoIP matching, Page Rules) and the challenges of combining them. The post introduces a new, unified matching engine implemented in Rust, designed to handle complex expressions with multiple attributes. It highlights the inspiration drawn from Wireshark's display filter syntax for creating a human-readable and machine-parseable DSL for defining firewall rules. The post also details the internal data structures used to represent HTTP request properties for matching.
  581. New Firewall Tab and AnalyticsThis post introduces a significant UI and feature enhancement to Cloudflare's Firewall product. It details the reorganization of existing firewall features into new tabs (Events, Firewall Rules, Managed Rules, Tools, Settings, and an Overview tab with Firewall Analytics). The core technical contribution is the introduction of Firewall Analytics for Enterprise customers, which provides visualization and analysis of firewall events. The post outlines a workflow demonstrating how to use these analytics to identify the source of security events, such as a spike in 'Block' events triggered by an Access Rule's Country Block, and drill down to specific IP addresses and targeted paths. It also highlights the ability to filter events and use user-defined filters for detailed analysis.
  582. Out of the Clouds and into the weeds: Cloudflare’s approach to abuse in new productsThis post details Cloudflare's evolving approach to handling abuse reports and law enforcement requests for new products. It outlines a four-question framework for assessing the relationship between Cloudflare's services and potential content complaints, focusing on the interaction with content, desired actions and consequences, applicable laws, and scalability. It differentiates responses for proxy/CDN services versus services with definitive storage, emphasizing content-neutrality and precise tooling. For proxy/CDN, it details forwarding complaints to hosts and handling phishing at URL or domain levels. For storage services, it outlines review and potential takedown processes for valid legal requests, including copyright infringement under DMCA.
  583. Cloudflare Access now supports RDPThis post introduces the integration of Cloudflare Access with Remote Desktop Protocol (RDP). It details how Access leverages identity provider integration (Okta, Azure AD) to enforce strong password policies and centralized credential management for RDP connections. Additionally, it explains how Argo Tunnel is used to secure RDP ports by creating a secure tunnel from the remote desktop to the Cloudflare network, eliminating the need for direct RDP port exposure. The post provides instructions for configuring Argo Tunnel with `cloudflared` and for connecting to RDP sessions through Access.
  584. Stop the Bots: Practical Lessons in Machine LearningThis post introduces Cloudflare's practical application of Machine Learning (ML) to combat bot attacks, specifically credential stuffing. It outlines a three-stage framework (Business Intelligence, Standalone Machine Learning, Machine Learning Productization) for integrating ML into products. For Cloudflare, this translates to using vast network data to train ML models for bot detection, achieving high accuracy in identifying malicious traffic, and developing predictive models to proactively warn companies of potential attacks based on their risk profile.
  585. Give your automated services credentials with Access service tokensThis post introduces Access service tokens, a new feature for Cloudflare Access that allows automated services, scripts, and bots to authenticate to internal sites secured by Access. It details how these tokens work by providing a Client ID and Secret that are validated directly by Cloudflare, bypassing the need for an identity provider redirect. The post explains how to generate these tokens in the dashboard, update Access policies to grant them permissions, and provides a use case of a chatbot accessing product usage reports.
  586. Cloudflare Support for Azure CustomersThis post announces the availability of a Cloudflare Argo Tunnel application within the Azure Marketplace, simplifying the secure connection between Azure-hosted origins and the Cloudflare edge. It also provides guidance for securing Azure's serverless Static Web Hosting service with Cloudflare's SSL and DNS resolver (1.1.1.1).
  587. Tracing Soon-to-Expire Federal .gov Certificates with CT MonitorsThis post highlights a critical aspect of website security by detailing how Cloudflare leverages its Certificate Transparency (CT) monitor, Merkle Town, to identify and track soon-to-expire and expired TLS certificates on .gov websites. It emphasizes the importance of automated certificate renewal and the role of CT logs and monitors in ensuring the integrity and trustworthiness of secure connections, especially during unexpected events like government shutdowns. The post also details technical challenges and unexpected misconfigurations found during the analysis.
  588. Argo Tunnel + DC/OSThis post introduces the integration of Cloudflare Argo Tunnel with Mesosphere DC/OS. It highlights how Argo Tunnel provides a secure, private connection between services running on DC/OS and Cloudflare's network, enabling load balancing and access to these services without opening inbound ports. This enhances the security and manageability of multi-cloud deployments by leveraging Cloudflare's edge security features for services managed by DC/OS.
  589. Athenian Project Turns One: Are Election Websites Safer?The Athenian Project provided free Enterprise-level service to over 100 US state and local government election websites, protecting them from DDoS attacks, SQL injection, and other threats. The project observed significant traffic spikes on election day due to legitimate user engagement, demonstrating the value of Cloudflare's CDN in managing unpredictable traffic. The WAF successfully blocked various internet-wide attacks targeting known vulnerabilities. Future plans include encouraging SSL adoption and encryption.
  590. Firewall Rules - Priority and OrderingIntroduced the ability for customers to control the order of Firewall Rule execution, offering two methods: priority numbering (arbitrary integer between 1 and 2,147,483,647) and drag-and-drop ordering (with a 200-rule limit). This addresses the community feedback regarding rule action precedence when multiple rules match a request.
  591. Banking-Grade Credential Stuffing: The Futility of Partial Password ValidationThis post analyzes the security implications of partial password validation, demonstrating its ineffectiveness against credential stuffing attacks. It simulates password breaches using breached password databases and analyzes the number of repeated logins required to fully compromise a password. The post advocates for multi-factor authentication (MFA) as a superior security measure, discussing the pros and cons of various MFA methods like SMS OTPs, authenticator apps, and hardware tokens.
  592. OAuth Auth Server through WorkersThis post details the implementation of a custom OAuth 2.0 authentication server using Cloudflare Workers and Cloudflare Storage (KV). It outlines the steps involved in the OAuth 2.0 workflow, including user redirection, code generation, and token exchange. The implementation leverages JWT for session management and demonstrates how to handle client secrets and store codes and tokens in KV namespaces. The post also highlights the potential use of Cloudflare Access as an alternative for simpler authentication needs.
  593. L4Drop: XDP DDoS MitigationsIntroduced L4Drop, a new XDP-based DDoS mitigation tool that replaces the previous Floodgate kernel bypass system. L4Drop leverages eBPF to run packet filtering logic directly in the network card driver, enabling high-speed packet dropping and sampling without kernel bypass or busy polling. It includes a BPF to C compiler for easier integration of existing BPF filters and a mechanism to modify ELF files for dynamic rule enabling/disabling based on location.
  594. Announcing SSH Access through CloudflareIntroduced the capability to secure SSH connections behind Cloudflare Access by integrating with Argo Tunnel and `cloudflared`. This allows for replacing traditional VPNs with a more secure and convenient access method, leveraging existing identity providers for authentication.
  595. The rise of multivector DDoS attacksThis post details the evolution of DDoS attack vectors observed by Cloudflare, specifically focusing on Layer 3/4 attacks. It highlights a massive 942Gbps SYN flood attributed to Xor.DDoS malware, noting its distributed nature and partially spoofed sources. The post also observes a decline in SSDP and memcached amplification attacks, while noting an increase in 'multivector' attacks that combine multiple amplification techniques to achieve high volumes. The analysis provides insights into the changing landscape of DDoS threats and Cloudflare's ongoing efforts to mitigate them.
  596. Introducing Spectrum with Load BalancingThis post announces the full integration of Cloudflare Spectrum with Load Balancing. It introduces the ability to configure TCP health checks for non-HTTP applications, allowing for intelligent failover and traffic distribution based on connection status. It also details how existing load balancing features like origin weights and steering modes (failover, dynamic, geo) are now applicable to TCP traffic proxied by Spectrum, enabling customers to build scalable and reliable TCP applications.
  597. Cloudflare’s network boosts security and performance for IBM Cloud customersThis post announces the general availability of Cloudflare's integration with IBM Cloud Internet Services (CIS) Enterprise. It highlights how Cloudflare's network, including its DDoS mitigation and WAF capabilities, is now accessible directly within the IBM Cloud user interface for enterprise customers. The post emphasizes the combined strength of Cloudflare's global network capacity and IBM Cloud's data centers in protecting applications and improving performance, as well as the benefit of waiving data transfer fees through the Bandwidth Alliance.
  598. Encrypt that SNI: Firefox editionThis post details the integration of Encrypted Server Name Indication (ESNI) with Firefox Nightly, enabling encrypted SNI for Cloudflare websites. It provides instructions on how to enable ESNI in Firefox's `about:config` and configure DNS over HTTPS (DoH) for enhanced privacy. The post also explains how to verify ESNI support using the `encryptedsni.com` test page and the `/cdn-cgi/trace` endpoint. It further demonstrates how to inspect ESNI traffic on the wire using Wireshark and discusses fallback mechanisms for ESNI key management to maintain service availability.
  599. Introducing Single Sign-On for the Cloudflare DashboardIntroduced Single Sign-On (SSO) for the Cloudflare dashboard for enterprise customers. This allows companies to use their existing identity providers (e.g., G Suite via SAML) to authenticate users accessing the Cloudflare dashboard. A Cloudflare Worker was developed to bridge Cloudflare Access authentication tokens with Cloudflare's internal authentication system, enabling edge-based authentication for faster logins.
  600. Leave your VPN and cURL secure APIs with Cloudflare AccessIntroduced `cloudflared`, a beta command-line tool that enables authentication for API requests protected by Cloudflare Access. This allows users to securely access APIs from the command line using JWTs, similar to browser-based authentication, by launching a browser for identity provider login and then securely transferring the JWT to the client machine. The tool includes a `curl` wrapper to automatically inject the JWT into the `cf-access-token` header.
  601. Announcing Firewall RulesIntroduced Firewall Rules, a new feature allowing customers to create fine-grained control over incoming requests by combining multiple attributes (e.g., IP, User-Agent, URI path) using a Wireshark-inspired expression language. This provides flexibility for both positive and negative security models, including pattern matching with regular expressions and a new `allow` action. The feature includes a Visual Rule Builder and Expression Editor for configuration, and introduces the `cf.client.bot` field for identifying known good bots.
  602. Cloudflare Access: Sharing our single-sign on plugin for AtlassianThis post introduces a new SSO plugin for Atlassian tools (Jira and Confluence) that leverages Cloudflare Access JWTs. The plugin maps identity data from the JWT payload to existing Atlassian user accounts, enabling single sign-on and eliminating the need for secondary credentials. The post also details the structure and usage of JWTs in Cloudflare Access and announces ongoing work to expand JWT-based authorization to other products like Redash.
  603. Encrypt it or lose it: how encrypted SNI worksThis post introduces and explains Encrypted SNI (ESNI), a new privacy-enhancing feature for TLS 1.3. It details how ESNI works by encrypting the SNI extension using public-key cryptography published via DNS, preventing on-path observers from identifying visited websites. The post also highlights the importance of encrypted DNS (DoT/DoH) and DNSSEC for ESNI's effectiveness and discusses the ongoing challenge of IP address-based tracking.
  604. Encrypting SNI: Fixing One of the Core Internet BugsThis post introduces and announces the launch of Encrypted SNI (ESNI), a protocol designed to fix a core internet privacy bug where the Server Name Indication (SNI) extension, used to host multiple encrypted websites on a single IP, was itself unencrypted. This allowed ISPs and others to see which websites users visited, even over HTTPS. Cloudflare, in collaboration with industry partners, has implemented ESNI across its network and is working with browser vendors like Mozilla to integrate it, aiming to make the encrypted web more private and secure.
  605. Introducing the Cloudflare Onion ServiceThis post introduces the Cloudflare Onion Service, a new feature that enhances privacy and anonymity for Tor Browser users visiting Cloudflare-protected websites. It leverages HTTP Alternative Services and Tor's onion service protocol to establish direct, encrypted connections, bypassing exit nodes and improving security and performance for anonymous users while also enabling more fine-grained rate-limiting against malicious traffic.
  606. Protection from Struts Remote Code Execution Vulnerability (S2-057)This post details Cloudflare's immediate mitigation of the Apache Struts S2-057 vulnerability using its Web Application Firewall (WAF). It explains the nature of OGNL expressions used in Struts RCE payloads and how S2-057 differs from previous vulnerabilities by allowing payloads in the 'namespace' parameter. Cloudflare's WAF already had rules to protect against OGNL expressions and specific Struts exploit vectors, enabling them to deploy a mitigation within hours of the vulnerability's disclosure. The post also shares observed attack patterns, noting that many were probing attempts rather than malicious actions.
  607. Identifying and alerting on data loss using Cloudflare WorkersThis post introduces the use of Cloudflare Workers to detect and prevent data loss by inspecting the content of HTTP responses for sensitive 'canary' data. It demonstrates how Workers can be configured to block responses containing leaked sensitive information, return a static 'Blocked' response, and trigger external alerts (e.g., PagerDuty) via `event.waitUntil()` to notify of potential data breaches. It also touches upon rate-limiting responses as a secondary measure.
  608. Three new ways teams are using Cloudflare AccessThis post details three new ways teams are using Cloudflare Access to transition from VPNs to a zero-trust model. It introduces the use of One-Time Pin (OTP) for granting access to external partners without adding them to an Identity Provider (IdP), demonstrating policy configuration with Access Groups and OTP. It also explains how to enforce network origin requirements by combining IdP authentication with IP address range checks in Access policies. Finally, it highlights the integration of Access with Argo Tunnel to securely expose on-premise applications without opening firewall ports.
  609. A Detailed Look at RFC 8446 (a.k.a. TLS 1.3)This post details the release and significance of TLS 1.3 (RFC 8446), highlighting its substantial security and performance improvements over previous TLS versions. It explains how TLS 1.3 addresses vulnerabilities inherent in TLS 1.2 (and earlier) by removing legacy features, fixing key exchange mechanisms (like RSA key exchange), and reducing handshake latency. This directly contributes to Cloudflare's ongoing efforts to provide robust website security by adopting and advocating for the latest, most secure encryption standards.
  610. Q2 FY 18 Product Releases, for a better Internet “end-to-end”Introduced CAPTCHA and JS Challenge as new actions for Rate Limiting, allowing for more sophisticated responses to threshold violations. Added matching Header attributes in the response as a new trigger for Rate Limiting, enabling more granular control over which requests are counted towards rate limits.
  611. Going Proactive on Security: Driving Encryption Adoption IntelligentlyThis post details Cloudflare's proactive efforts to drive encryption adoption (HTTPS) by developing intelligent systems like HelperBot to automate support and debugging for common SSL misconfigurations. It also introduces the SSL Test Tool, a public-facing utility powered by HelperBot-External, designed to help website owners identify and fix issues preventing them from enabling HTTPS. The post highlights the shift from reactive support to proactive outreach through emails and tools to improve internet security.
  612. Cloudflare Access: Now teams of any size can turn off their VPNThis post announces the general availability of Cloudflare Access, a zero trust solution that replaces traditional VPNs. It introduces new policy types: Bypass (to exclude specific paths/subdomains from Access checks), IP Ranges (to allow/deny based on IP addresses), and Everyone (a broad policy type). It also introduces Access Groups, which allow users to define reusable sets of membership rules (based on email, IP ranges, or IdP groups) to simplify policy creation and management. The pricing for Access Basic and Premium plans is also detailed.
  613. Today, Chrome Takes Another Step Forward in Addressing the Design Flaw That is an Unencrypted WebThis post, authored by Troy Hunt, highlights a significant milestone in the push for a secure web: Chrome 68 flagging all non-secure connections as 'Not secure.' It frames this as addressing a fundamental design flaw of the original unencrypted web and emphasizes the increasing adoption of HTTPS, citing data on its rapid growth. The post details the risks of unencrypted sites, even static ones, and positions Cloudflare as a solution for easily enabling HTTPS, which also unlocks performance benefits like HTTP/2 and Brotli. Cloudflare's note further emphasizes their commitment to democratizing modern web technologies with Universal SSL and a free SSL test tool.
  614. T-25 days until Chrome starts flagging HTTP sites as "Not Secure"This post highlights the critical juncture where Chrome began flagging HTTP sites as 'Not Secure', emphasizing the importance of HTTPS adoption. It debunks common myths surrounding HTTPS deployment difficulty, necessity, and performance, showcasing Cloudflare's role in simplifying SSL certificate management and offering free, performant HTTPS through its edge network. It also details Cloudflare's solutions for individual sites and SaaS providers, and encourages users to adopt HTTPS by enabling features like 'Always Use HTTPS' and 'Automatic HTTPS Rewrites'.
  615. Today we mitigated 1.1.1.1This post details an incident where Cloudflare's internal DDoS mitigation system, Gatebot, mistakenly identified legitimate traffic to the 1.1.1.1 DNS resolver as an attack due to a new integration with the Provision API. This led to a 17-minute outage of the 1.1.1.1 service. The post highlights the complexity of Gatebot's reactive automation stage and the importance of thorough testing when integrating new systems, especially those that interact with critical infrastructure like DNS resolvers. It underscores a lesson learned in improving internal systems and testing procedures for future mitigation efforts.
  616. Rate Limiting: Delivering more rules, and greater controlIntroduced new challenge actions (JavaScript Challenge, Google reCAPTCHA) for Rate Limiting, allowing for more nuanced traffic management beyond simple blocking. Added dynamic scalability for Rate Limiting by enabling matching on Origin Response Headers. Provided detailed examples and tiered rule configurations for protecting against credential stuffing, enumeration attacks, and content scraping.
  617. You get TLS 1.3! You get TLS 1.3! Everyone gets TLS 1.3!This post announces the general availability and default enablement of TLS 1.3 for all new Cloudflare zones, marking a significant milestone in the adoption of this improved security protocol. It details the technical challenges overcome, particularly with middleboxes, and the strategies employed to ensure compatibility. The post also highlights the increasing adoption metrics of TLS 1.3 across Cloudflare's network and reaffirms the company's commitment to its widespread use.
  618. Now You Can Setup Centrify, OneLogin, Ping and Other Identity Providers with Cloudflare AccessThis post introduces support for Centrify and OneLogin as identity providers for Cloudflare Access, along with a generic connector for any OpenID Connect (OIDC) based identity provider. It provides detailed, step-by-step instructions for configuring these integrations, including screenshots and specific configuration parameters for each provider and the OIDC connector.
  619. Keeping Drupal sites safe with Cloudflare's WAFThis post details the implementation and effectiveness of a new Cloudflare WAF rule (ID D0003) designed to mitigate the Drupalgeddon 2 vulnerability (CVE-2018-7600). It analyzes the vulnerability's technical details, including the exploitation of renderable arrays and insufficient input validation in Drupal. The post quantifies the WAF's impact by reporting the number of blocked attacks (over 500,000 in a week), the daily unique IP addresses attempting exploitation, and provides examples of malicious payloads, including attempts to download specific files. It also highlights the ongoing nature of the threat, with over 56,000 blocked attacks per day.
  620. Introducing Spectrum: Extending Cloudflare To 65,533 More PortsThis post introduces Cloudflare Spectrum, a new product that extends Cloudflare's DDoS protection, TLS termination, and IP firewall capabilities to all TCP ports and protocols, not just HTTP/S. This significantly broadens the scope of Cloudflare's security and acceleration offerings to encompass any internet-connected service, including email, file transfer, and custom protocols, addressing a previously unmet need for comprehensive protection of diverse network infrastructure.
  621. Abusing Linux's firewall: the hack that allowed us to build SpectrumThis post introduces Cloudflare Spectrum, a new feature that extends DDoS protection, load balancing, and content acceleration to any TCP-based protocol. It details the technical challenges of accepting connections on any port (1-65535) and IP address on Linux edge servers, and how these were overcome using the 'AnyIP' trick for IP address assignment and the obscure 'TPROXY' iptables module combined with the IP_TRANSPARENT socket option. This allows for binding to any port without relying on conntrack or custom kernel patches, demonstrating a novel application of Linux networking capabilities for enhanced security and flexibility.
  622. Argo Tunnel: A Private Link to the Public InternetThis post introduces Argo Tunnel, a new product that provides a secure, private connection between a web server and Cloudflare. It aims to replace older, more complex, and expensive methods like GRE tunnels by offering a simpler, faster, and more secure alternative. Argo Tunnel reduces the attack surface by making origin servers unroutable to the public internet and leverages Cloudflare's Argo smart routing for performance benefits. It is bundled with Argo and offers a free tier consideration.
  623. Extend your security view from the data center to the edgeThis post details the integration of Cloudflare's security data with Google Cloud Security Command Center (Cloud SCC), allowing for a unified view of threats, malicious server activity, vulnerabilities, and sensitive data access levels across both platforms. Cloudflare data, including top threat origins, threat types, and WAF events, is pushed via API endpoints to Cloud SCC, providing detailed findings such as source country, IP, hostname, URI, user agent, and action taken.
  624. Cloudflare is adding Drupal WAF Rule to Mitigate Critical Drupal ExploitIntroduced a new Web Application Firewall (WAF) rule (D0003) to mitigate the critical Drupal remote code execution exploit (CVE-2018-7600). This rule is available in the Drupal category of the Cloudflare ruleset.
  625. A Solution to Compression Oracles on the WebDeveloped and open-sourced cf-nocompress, a proof-of-concept NGINX plugin with a modified gzip module to mitigate compression oracle attacks (CRIME, BREACH, TIME, HEIST) by selectively compressing non-secret parts of web pages. The solution uses sregex to identify secrets via regular expressions and disables compression for them, preventing their inclusion in the compression dictionary. This approach aims to transparently protect sensitive information like CSRF tokens without requiring application modification or client-side JavaScript.
  626. A tour through Merkle Town, Cloudflare's Certificate Transparency dashboardThis post introduces Cloudflare's role as a Certificate Transparency (CT) log operator and details their publicly accessible dashboard, Merkle Town. Merkle Town provides insights into the health, performance, and statistics of CT logs, including certificate breakdown by type, root CAs, global issuance rates, and log utilization by large CAs. This contributes to the broader website security narrative by focusing on the underlying infrastructure that supports SSL certificate trust and transparency.
  627. Introducing Certificate Transparency and NimbusThis post introduces Cloudflare's support for Certificate Transparency (CT) by launching Nimbus, a free public CT log, and Merkle Town, a dashboard for exploring the CT ecosystem. It explains the importance of CT in improving online security by making certificate issuance accountable, addressing the risks of mis-issued certificates due to Certificate Authority (CA) misbehavior or breaches, and detailing the roles of log operators, auditors, and monitors within the CT ecosystem. The post also outlines how CT is integrated into the web PKI, including the use of Signed Certificate Timestamps (SCTs) and browser requirements for CT qualification.
  628. Deprecating TLS 1.0 and 1.1 on api.cloudflare.comThis post details the deprecation of TLS 1.0 and 1.1 on api.cloudflare.com and the Cloudflare dashboard, moving towards a mandatory TLS 1.2 or higher standard. It outlines the timeline for these changes, including warnings, a brownout period, and permanent disabling. The post also introduces upcoming features like 'Minimum TLS Version' controls and enhanced TLS analytics for customer traffic, allowing users to enforce modern TLS versions for their own sites.
  629. The real cause of large DDoS - IP SpoofingThis post delves into the root cause of large-scale Distributed Denial of Service (DDoS) attacks, identifying IP spoofing as the primary enabler. It explains how IP spoofing works in both direct and amplification attacks, illustrating the technical challenges and internet design properties that make it possible. The post details how Cloudflare analyzes spoofed IP patterns and discusses solutions like BCP38 and the role of internet carriers in mitigating these threats, thereby expanding the understanding of network-level vulnerabilities within the security thread.
  630. Memcrashed - Major amplification attacks from UDP port 11211This post details a newly discovered and significant amplification attack vector using the memcached protocol over UDP port 11211. It explains the mechanics of such attacks, highlights the massive bandwidth generated (up to 260Gbps observed), identifies common sources of vulnerable memcached servers (OVH, Digital Ocean, Sakura), and provides actionable advice for memcached users, system administrators, and ISPs to mitigate these threats. It also emphasizes the ongoing challenge of IP spoofing and the need for developers to be cautious with UDP protocols.
  631. Validating Leaked Passwords with k-AnonymityCloudflare has contributed to the Pwned Passwords service by designing and implementing API endpoints that support anonymized range queries. This feature allows clients to search for breached passwords using truncated hash prefixes, ensuring that the Pwned Passwords API does not receive the complete unsalted password hash, thereby enhancing user privacy and security. The implementation leverages the k-anonymity principle by grouping hashes into buckets based on their prefixes, enabling clients to perform offline checks.
  632. Keeping our users safeThis post details Cloudflare's current practices for storing and handling user credentials (passwords and API keys) to protect against common attacks. It describes the use of bcrypt for password hashing, AES/SHA256/entropy for API key generation, audit logs for access, and HTTPS for in-transit security. It also introduces CAPTCHA challenges for viewing API keys and discusses future plans for scoped API keys and IP restrictions.
  633. HTTPS or bust: Chrome’s plan to label sites as "Not Secure"This post details Google Chrome's initiative to label all HTTP sites as 'Not Secure' starting in July 2018, marking a significant step in the push for universal HTTPS adoption. It highlights Cloudflare's role in this evolution, referencing its Universal SSL offering and its position in the broader webPKI ecosystem. The post also outlines historical milestones and predicts future developments in browser security indicators, emphasizing the importance of HTTPS for user trust and security.
  634. Introducing Cloudflare Access: Like BeyondCorp, But You Don’t Have To Be A Google Employee To Use ItThis post introduces Cloudflare Access, a perimeter-less access control solution for cloud and on-premise applications. It acts as a unified reverse proxy that enforces access control by ensuring every request is authenticated (integrating with identity providers like Google, Azure AD, and Okta, and supporting TLS client authentication), authorized (via configurable access policies for groups and users), and encrypted (using HTTPS, eliminating the need for VPNs). Features include easy policy changes, session duration modification, user session revocation, and centralized logging. It can be paired with Argo and Argo Tunnel for enhanced performance and security, and integrated with the Web Application Firewall for legacy application protection. Access is powered by Cloudflare's global network.
  635. How "expensive" is crypto anyway?This post delves into the performance and cost of cryptographic operations within TLS deployments at Cloudflare's scale. It provides detailed profiling data on CPU usage for various ciphersuites, public key algorithms (RSA, ECDHE, ECDSA), and hash functions (SHA1, SHA2). The analysis highlights that while modern cryptography is generally efficient, RSA remains a significant resource consumer, and it advocates for the adoption of ECDSA certificates. The post also touches upon the future of TLS in the context of quantum computing, indicating proactive research into post-quantum cryptography.
  636. Why TLS 1.3 isn't in browsers yetThis post details the challenges and technical reasons behind the delayed adoption of TLS 1.3 in major browsers. It explains the historical context of TLS version negotiation, the impact of the POODLE vulnerability and insecure downgrade attacks, and how these issues led to middlebox ossification and incompatibility with TLS 1.3's design. The post highlights the need for correct implementation of version negotiation and the role of middleboxes in hindering protocol upgrades.
  637. Concise (Post-Christmas) Cryptography ChallengesThis post contributes to the website security and threat management thread by presenting practical cryptography challenges. It demonstrates how to crack BCrypt password hashes, explains the implications of HSTS in preventing SSL stripping attacks, and provides a detailed walkthrough of reversing AES-256 encryption. These challenges highlight the importance of understanding and implementing secure cryptographic practices within the context of web security.
  638. TLS 1.3 is going to save us all, and other reasons why IoT is still insecureThis post highlights the growing threat of DDoS attacks originating from compromised IoT devices and identifies two key security challenges: unreliable software updates for IoT devices and the overhead associated with traditional TLS implementations. It proposes network-level filtering as a solution for update issues and advocates for TLS 1.3, elliptic curve cryptography, and secure protocols like MQTT/CoAP with DTLS to address TLS-related challenges in IoT, thereby extending Cloudflare's security focus to the burgeoning IoT landscape.
  639. Inside the infamous Mirai IoT Botnet: A Retrospective AnalysisThis post provides a retrospective analysis of the Mirai IoT botnet, detailing its genesis, propagation methods (default credentials), attack capabilities (DDoS techniques), and its impact on major services like Krebs on Security and OVH. It highlights the scale of the threat (hundreds of thousands of compromised IoT devices) and the collaborative research effort involving Cloudflare to understand and document this significant event. This contributes to the understanding of large-scale, botnet-driven DDoS attacks and the evolving threat landscape that Cloudflare actively manages.
  640. Why Some Phishing Emails Are Mysteriously DisappearingThis post introduces a new technique for combating phishing by dynamically rewriting DMARC DNS records to reject emails originating from malicious domains that abuse Cloudflare's DNS services. It explains the underlying email authentication protocols (SPF, DKIM, DMARC) and how manipulating the DMARC policy can effectively stop phishing attempts at the email client level, adding a DNS-based email security layer to Cloudflare's threat management capabilities.
  641. CAA of the Wild: Supporting a New StandardThis post details Cloudflare's adoption and rollout of the Certification Authority Authorization (CAA) Resource Record standard. It explains the purpose of CAA records in enhancing SSL certificate issuance security by allowing domain owners to specify authorized Certificate Authorities (CAs). The post highlights Cloudflare's beta program for testing CAA support, its eventual removal of the beta flag for all users, and its integration with Universal SSL. It also delves into the complexities and potential issues with the CAA record processing algorithm, particularly concerning CNAME records and wildcard domains, demonstrating Cloudflare's proactive approach to supporting and refining new internet security standards.
  642. Make SSL boring againThis post details Cloudflare's migration of its edge SSL connection termination stack to BoringSSL. This move enabled support for TLS 1.3 across the board, improved key negotiation with X25519 for TLS 1.2 and earlier, and introduced RSA-PSS for TLS 1.2. It also highlights internal improvements to features like Keyless SSL, distributed session ID caches, and cipher grouping, as well as the development of a more reliable OCSP stapling pipeline. The post also touches on addressing performance issues with base64 decoding in BoringSSL and maintaining support for legacy ChaCha20-Poly1305 ciphers for older clients.
  643. Introducing the Cloudflare Warp Ingress Controller for KubernetesThis post introduces the Cloudflare Warp Ingress Controller for Kubernetes, a new integration that allows Kubernetes-managed services to be securely exposed to the internet through Cloudflare's network. This extends Cloudflare's security and performance benefits (DDoS protection, WAF, global load balancing) to containerized applications, simplifying the process of connecting them to the outside world and ensuring they are protected and accelerated by Cloudflare's services. It also highlights the collaboration with StackPointCloud for seamless integration.
  644. The New DDoS LandscapeThis post details the evolving landscape of DDoS attacks, noting a significant shift from volumetric network-layer attacks (Layer 3/4) to more sophisticated application-layer attacks. It explains the mechanisms behind botnets, IoT devices, and DNS amplification as sources of attack capacity, and contrasts older mitigation priorities focused on network capacity with the new reality of application-layer threats. The post highlights Cloudflare's 'Unmetered Mitigation' policy as a response to the increasing size and sophistication of attacks, ensuring continuous service availability.
  645. Thwarting the Tactics of the Equifax AttackersThis post details the analysis of the Equifax breach, highlighting the importance of timely patching and the risks associated with single points of failure in vulnerability communication. It explains Remote Code Execution (RCE) via Apache Struts vulnerabilities (CVE-2017-5638, CVE-2017-9805) with code examples and discusses SQL Injection (SQLi) with a detailed example of account takeover. It also mentions Cloudflare's WAF rules protecting against these and other attacks (XSS), noting the high volume of matches observed. The post emphasizes communication, awareness of installed software versions, and the role of Cloudflare's WAF as a last line of defense.
  646. On the dangers of Intel's frequency scalingThis post investigates the performance degradation observed when using Intel's AVX-512 instruction set with cryptographic operations like ChaCha20-Poly1305. It details how dynamic frequency scaling, triggered by AVX-512 usage, can significantly reduce CPU performance, leading to a decrease in server throughput even when AVX-512 code constitutes a small percentage of the workload. The post highlights the trade-offs between using modern, high-performance ciphers and the potential for performance penalties due to hardware frequency scaling, and suggests disabling AVX-512 for general-purpose workloads if not strictly required for specific high-performance tasks.
  647. Privacy Pass - “The Math”This post introduces and details the 'Privacy Pass' protocol, a novel cryptographic approach developed to improve website accessibility for users interacting with Cloudflare's network. It explains the mathematical underpinnings of the protocol, moving from blind RSA to more efficient elliptic curve cryptography and Oblivious PRFs. Privacy Pass allows users to obtain cryptographically blinded tokens after solving a challenge (like a CAPTCHA), which can then be used to bypass future challenges without revealing the user's identity to the server, thus enhancing privacy and reducing friction.
  648. Cloudflare supports Privacy PassThis post introduces Cloudflare's support for Privacy Pass, a privacy-preserving protocol that uses zero-knowledge proofs. This initiative aims to improve the browsing experience for users of anonymity services or shared IPs by reducing the number of challenge pages they encounter. It represents an effort to balance security with user privacy and convenience, particularly for vulnerable internet users, and is part of a broader effort to make the internet more accessible.
  649. LavaRand in Production: The Nitty-Gritty Technical DetailsThis post details the technical implementation of LavaRand, a system that uses a wall of lava lamps as a source of true randomness for cryptographic operations. It explains the concepts of true vs. pseudorandomness, the importance of randomness in cryptography, and how LavaRand integrates with Cloudflare's production systems to provide an additional layer of security by mixing entropy from physical processes with existing entropy sources.
  650. Randomness 101: LavaRand in ProductionThis post introduces LavaRand, a novel system that uses lava lamps as a secondary source of cryptographic randomness for Cloudflare's production servers. It explains the critical need for unpredictable randomness in cryptography, the challenges computers face in generating it, and how CSPRNGs combined with real-world unpredictable inputs (like the chaotic flow of lava lamps captured by a camera) can provide a robust solution. LavaRand serves as a 'hedge' to ensure security even if primary randomness sources are compromised, highlighting Cloudflare's proactive and layered approach to security.
  651. Performing & Preventing SSL Stripping: A Plain-English PrimerThis post provides a plain-English explanation of SSL stripping attacks and how they exploit the transition from HTTP to HTTPS. It details the evolution of encryption protocols (SSL/TLS) and the mechanisms designed to prevent such attacks, including HTTP Strict Transport Security (HSTS) and HSTS preloading. It highlights the importance of end-to-end HTTPS and the ongoing challenges in securing web traffic against evolving threats.
  652. A Fast, Secure Migration to Google Cloud Platform using CloudflareThis post highlights Cloudflare's role in securing cloud migrations, specifically detailing how LUSH migrated to Google Cloud Platform. It emphasizes the use of Cloudflare's load balancing across cloud providers, Web Application Firewall (WAF), SSL/TLS encryption, and rate limiting as key security measures during and after migration. The post also touches upon the benefits of direct interconnections between Cloudflare and Google Cloud Platform data centers for performance and cost savings, and reinforces the importance of SSL best practices.
  653. Introducing Cloudflare Warp: Hide Behind The EdgeThis post introduces Cloudflare Warp (later renamed Argo Tunnel), a new security-conscious tool that allows web applications to be exposed without exposing the underlying server. It achieves this by creating a private, encrypted virtual tunnel from the Cloudflare edge to the application's origin. This effectively hides the origin server from the internet, allowing Cloudflare's edge to act as a network shield and enforce security policies before traffic reaches the server. The tool also offers side benefits like service discovery and the ability to tag tunnels for future routing configurations.
  654. Geo Key Manager: How It WorksIntroduced Geo Key Manager, a feature that allows customers to control where their private SSL keys are stored on Cloudflare's network. This builds on Keyless SSL by hosting key servers in chosen locations, reducing complexity and latency. The architecture leverages Identity-Based Broadcast Encryption (IBBE) and Identity-Based Revocation (IBR) to provide granular control over key distribution based on regions and specific data center locations, addressing diverse regulatory and risk profile requirements.
  655. Introducing the Cloudflare Geo Key ManagerThis post introduces Geo Key Manager, a new feature that allows customers to control the geographic distribution of their SSL private keys. This addresses geopolitical concerns and regulatory requirements by enabling customers to restrict key access to specific regions (e.g., U.S. Only, E.U. Only) or to Cloudflare's highest security data centers. The post also details the security requirements for these data centers and explains the performance implications of using Keyless SSL when keys are not locally accessible, highlighting the use of session resumption to mitigate latency for subsequent requests.
  656. No Scrubs: The Architecture That Made Unmetered Mitigation PossibleThis post details Cloudflare's architectural approach to DDoS mitigation, highlighting the shift away from traditional 'scrubbing centers' towards an integrated, network-wide solution. It explains the challenges of bandwidth, cost, and knowledge associated with scrubbing centers and presents Cloudflare's 'unmetered mitigation' strategy. This involves leveraging every server in the network for mitigation, load balancing attacks across data centers and servers, and employing custom software (iptables, EFVI) for efficient packet processing. The post also emphasizes the benefits of this integrated approach, including cost-effectiveness, always-on protection, and continuous improvement of the entire software stack through real-world attack mitigation. It also touches upon Cloudflare's commitment to open-sourcing security tools.
  657. Meet Gatebot - a bot that allows us to sleepThis post introduces Gatebot, an automated mitigation system designed to handle large-scale DDoS attacks. It details the evolution from manual SRE intervention to an automated 'detection/logic/mitigation' pipeline. The post explains various mitigation techniques employed, including scattering, iptables extensions, kernel bypass with floodgate, and HTTP-layer adjustments. It highlights how Gatebot's automation improves response time, precision, and allows for consistent DDoS protection for all users, and notes the reuse of this model in other systems like the Automatic Network System.
  658. Unmetered Mitigation: DDoS Protection Without LimitsIntroduced 'Unmetered Mitigation' for DDoS protection, eliminating surge pricing and customer termination regardless of attack size or plan level. This represents a significant shift in DDoS mitigation strategy, moving towards a default, unlimited service.
  659. Understanding the prevalence of web traffic interceptionThis post contributes to the understanding of web traffic interception by presenting research findings on its prevalence, methods, and security implications. It details the technical mechanisms of interception (local and remote), the role of trusted certificate authorities, and the use of TLS fingerprinting to detect interception. The post quantifies interception rates (4-10%), breaks them down by OS and browser, and categorizes interceptors by motivation (security vs. malicious). It also explains how insecure cryptographic implementations by interceptors weaken overall security.
  660. SIDH in Go for quantum-resistant TLS 1.3This post introduces the implementation of Supersingular Isogeny Diffie-Hellman (SIDH) in Go for quantum-resistant TLS 1.3. It details the quantum threat to current cryptography, explains the principles of SIDH, and describes its integration into Cloudflare's TLS 1.3 client and the challenges of implementing high-performance cryptographic primitives in Go.
  661. The WireX Botnet: How Industry Collaboration Disrupted a DDoS AttackThis post details Cloudflare's involvement in a collaborative effort to disrupt the WireX botnet, a large-scale DDoS attack originating from Android devices. It highlights the importance of industry-wide information sharing and cooperation between security companies, CDNs, and content providers to effectively combat sophisticated threats. The post showcases Cloudflare's role in analyzing attack vectors, identifying malicious applications, and working with partners like Google to remove them, underscoring the evolution of threat management to include proactive, collaborative disruption of botnets.
  662. High-reliability OCSP stapling and why it mattersIntroduced a redesigned, robust, and reliable OCSP stapling infrastructure that serves valid OCSP stapled responses for all connections where the certificate authority has set up OCSP, improving connection times and enabling reliable certificate revocation checking.
  663. Stupidly Simple DDoS Protocol (SSDP) generates 100 Gbps DDoSThis post details a significant 100 Gbps+ Distributed Denial of Service (DDoS) attack leveraging the Simple Service Discovery Protocol (SSDP), commonly used by UPnP. It explains how misconfigured firewalls can expose UPnP-enabled devices to the internet, allowing attackers to spoof source IPs and trigger large amplification responses from these devices. The post provides technical details on the attack, including packet analysis, reflector IP distribution, and the amplification factors achieved by SSDP, highlighting the ongoing challenge of mitigating novel DDoS vectors.
  664. Project Jengo: Explaining Challenges to Patent Validity (and a looming threat)This post introduces 'Project Jengo', Cloudflare's initiative to combat patent trolls by challenging the validity of patents through USPTO administrative proceedings like Inter Partes Review (IPR) and ex parte reexamination. It details the mechanics and advantages of these processes compared to traditional court litigation, highlighting how they can be used to invalidate 'bad patents' that stifle innovation. This represents a new facet of Cloudflare's threat management, extending beyond technical defenses to legal and administrative challenges against entities that leverage patents to hinder technological progress.
  665. How we built rate limiting capable of scaling to millions of domainsThis post details the implementation of Cloudflare's rate limiting system, designed to scale to millions of domains. It describes the challenges of distributed rate limiting across an anycast network, the use of a Twemproxy cluster with memcached for shared counters within each PoP, and the adoption of a sliding window algorithm for accurate rate approximation. The system leverages asynchronous counter increments and in-memory caching of mitigation states to handle high-volume L7 attacks efficiently without impacting legitimate traffic.
  666. Reflections on reflection (attacks)This post details the analysis of reflection attacks, specifically NTP and SSDP, including their mechanics, prevalence, and statistics gathered from Cloudflare's logs. It explains how these attacks work, lists popular reflection vectors, and provides detailed statistics on NTP and SSDP attacks, including duration, number of reflectors, and peak bandwidth. It also touches on Cloudflare's automated defenses against such attacks.
  667. How eero mesh WiFi routers connect to the cloudThis post details how eero uses Cloudflare as a 'cloud canary' to test internet availability from their devices. They store a small file in Amazon S3, protected by Cloudflare, to serve as a secondary internet check. This allows eero devices to continuously verify internet access without relying on third-party sites, preserving user privacy and providing an out-of-band, highly available, and low-cost method. Cloudflare's CDN serves this file from the edge, minimizing S3 costs.
  668. IoT Security Anti-PatternsThis post contributes to the website security and threat management feature thread by extending the discussion to the emerging security landscape of the Internet of Things (IoT). It identifies and explains four key security anti-patterns prevalent in IoT device development: insecure HTTP Pub/Sub leading to DDoS vulnerabilities, the risks of IoT devices acting as TLS servers with self-signed certificates, the critical vulnerability of unencrypted bootloaders, and the performance and security issues arising from using databases as inter-process communication (IPC). This expands the scope of threat management to encompass connected devices.
  669. Introducing TLS with Client AuthenticationIntroduced TLS with Client Authentication for enterprise customers, enabling server-side authentication of clients via unique client certificates. This feature enhances security for IoT, mobile apps, and enterprise networks by ensuring only authorized clients can connect. The handshake process involves the client presenting a certificate signed by a trusted Certificate Authority, which is then verified by the server. Cloudflare offers this functionality at the edge to offload CPU-intensive cryptographic operations, with enforce and report modes, and the ability to forward client certificate fields as custom headers. Cloudflare's open-sourced PKI (cfssl) is provided as a tool for customers to set up their own Certificate Authority.
  670. Introducing Cloudflare Orbit: A Private Network for IoT DevicesIntroduced Cloudflare Orbit, a private network for IoT devices that acts as a security shield at the edge. Orbit allows IoT companies to apply security logic and firewall rules to protect devices from exploits, even if they are unpatched. This is achieved by filtering malicious requests before they reach the device. Additionally, Orbit introduces TLS Client Authentication handled at the edge, which validates client certificates from IoT devices, ensuring only authorized devices can communicate with IoT infrastructure.
  671. AES-CBC is going the way of the dodoThis post details the significant decline in the use of AES-CBC cipher suites on Cloudflare's network, marking a milestone where more secure alternatives like AES-GCM and ChaCha20-Poly1305 have surpassed it. It also highlights the increasing adoption of ECDSA over RSA for digital signatures and the continued dominance of Perfect Forward Secrecy (PFS), indicating a positive trend towards safer and faster cryptography on the web.
  672. Introducing SSL for SaaSThis post introduces 'SSL for SaaS,' a new capability that allows SaaS providers to easily extend Cloudflare's security benefits, specifically automated SSL certificate provisioning and management, to their customers' custom domains. This addresses the complexity of manually managing SSL certificates for white-labeled SaaS applications, enabling HTTPS for these custom domains with a simple API call and CNAME setup. It highlights how this feature enhances security, SEO, and performance for end-users by leveraging Cloudflare's edge network and advanced TLS implementations.
  673. Cloudflare Rate Limiting - Insight, Control, and Mitigation against Layer 7 DDoS AttacksThis post announces the general availability of Cloudflare's Rate Limiting service to all customers, extending its previous availability to Enterprise customers. It details how Rate Limiting helps mitigate Layer 7 DDoS attacks, brute-force login attempts, and bot scraping by blocking offending IP addresses at the network edge. The post outlines how to enable and configure Rate Limiting through the dashboard, including path-specific rules and HTTP method limitations for Business+ plans. It also introduces a 'simulate' mode for Pro+ plans to test rules before live deployment and mentions upcoming analytics for insights into traffic patterns and rule efficacy.
  674. An AMP validator you can cURLThis post introduces a new AMP linter API that can be accessed via cURL. The API allows developers to validate AMP pages by sending either a URL or the HTML content directly. It returns a JSON response indicating validity and provides specific error codes and links to documentation for invalid pages. The post also includes examples of how to use the API with cURL and Python.
  675. Quantifying the Impact of "Cloudbleed"This post details the analysis of the "Cloudbleed" bug, a memory leak in Cloudflare's parser that exposed customer data. It explains how the bug was triggered by specific HTML flaws and enabled Cloudflare features, the code path involved, and the timeline of its exposure and patching. The post quantifies the impact by analyzing logs, finding no evidence of malicious exploitation before patching, and identifying that while internal headers and cookies were leaked, no passwords, credit card numbers, or health records were found in the reviewed data. It also outlines the methodology used to search for malicious exploitation patterns.
  676. Incident report on memory leak caused by Cloudflare parser bugThis post details a critical security incident where a memory leak in Cloudflare's HTML parser (Ragel-based) led to the potential exposure of sensitive data like cookies and POST bodies. It highlights the rapid response to identify the root cause, disable affected features (email obfuscation, server-side excludes, automatic HTTPS rewrites), and deploy a global patch within hours. The post also provides a deep technical dive into the bug's origin in pointer arithmetic and buffer handling, and explains why it manifested after the introduction of a new parser (cf-html). This incident underscores Cloudflare's commitment to transparency and its ability to quickly address security vulnerabilities impacting its infrastructure.
  677. NCC Group's Cryptography Services audits our Go TLS 1.3 stackThis post details Cloudflare's implementation of TLS 1.3, including an independent audit by NCC Group. It highlights the use of Go's standard library for a secure and efficient implementation, the focus on modern cryptographic algorithms, and the commitment to upstreaming improvements to the Go project. This demonstrates a commitment to advancing the security of internet connections through the adoption and refinement of the latest encryption standards.
  678. DDoS Ransom: An Offer You Can RefuseThis post details the emergence and tactics of DDoS ransom groups, specifically noting their use of demonstration attacks and ransom emails referencing Mirai. It reinforces Cloudflare's stance against paying ransoms, explains the typical attack vectors and volumes observed in demonstration attacks, and advises users to have a proactive action plan for DDoS mitigation.
  679. Protecting everyone from WordPress Content InjectionThis post details the immediate rollout of two new Web Application Firewall (WAF) rules (WP0025A and WP0025B) to protect unpatched WordPress sites (versions below 4.7.2) from a critical content injection vulnerability discovered by Sucuri. These rules were developed in collaboration with WordPress and other WAF vendors and were made available to all Cloudflare customers, including free tier users, before the vulnerability was publicly announced.
  680. Token Authentication for Cached Private Content and APIsIntroduced Token Authentication as a feature to control access to cached private content and APIs. This feature allows for access control via URL tokens or HTTP request headers, validated at the edge before reaching the origin or cache. The token is an HMAC generated from a shared secret, resource path, and timestamp. It supports both static content protection (e.g., downloads) and API authentication, where tokens are provided by the origin server after initial authentication. The implementation involves configuring rules within the Web Application Firewall (WAF) Custom User Rule Set Package, with options for simulate, challenge, or block actions. Customization of the WAF block page is also supported. The post provides PHP code examples for generating URL tokens and outlines the benefits for API protection, including statelessness, CSRF prevention, and reduced origin load. It also mentions embedding and encrypting shared secrets within mobile applications for API endpoint protection.
  681. The Porcupine Attack: investigating millions of junk requestsThis post details the investigation and analysis of the 'Porcupine Attack', a novel threat characterized by millions of junk HTTP requests per second that bypassed traditional HTTP DDoS mitigation systems. It highlights Cloudflare's internal monitoring tools (Grafana), debugging techniques (tcpdump), and the detailed analysis of the malformed HTTP payload, revealing a patterned binary junk. The post also discusses the scale, global geographic distribution, and aggressive IP rotation of the attacking sources, suggesting a sophisticated botnet. It concludes with the identification of the payload generation algorithm and ongoing investigation into the nature of the attack.
  682. The Daily DDoS: Ten Days of Massive AttacksThis post details a ten-day period of massive DDoS attacks, observing new attacker patterns like working regular business hours and using non-Mirai botnet software. It highlights Cloudflare's ability to automatically mitigate these large-scale, sustained attacks (peaking at 400Gbps and 172Mpps) without impacting customers, reinforcing the effectiveness of its architectural design for handling such threats.
  683. How Cloudflare's Architecture Allows Us to Scale to Stop the Largest AttacksThis post details Cloudflare's architectural approach to scaling its DDoS mitigation capabilities, contrasting it with legacy hardware-based solutions. It explains how Cloudflare's distributed, software-defined network, built on commodity hardware and BGP routing, allows for cost-effective scaling and the ability to absorb massive attacks. The post also highlights how Cloudflare's bandwidth purchasing model (95th percentile billing) makes DDoS mitigation effectively free for the company, enabling services like Project Galileo.
  684. TLS nonce-nseThis post details the evolution of nonce management in TLS, explaining its importance for cryptographic security. It traces the progression from RC4's lack of nonces, through CBC's vulnerabilities in TLS 1.0 (BEAST attack) and its fixes in TLS 1.1 and 1.2, to the improved nonce handling in TLS 1.2 AES-GCM and the final robust implementation in TLS 1.3. It also highlights the "Nonce-Disrespecting Adversaries" vulnerability and the ongoing research into nonce reuse resistance.
  685. Say Cheese: a snapshot of the massive DDoS attacks coming from IoT camerasThis post details a significant shift in DDoS attack vectors, highlighting the emergence of large-scale attacks originating from IoT botnets, specifically mentioning the Mirai botnet and similar threats. It provides concrete data on two major L7 HTTP-based DDoS attacks, one peaking at 1.75 million requests per second and another generating 360Gbps of inbound traffic with large HTTP payloads. The post analyzes the geographical distribution of these attacks, the Autonomous Systems (AS) involved, and provides evidence suggesting the compromised devices are primarily IoT cameras and potentially NAS devices. It also discusses the evolution of DDoS mitigation strategies to counter these new L7 threats, including the deployment of a new system that recognizes and blocks these attacks across the network.
  686. Rate Limiting: Live DemoIntroduced Cloudflare Rate Limiting, a feature to control traffic based on request rates per client IP address, cookie, or other attributes. The post details configuration options including URL patterns (with wildcards), threshold (requests per minute), action (block/simulate), timeout, and response body type/content. It also mentions potential future enhancements like specifying methods, response codes, headers, and cookies, and extending mitigation options to CAPTCHA.
  687. Introducing Dedicated SSL CertificatesThis post introduces Dedicated SSL Certificates and Dedicated SSL Certificates with Custom Hostnames. These offerings provide customers with non-shared, customizable SSL certificates issued on-demand with a new private key exclusively for their domain. This addresses customer requests for more control over certificate issuance, branding (showing their domain name instead of cloudflaressl.com), protection of multiple levels of subdomains, and granular control over SSL/TLS features. It complements the existing Universal SSL by offering a higher degree of personalization and isolation for specific use cases like agencies, SaaS providers, and those requiring advanced subdomain coverage.
  688. Control your traffic at the edge with CloudflareIntroduced Rate Limiting to control traffic based on request counts per IP, URI, or authentication token, and Traffic Manager for load balancing across multiple origin servers and geographies with health checks and geo-steering.
  689. How we brought HTTPS Everywhere to the cloud (part 1)This post details Cloudflare's initiative to automatically rewrite HTTP dependencies to HTTPS on the server-side to combat mixed content issues. It explains the challenges of naive rewriting and how Cloudflare developed a custom, high-performance engine inspired by the HTTPS Everywhere browser extension. The post dives into the technical details of how the engine parses domain wildcards efficiently using Ragel and state machines, optimizing for performance at scale.
  690. An overview of TLS 1.3 and Q&AThis post introduces TLS 1.3 as a significant advancement in secure communication protocols, detailing its improvements over TLS 1.2. It explains how TLS 1.3 reduces handshake round-trips from two to one, and enables 0-RTT connections for even faster initial data transfer. It also highlights the removal of outdated and insecure cryptographic algorithms and features, making the protocol more robust and less prone to implementation errors and vulnerabilities.
  691. Introducing TLS 1.3This post introduces TLS 1.3 as a significant upgrade to encrypted internet traffic, available to all Cloudflare customers. It highlights TLS 1.3's key benefits: enhanced security through the removal of outdated and vulnerable cryptographic features (like RSA key transport, CBC mode ciphers, RC4, SHA-1, and arbitrary Diffie-Hellman groups) and improved speed by reducing the handshake process from two round-trips to one, with a future plan for zero round-trip mode (0-RTT). This directly contributes to the ongoing effort to secure and optimize web traffic.
  692. Encryption WeekThis post, 'Encryption Week,' introduces three major features that significantly advance Cloudflare's commitment to encryption and web security: TLS 1.3 for faster and more secure connections, Automatic HTTPS Rewrites to automatically fix mixed content issues and enable HTTPS adoption, and Opportunistic Encryption to provide HTTP/2 benefits to unencrypted HTTP sites. These features collectively aim to make encryption more accessible and widespread, contributing to the goal of an encrypted internet.
  693. CloudFlare’s new WordPress pluginThis post introduces a new Cloudflare WordPress plugin that simplifies the integration of Cloudflare's performance and security benefits for WordPress sites. It offers one-click WordPress-optimized settings, integrates Web Application Firewall (WAF) rulesets specifically for WordPress threats, and provides automatic cache purging when website appearance changes. The plugin also allows users to adjust Cloudflare settings and view analytics directly from within the WordPress dashboard, and restores original visitor IP addresses in logs.
  694. Introducing the p0f BPF compilerThis post introduces the p0f BPF compiler, an open-source component of Cloudflare's bpftools. It details how Cloudflare uses the p0f tool to analyze network traffic and generate signatures for identifying different operating systems and, crucially, attack patterns like SYN floods. The post explains the p0f signature format and demonstrates how the new compiler translates these signatures into BPF bytecode for iptables. This enables Cloudflare to efficiently rate-limit or drop malicious SYN packets based on their specific characteristics, significantly enhancing their SYN flood mitigation capabilities.
  695. CloudFlare sites protected from httpoxyIntroduced automatic protection for all customers against the httpoxy vulnerability. Provided an option for customers to block such requests using WAF rule 100050.
  696. The Sleepy User AgentThis post details a specific attack vector where SQL injection is attempted via the User-Agent header, demonstrating how blind SQL injection can be used to infer database structure and data by observing response delays. It highlights the vulnerability of unsanitized input in HTTP headers and provides a secure code example using prepared statements in PHP to prevent such attacks. The Cloudflare WAF is mentioned as a mitigation for SQL injection attempts.
  697. How we built Origin CA: Web CryptoThis post introduces the Cloudflare Origin CA, a new feature that allows users to obtain certificates directly from Cloudflare to encrypt the connection between Cloudflare and their origin servers. It highlights the use of the Web Crypto API for client-side private key generation, enhancing both security and usability by eliminating the need for users to manage private keys or interact with third-party certificate authorities for this specific purpose.
  698. Inside ImageTragick: The Real Payloads Being Used to Hack WebsitesThis post details the discovery and analysis of the ImageTragick vulnerability (CVE-2016-3714) in ImageMagick, which allows for arbitrary code execution. It describes how Cloudflare quickly deployed a WAF rule to protect customers and analyzes the common payloads used by attackers for reconnaissance and remote access. The post emphasizes the importance of upgrading ImageMagick to patch the vulnerability.
  699. Yet Another Padding Oracle in OpenSSL CBC CiphersuitesThis post details a specific padding oracle vulnerability (CVE-2016-2107) found in OpenSSL's CBC mode cipher suites, which was a fix for a previous vulnerability (Lucky13). It explains the technical details of the vulnerability, how it exploits constant-time programming practices, and how Cloudflare engineers analyze and address such cryptographic weaknesses to maintain the security of its network and customer connections.
  700. Introducing CloudFlare Origin CAThis post introduces Cloudflare Origin CA, a new service that provides free and performant encryption from Cloudflare's edge to the customer's origin server. It addresses the complexities of obtaining and renewing certificates by offering simplified issuance, wildcard certificate support, faster and more reliable revocation, and optimized certificates that reduce handshake size and origin bandwidth consumption. This enhances the overall security posture by making end-to-end encryption more accessible and efficient.
  701. Stronger protection and more control over security settings with CloudFlare’s new cPanel pluginThe cPanel plugin has been re-architected using the latest cPanel PHP-based APIs for easier feature addition and more frequent updates. New features include Full Zone Provisioning for enabling DDoS mitigation at the root domain, an 'I'm under attack' mode for Layer 7 DDoS attacks, and granular control over security settings (basic security level, challenge passage, browser integrity check). Performance controls now include cache management, auto-minify for CSS/JS/HTML, and development mode toggling. The plugin also offers localization support for easier translation.
  702. IETF Hackathon: Getting TLS 1.3 working in the browserThis post details Cloudflare's active participation in an IETF Hackathon to implement and test TLS 1.3 in browsers. It highlights the collaborative effort to integrate TLS 1.3 with Firefox and Cloudflare's test infrastructure, focusing on achieving interoperability for features like PSK-based resumption and 0-RTT. This contribution showcases Cloudflare's commitment to advancing and deploying cutting-edge security protocols to enhance internet security.
  703. It takes two to ChaCha (Poly)This post details Cloudflare's early adoption and ongoing support for the ChaCha20-Poly1305 AEAD cipher suite. It explains the technical aspects of AEADs, the history and standardization of ChaCha20-Poly1305, its advantages over AES-GCM, and the differences between draft and RFC versions. Cloudflare's contribution includes an open-sourced patch for OpenSSL that supports both versions, ensuring compatibility with existing and upcoming browsers, and highlighting their role in pioneering this technology for improved web performance and security, especially on mobile devices.
  704. The Trouble with TorThis post details Cloudflare's approach to handling traffic from the Tor network, which presents a unique challenge due to the high percentage of malicious requests originating from Tor exit nodes and the inherent anonymity that prevents traditional reputation-based filtering. The post discusses the trade-offs between security, anonymity, and convenience, and the implementation of CAPTCHAs (specifically Google's reCAPTCHA) as a primary mechanism to distinguish automated malicious traffic from legitimate human users. It also introduces open-sourced tools like 'torhoney' and 'torexit' for analyzing Tor exit node reputation and longevity, and discusses potential future improvements such as treating GET requests differently and allowing customers to configure rules for Tor traffic.
  705. TLS Certificate Optimization: The Technical Details behind "No Browser Left Behind"This post details Cloudflare's 'no browser left behind' initiative, specifically focusing on the technical implementation of TLS certificate optimization. It explains the complex logic required to dynamically serve the most appropriate certificate (SHA-1 RSA, SHA-2 RSA, or SHA-2 ECDSA) based on the client's capabilities, as communicated in the TLS ClientHello message. This ensures secure connections for all users, regardless of their browser's support for newer cryptographic standards, while also optimizing for performance.
  706. 400Gbps: Winter of Whopping Weekend DDoS AttacksThis post details Cloudflare's advancements in automatically mitigating large-scale Layer 3 DDoS attacks, reporting peak traffic of over 400Gbps and 180Mpps. It highlights how their network capacity and automated systems allow them to absorb and accurately measure these attacks, improving their mitigation capabilities with each event and enabling them to withstand even larger future attacks.
  707. Staying afloat: the DROWN Attack and CloudFlareThis post highlights Cloudflare's proactive protection against the DROWN attack by ensuring SSLv2 is not enabled on its own infrastructure and by testing customer origin servers for vulnerabilities. It reinforces the ongoing commitment to secure encryption protocols and threat mitigation.
  708. Introducing CloudFlare Registrar: Designed for Security, Not the MassesThis post introduces Cloudflare Registrar, a new service designed to address the critical security vulnerability of domain hijacking at the registrar level. It details the historical context of domain registration, the inherent security weaknesses in existing mass-market registrars, and Cloudflare's solution which involves implementing robust security measures like registrar and registry locks, multi-user offline confirmation, two-factor authentication, and automatic DNSSEC. This marks an expansion of Cloudflare's security offerings beyond website traffic to the ownership and management of domains themselves.
  709. Padding oracles and the decline of CBC-mode cipher suitesThis post details the vulnerability of CBC-mode cipher suites to padding oracle attacks, a significant threat to TLS security. It explains the mechanics of these attacks and highlights Cloudflare's role in mitigating them by promoting the adoption of more secure AEAD cipher suites, thereby enhancing website security and threat management.
  710. Change the (S)Channel! Deconstructing the Microsoft TLS Session Resumption bugThis post details Cloudflare's investigation and deconstruction of a bug within Microsoft's SChannel TLS implementation. The bug caused connection failures or security downgrades (TLS 1.2 to TLS 1.0) when clients using SChannel encountered TLS session tickets being renewed during an abbreviated handshake. Cloudflare's proactive approach to TLS session ticket management, including frequent key regeneration for security and scalability, exposed this underlying issue in Microsoft's implementation. The post highlights Cloudflare's role in identifying, troubleshooting, and ultimately contributing to the resolution of this critical security vulnerability affecting a wide range of Microsoft products.
  711. Preventing Malicious Request LoopsThis post addresses a specific threat vector: malicious request loops caused by non-compliant reverse proxy services. It details how Cloudflare uses the 'Via' header to prevent these loops for its own service and calls for industry-wide adoption of RFC 7230 standards to ensure a more secure and stable web ecosystem. It highlights the importance of standards compliance in preventing resource exhaustion and denial-of-service attacks.
  712. Why it’s harder to forge a SHA-1 certificate than it is to find a SHA-1 collisionThis post details the cryptographic implications of SHA-1 hash collisions and their potential to forge digital certificates, highlighting that while collisions are becoming feasible, forging a certificate requires more than just a collision. It emphasizes the importance of CA practices like including randomness in serial numbers to mitigate such attacks.
  713. A Different Kind of POP: The Joomla Unserialize VulnerabilityThis post details the analysis of a specific Joomla unserialize vulnerability (CVE-2015-8562), explaining the POP chain exploit mechanism and the vulnerable code paths in Joomla's session handling. It highlights how Cloudflare's Web Application Firewall (WAF) automatically protected users by creating and deploying a specific rule set, demonstrating the effectiveness of the WAF in blocking exploit attempts in the wild.
  714. SHA-1 Deprecation: No Browser Left BehindThis post details Cloudflare's proactive approach to deprecating the SHA-1 hashing algorithm for SSL certificates. It highlights the security risks associated with SHA-1, the challenges of transitioning to SHA-2 (particularly for users in developing countries with older devices), and Cloudflare's solution: implementing SHA-1 fallback for legacy browsers while serving SHA-256 to modern ones. This demonstrates a commitment to both advancing security standards and ensuring broad accessibility.
  715. A Look at the New WordPress Brute Force Amplification AttackThis post details a new WordPress brute force amplification attack vector that abuses the `system.multicall` functionality within XML-RPC to make a large number of login attempts with a single HTTP request. It explains the underlying XML-RPC protocol and how `system.multicall` can be exploited. Cloudflare's Web Application Firewall (WAF) is presented as a solution, with a specific rule (WP0018) available for Pro+ customers to block these amplified brute force attempts. A manual mitigation by disabling `system.multicall` in WordPress's `functions.php` is also provided.
  716. Mobile Ad Networks as DDoS Vectors: A Case StudyThis post details a novel DDoS attack vector utilizing mobile ad networks to distribute malicious JavaScript, which then floods Cloudflare customer sites with HTTP requests. It provides a case study of such an attack, analyzing the request patterns, the attack page, and the likely distribution mechanism through ad networks. This highlights a new type of threat that Cloudflare's platform is capable of detecting and mitigating automatically.
  717. Weird bug of the day: Twitter in-app browser can't visit siteThis post details the debugging and resolution of an issue where the Twitter in-app browser failed to load Cloudflare-protected sites when transitioning from an HTTPS link in a tweet to an HTTP link on a Cloudflare customer's site. The root cause was identified as the Twitter app blanking out the Referer header, which violated RFC 7231. Cloudflare's Browser Integrity Check was flagging this as an error. The fix involved relaxing the Referer header check for this specific client behavior, demonstrating an adaptation of security policies to accommodate real-world client quirks while adhering to Postel's Law.
  718. Logjam: the latest TLS vulnerability explainedThis post explains the Logjam vulnerability, a novel downgrade attack against the TLS protocol that exploits EXPORT cryptography. It highlights how Cloudflare customers are protected because Cloudflare does not support non-EC Diffie-Hellman cipher suites or EXPORT-grade cryptography, and instead relies on Elliptic Curve Diffie-Hellman (ECDHE) for forward secrecy. The post details the technical workings of Diffie-Hellman and the Logjam attack, emphasizing the importance of strong, non-reused cryptographic parameters and the server's role in accepting weak parameters.
  719. An introduction to JavaScript-based DDoSThis post introduces JavaScript-based DDoS attacks as a new and evolving threat. It explains how malicious JavaScript can be used to enlist unsuspecting web users into DDoS attacks, either through compromised websites, hijacked third-party scripts, or man-in-the-middle attacks. It also highlights Subresource Integrity (SRI) as a proposed solution to mitigate risks from compromised third-party scripts and emphasizes the importance of HTTPS for preventing man-in-the-middle attacks and protecting against JavaScript DDoS.
  720. New Magento WAF Rule – RCE Vulnerability ProtectionIntroduced a new ModSecurity rule to protect against a specific RCE vulnerability in Magento (versions 1.9.1.0 CE and 1.14.1.0 EE). Instructed users to enable the 'CloudFlare Magento' Group in WAF Settings and download the SUPEE-5344 patch from Magento.
  721. Of Phishing Attacks and WordPress 0daysThis post details the analysis and neutralization of a phishing campaign that utilized compromised WordPress sites and a zero-day vulnerability. It describes the phishing email's structure, the compromised landing pages hosted on Bluehost, and the various URL obfuscation techniques employed by attackers (image maps, misspelled domains, homoglyphs, reflection, redirection, javascript, Punycode). The post also highlights the discovery of a critical cross-site scripting vulnerability in WordPress 4.1.1, which was likely exploited in the attack. Cloudflare's collaboration with Bluehost in responding to compromised sites is also mentioned.
  722. Protection against critical Windows vulnerability (CVE-2015-1635)Introduced a new WAF rule to automatically block requests exploiting MS15-034 (CVE-2015-1635) by inspecting HTTP Range headers. This provides immediate protection for paid plan customers with WAF enabled against this specific DoS/RCE vulnerability.
  723. OpenSSL Security Advisory of 19 March 2015This post details Cloudflare's immediate response to multiple OpenSSL vulnerabilities discovered in March 2015. It highlights Cloudflare's process of analyzing the vulnerabilities, determining their impact (primarily Denial of Service rather than information disclosure for Cloudflare's infrastructure), and rapidly deploying patches to their production environment. It also emphasizes the importance of such timely updates for maintaining the security of the internet infrastructure and encourages customers to do the same.
  724. No upgrade needed: CloudFlare sites already protected from FREAKThis post highlights Cloudflare's proactive security measures against the FREAK vulnerability by not supporting weak 'export grade' cryptography and maintaining updated OpenSSL versions. It reinforces their ongoing commitment to disabling outdated protocols and ciphers (like SSLv3 and RC4) and adopting modern, secure ones (like ChaCha-Poly, forward secrecy, and elliptic curves).
  725. Protecting web origins with Authenticated Origin PullsThis post introduces TLS Client Authentication (Authenticated Origin Pulls) as a mechanism for origin servers to verify that requests are coming from Cloudflare. This is achieved by configuring the origin server to only accept requests with a valid client certificate issued by Cloudflare. The post details the implementation of this feature by adding support to nginx and provides the Cloudflare origin-pull certificate. It also outlines the opt-in process for customers via the new dashboard.
  726. Enforce Web Policy with HTTP Strict Transport Security (HSTS)This post introduces HTTP Strict Transport Security (HSTS) as a new feature for Cloudflare customers. It explains HSTS's purpose in preventing downgrade attacks, details its configurable parameters (max-age, includeSubDomains), and outlines the process for enabling it via the new beta dashboard. The post emphasizes the importance of a stable HTTPS configuration before enabling HSTS due to its browser-cached policy.
  727. Universal SSL: Encryption all the way to the origin, for freeThis post announces the public beta of Cloudflare's Origin CA service, which provides free, limited-function certificates for customer origin servers. This enables full encryption of traffic from the browser to the origin server, complementing the existing Universal SSL feature. It details the three SSL modes (Flexible, Full, Strict), explains the creation and validation process for Origin CA certificates, and provides instructions on how to create Certificate Signing Requests (CSRs) using CFSSL.
  728. TLS Session Resumption: Full-speed and SecureThis post details Cloudflare's implementation of TLS session resumption (both Session IDs and Session Tickets) to improve the performance of Universal SSL. It explains the technical challenges of sharing session data across multiple hosts within a Point of Presence (PoP) and Cloudflare's solutions using memcached for Session IDs and a secure, rotated key distribution system for Session Tickets. The post highlights the performance benefits of session resumption, reducing handshake costs and improving user experience, especially for mobile users.
  729. Do the ChaCha: better mobile performance with cryptographyThis post introduces the adoption of ChaCha20-Poly1305 cipher suites to improve mobile performance and security. It highlights the limitations of existing ciphers like AES for mobile devices and explains how ChaCha20-Poly1305 offers a faster and more battery-efficient alternative. The post details the security benefits of these new algorithms, their performance advantages, and Cloudflare's intelligent client-based selection of cipher suites.
  730. End of the road for RC4This post details the complete disabling of the RC4 encryption algorithm for all SSL/TLS connections to Cloudflare sites. It explains the phased approach taken over the past year, including disabling it for TLS 1.1 and above, and then deprecating it. The post highlights the remaining use cases for RC4 (old mobile phones, Windows XP, and SSL-intercepting proxy software) and the rationale for its complete removal due to security vulnerabilities, even for the remaining small percentage of connections.
  731. SSL Week Means Less Weak SSLThis post announces 'SSL Week' and highlights Cloudflare's ongoing commitment to improving encryption on the internet. It details efforts to make encryption easy, fast, and secure, including the rollout of Universal SSL, making connections to origin servers secure and cryptographically verifiable, and the addition of new, faster ciphers while deprecating older, less secure ones.
  732. Flexible SSL & Wordpress: Fixing “Mixed Content” ErrorsIntroduced protocol rewriting in the Cloudflare WordPress plugin to automatically change HTTP asset links to relative protocols (e.g., `//www.example.com/...`). This resolves "Mixed Content" errors for websites using Flexible SSL, where the connection between the visitor and Cloudflare is HTTPS, but between Cloudflare and the origin server is HTTP. Recommended adding a page rule to redirect all HTTP traffic to HTTPS for comprehensive security.
  733. DDoS Packet Forensics: Take me to the hex!This post contributes to website security by detailing the forensic analysis of a DDoS attack. It uncovers specific, non-obvious relationships between packet fields (TTL, source IP, DNS ID, and IPv4 ID) used by attackers, demonstrating a sophisticated method of spoofing and potentially generating source IPs. This deep dive into packet-level manipulation enhances the understanding of attack vectors and informs the development of more advanced threat detection mechanisms.
  734. CloudFlare in 2014: Bigger, Faster, SecurerThis post details Cloudflare's significant security advancements in 2014, including the introduction of Strict SSL mode, proactive protection against Heartbleed and Shellshock vulnerabilities, the revocation and reissuance of all SSL certificates, the removal of RC4 cipher support, achieving PCI certification, and the landmark launch of Universal SSL, making SSL free for all customers. It also highlights the introduction of Keyless SSL, enhancing customer control over private keys.
  735. Kyoto Tycoon Secure ReplicationThis post details the integration of mutually-authenticated TLS encryption into Kyoto Tycoon, a key-value store used by Cloudflare for replicating sensitive data between data centers. This enhancement protects data in transit over the public internet, preventing eavesdropping and modification by securing the replication pipeline for critical information like session ticket keys and DNS data.
  736. CloudFlare and SHA-1 CertificatesThis post details Cloudflare's proactive response to upcoming browser policy changes (Chrome and Firefox) deprecating SHA-1 certificates. It explains the technical implications of SHA-1 vs. SHA-2, the compatibility challenges with older operating systems like Windows XP SP2, and Cloudflare's strategy to manage this by issuing SHA-1 certificates expiring before 2016 for paid customers and SHA-2 for free customers. It also outlines a future plan to offer SNI certificates with SHA-1 fallback for paid customers to maximize reach and security.
  737. Drupal 7 SA-CORE-2014-005 SQL Injection ProtectionThis post details the immediate mitigation of a critical Drupal 7 SQL injection vulnerability (SA-CORE-2014-005) through Cloudflare's Web Application Firewall (WAF) ruleset (Rule D0002). It emphasizes that WAF protection is a temporary measure and strongly advises users to upgrade Drupal to the patched version (7.32) to address potential compromises.
  738. SSLv3 Support Disabled By Default Due to POODLE VulnerabilityThis post details Cloudflare's immediate response to the POODLE vulnerability affecting SSLv3. It outlines the decision to disable SSLv3 by default across the network, provides statistics on SSLv3 usage to assess impact, and discusses the technical mitigation strategies being explored, such as implementing fallback SCSV to prevent downgrade attacks. It also highlights the availability of an override option for Business and Enterprise customers.
  739. Automatic protection for common web platformsThis post introduces the concept of platform-specific WAF rulesets for common web platforms (WordPress, Drupal, Plone, WHMCS, Joomla). It explains that enabling these rulesets provides automatic protection against newly discovered vulnerabilities as Cloudflare pushes updates to them. It highlights the ease of enabling these rulesets via a simple ON/OFF button in the WAF Settings and references previous automatic rollouts for Heartbleed and Shellshock.
  740. Universal SSL: How It ScalesThis post details the technical advancements enabling Cloudflare's Universal SSL, which scaled HTTPS adoption to millions of sites. It highlights the use of modern hardware with cryptographic instructions (AES-NI, CLMUL), modern cryptographic algorithms (ECDSA, ECDHE) for faster handshakes, session resumption techniques (session tickets and IDs) for returning visitors, and lazy loading of certificates to manage dynamic configurations at scale. These optimizations reduced the CPU cost of SSL to near zero, making widespread HTTPS deployment feasible.
  741. Inside Shellshock: How hackers are using it to exploit systemsThis post details Cloudflare's immediate response to the Shellshock vulnerability, including the rollout of WAF protection for Pro, Business, and Enterprise customers, followed by protection for Free plan customers. It analyzes attack vectors, sources, and common exploitation techniques (e.g., arbitrary code execution via User-Agent, data exfiltration via `cat /etc/passwd` or email, reconnaissance via `ping` or `wget`). It highlights the technical details of how the vulnerability works by passing environment variables into bash and the importance of patching bash itself.
  742. Universal SSL: Be just a bit more patientThis post details the rollout of Cloudflare's Universal SSL feature, highlighting the challenges and progress in deploying SSL certificates to millions of websites. It explains the phased approach, expected delays, and potential certificate mismatch errors users might encounter during the provisioning process. The post also outlines how Cloudflare is tracking progress and communicating updates to customers, and provides examples of sites with Universal SSL enabled, noting the potential for mixed content warnings and Cloudflare's future plans to address them.
  743. Origin Server Connection Security with Universal SSLThis post introduces Universal SSL, enabling HTTPS support for all sites by default. It details two primary methods for securing the connection between Cloudflare and origin servers: Full SSL using self-signed certificates and Strict SSL using certificates from trusted Certificate Authorities. It also previews a future Cloudflare Origin CA and certificate pinning feature.
  744. Introducing Universal SSLThis post announces the launch of Universal SSL, a groundbreaking initiative that automatically provisions SSL certificates for all Cloudflare customers, including those on the free plan. This significantly expands HTTPS adoption, doubling the number of SSL-enabled sites on the internet at the time. It addresses technical challenges related to CPU load and IPv4 exhaustion by leveraging modern browser features like ECDSA and SNI, and also promotes the adoption of modern browsers and operating systems. Furthermore, Universal SSL enables broader support for performance-enhancing protocols like SPDY and contributes to Cloudflare's mission of a more secure and open internet.
  745. Shellshock protection enabled for all customersThis post announces the automatic rollout of basic Shellshock protection for all Cloudflare customers (Free, Pro, Business, and Enterprise) through the WAF, in addition to the enhanced protection already provided to paying customers. This extends the website security and threat management capability to cover a critical new vulnerability.
  746. Bash vulnerability CVE-2014-6271 patchedThis post details Cloudflare's immediate response to the critical CVE-2014-6271 (Shellshock) vulnerability in Bash. It describes the internal testing and deployment of a patch across Cloudflare's infrastructure to protect its own servers. Additionally, it highlights the proactive creation and default enablement of a Web Application Firewall (WAF) rule for Pro, Business, and Enterprise customers to protect their servers that may not have been patched. The post also notes the subsequent release of updated Bash packages addressing related vulnerabilities (CVE-2014-7169) and Cloudflare's continued monitoring and patching efforts.
  747. Keyless SSL: The Nitty Gritty Technical DetailsThis post delves into the technical intricacies of TLS handshakes, explaining the RSA and Ephemeral Diffie-Hellman methods. It introduces Cloudflare's 'Keyless SSL' feature, which aims to enhance security by allowing TLS connections without exposing private SSL keys at the edge. This innovation addresses the security risks associated with traditional private key management during TLS handshakes, offering a more robust solution for secure communication.
  748. Announcing Keyless SSL™: All the Benefits of CloudFlare Without Having to Turn Over Your Private SSL KeysThis post introduces Keyless SSL, a novel solution that enables cloud-based SSL termination without requiring Cloudflare to possess customers' private SSL keys. This addresses a critical security concern for financial institutions and enterprises, allowing them to benefit from Cloudflare's scalable network while maintaining strict control over their sensitive cryptographic material. The post details the genesis of the idea, the initial prototype, and the subsequent engineering effort to make it production-ready, highlighting its impact on SSL termination speed and security.
  749. DIY Web Server: Raspberry Pi + CloudFlareThis post describes a user's project using a Raspberry Pi as a web server and Cloudflare to handle traffic, security, and performance. It details the hardware components (Raspberry Pi, network cable, power supply, SD card) and the software setup (Apache2, with notes on Nginx). The core contribution is demonstrating how Cloudflare's services can enable a low-power, low-cost device to host a website by offloading traffic management, security, and performance optimization.
  750. Google Now Factoring HTTPS Support Into Ranking; CloudFlare On Track to Make it Free and EasyThis post marks a significant milestone in Cloudflare's commitment to website security by addressing the widespread adoption of HTTPS. It highlights Google's new ranking signal for HTTPS, providing a strong incentive for websites to adopt secure connections. Crucially, Cloudflare announces a technical breakthrough in 'lazy loading' SSL certificates, overcoming a major hurdle to offering free and easy HTTPS support to all customers, with a rollout planned for mid-October. This innovation is poised to dramatically increase the number of HTTPS-enabled websites.
  751. Introducing CFSSL - CloudFlare's PKI toolkitThis post introduces CFSSL, Cloudflare's open-source Public Key Infrastructure (PKI) toolkit. CFSSL is used internally for TLS/SSL certificate bundling and Certificate Authority (CA) infrastructure, and is now open-sourced to help website operators create correct certificate bundles more easily. It addresses the pain points of certificate bundling, balancing performance, security, and compatibility by helping users select the optimal certificate chain for maximum browser compatibility. The post details how CFSSL works, its use as a web service with a JSON API, and its role in Cloudflare's own HTTPS service.
  752. Introducing the BPF ToolsThis post introduces Cloudflare's open-sourced BPF Tools, designed for high-performance packet filtering to combat large-scale DDoS attacks. It details how these tools, including `pcap2hex`, `parsedns`, `bpfgen`, `filter`, and `iptables_bpf`, can be used to analyze pcap files, generate BPF bytecode for specific traffic patterns (like DNS floods targeting subdomains), verify the bytecode, and deploy it via iptables rules. The contribution highlights the practical application of BPF for dropping malicious traffic at the iptables level before it impacts application servers, with a focus on DNS traffic and the ability to match IPv6 packets, perform suffix matching, and handle case-insensitive domain matching.
  753. New OpenSSL vulnerabilities: CloudFlare systems patchedThis post highlights Cloudflare's immediate patching of its systems against newly discovered OpenSSL vulnerabilities, specifically CVE-2014-0224 (CCS Injection). It demonstrates Cloudflare's proactive approach to system-level security and its ability to protect customers from critical, widespread threats by applying patches across its infrastructure.
  754. BPF - the forgotten bytecodeThis post introduces the Berkeley Packet Filter (BPF) as a powerful and flexible mechanism for packet filtering within the kernel. It details how BPF, originally developed for `tcpdump`, has evolved and is now utilized by Cloudflare for advanced threat management. Specifically, it highlights the use of the `xt_bpf` iptables module to apply custom BPF bytecode for precisely matching and dropping malicious traffic, such as DNS queries for specific domains or subdomains, and demonstrates its effectiveness in handling massive packet floods.
  755. The Web is World-Wide, or who still needs RC4?This post details Cloudflare's ongoing efforts to deprecate the RC4 encryption protocol due to its known vulnerabilities. It analyzes the remaining usage of RC4, identifying specific user agents, devices (older phones, browsers like IE 5.01, iCab), and geographic regions where it's still prevalent. The post also highlights the unexpected use of RC4 in transparent SSL proxies within large institutions, explaining the technical reasons behind its continued necessity for certain legacy systems and the challenges in fully deprecating it.
  756. Killing RC4: The Long GoodbyeThis post details Cloudflare's proactive decision to deprecate the RC4 cipher for HTTPS connections, prioritizing stronger encryption methods like AES-GCM and AES-CBC. It explains the historical context of RC4's temporary rise due to the BEAST attack and the subsequent discovery of RC4's inherent weaknesses, making it a liability for long-term data security. The post highlights the technical shift in cipher preference and provides data on the minimal impact of this change, demonstrating Cloudflare's commitment to staying ahead of cryptographic vulnerabilities.
  757. Tracking our SSL configurationThis post details Cloudflare's proactive approach to managing and evolving its SSL/TLS configuration in response to emerging security threats. It introduces a new mechanism for tracking these changes via a GitHub repository (sslconfig) and highlights specific security vulnerabilities addressed, such as Lucky 13, BEAST, and RC4 biases. The post also emphasizes the adoption of advanced cryptographic techniques like ECDSA and Perfect Forward Secrecy to enhance customer security.
  758. Searching for The Prime Suspect: How Heartbleed Leaked Private KeysThis post details the technical analysis of the Heartbleed vulnerability, specifically how it exposed private SSL keys by allowing attackers to extract prime numbers used in RSA encryption. It explains the underlying RSA and Montgomery Reduction algorithms, and through memory instrumentation, demonstrates how OpenSSL versions vulnerable to Heartbleed left copies of these prime numbers in memory. The post also contributes proposed patches to OpenSSL to address these memory management issues, enhancing the security of SSL/TLS implementations.
  759. The Hidden Costs of HeartbleedThis post highlights the significant hidden costs and infrastructure burden associated with SSL certificate revocation, specifically in the context of the Heartbleed vulnerability. It details the technical mechanisms of OCSP and CRL, quantifies the bandwidth and financial costs for Certificate Authorities (CAs) during mass revocations, and emphasizes Cloudflare's capability to absorb and manage this load, thereby enabling faster responses to security threats.
  760. The Heartbleed Aftermath: all CloudFlare certificates revoked and reissuedThis post details Cloudflare's response to the Heartbleed vulnerability, including the immediate patching of their systems, the investigation into potential private key compromise, and the subsequent mass revocation and reissuance of all SSL certificates they manage. It also provides a technical deep-dive into how the Heartbleed vulnerability worked, explaining the memory leakage of private keys and RSA cryptosystem components, and highlights the winners of the Cloudflare Challenge to find the private key.
  761. Certificate Revocation and HeartbleedThis post addresses the critical security implications of the Heartbleed vulnerability, specifically focusing on certificate revocation and its effectiveness. It details how Cloudflare revoked its own certificate and highlights the varying browser behaviors when encountering revoked certificates, emphasizing the importance of robust revocation checking mechanisms. The post also discusses the surge in certificate revocations due to Heartbleed and encourages users to revoke and rekey their certificates if vulnerable.
  762. The Results of the CloudFlare ChallengeThis post details the results of the Cloudflare Challenge, where the community was tasked with stealing a private key from a vulnerable Nginx server using the Heartbleed exploit. It highlights the effectiveness of community-driven security research and emphasizes the ongoing danger posed by such vulnerabilities, reinforcing the need for robust threat management.
  763. Answering the Critical Question: Can You Get Private SSL Keys Using Heartbleed?This post details the discovery and impact of the Heartbleed vulnerability, a critical bug in OpenSSL that could potentially expose server memory, including private SSL keys. Cloudflare's engineers investigated the exploit's ability to extract private keys, initially believing it to be impossible due to their specific NGINX and OpenSSL configurations. They launched a public challenge to test this hypothesis and, upon confirmation that private keys could indeed be extracted, initiated a mass reissue and revocation of customer SSL keys. The post also provides a technical explanation of the Heartbleed bug and how memory allocation on the heap can influence the exploit's effectiveness.
  764. Jetpack for WordPress: automatic protectionThis post details the automatic protection provided by Cloudflare's Web Application Firewall (WAF) against a newly discovered security flaw in the Jetpack plugin for WordPress (CVE-2014-0173). A WAF rule was automatically deployed to all Cloudflare customers, including free tier users, to mitigate this vulnerability. While users are still advised to update Jetpack to version 2.9.3, the WAF rule provides immediate protection against potential exploitation.
  765. Staying ahead of OpenSSL vulnerabilitiesThis post highlights Cloudflare's proactive approach to security by patching the Heartbleed vulnerability in OpenSSL before it was publicly disclosed. It demonstrates their responsibility in managing critical cryptographic libraries used for SSL/TLS connections and their commitment to protecting customer sites through rapid fixes and responsible disclosure practices.
  766. What do you do when the world’s attention is on you?This post highlights the critical role of Cloudflare in protecting high-profile, high-traffic events from DDoS attacks and other web threats. It showcases the immediate implementation and effectiveness of Cloudflare's security measures in handling a 10x spike in traffic for livestreamed interviews of Julian Assange and Edward Snowden, demonstrating its ability to secure and accelerate content for major global events.
  767. WordPress Pingback Attacks and our WAFThis post details the use of Cloudflare's Web Application Firewall (WAF) to block WordPress pingback attacks. It explains how attackers exploit the XML-RPC endpoint and the pingback mechanism to trigger HTTP requests to victim sites, effectively turning WordPress sites into attack vectors. The post highlights two specific WAF rules: WP0001 "WordPress Pingback Blocker" and rule 100000 "WordPress Numbers Botnet," which address the pingback abuse and the use of mutating query strings, respectively. It also mentions the existence of a WordPress-specific ruleset and the Cloudflare WordPress plugin.
  768. Cloudflare Acquires StopTheHackerThis post announces the acquisition of StopTheHacker, an anti-malware firm, by Cloudflare. The acquisition aims to integrate StopTheHacker's malware scanning and remediation capabilities into Cloudflare's platform. Key technical contributions include the ability to provide immediate patching services for malware and vulnerabilities, and leveraging Cloudflare's infrastructure for more frequent and thorough scans. This enhances Cloudflare's existing website security and threat management offerings by adding proactive malware detection and remediation.
  769. Good News: Vulnerable NTP Servers Closing DownThis post details Cloudflare's experience with a large-scale DDoS attack utilizing vulnerable NTP servers and their subsequent efforts to encourage network administrators to patch these vulnerabilities. It showcases Cloudflare's role in identifying and mitigating widespread internet threats, contributing to a more secure internet ecosystem beyond their direct WAF product. The post highlights the success of their outreach in reducing the number of vulnerable NTP servers.
  770. Introducing Strict SSL: Protecting Against a On-Path Attack on Origin TrafficIntroduced 'Full SSL (Strict)' mode, which adds origin server certificate validation to the existing Full SSL option. This new mode prevents on-path attacks by ensuring that Cloudflare validates the certificate chain presented by the web server against its own list of trusted certificate authorities. Changes were upstreamed to nginx to enable origin certificate validation and support SNI for multiple domains behind the same IP over TLS.
  771. Technical Details Behind a 400Gbps NTP Amplification DDoS AttackThis post details a significant 400Gbps NTP amplification DDoS attack mitigated by Cloudflare, highlighting it as a major new threat. It explains the mechanics of NTP amplification attacks, the scale and global distribution of this specific attack, and Cloudflare's efforts to work with network operators to address vulnerable NTP servers. It also touches upon the broader context of amplification attacks and emerging threats like SNMP amplification.
  772. Killing RC4 (softly)This post addresses the evolution of TLS security by detailing the deprecation of RC4 cipher suites for TLS v1.1 and above. It explains the historical context of preferring RC4 to mitigate BEAST attacks, the subsequent discovery of RC4 vulnerabilities, and the challenge of selectively disabling RC4 due to limitations in open-source web servers. Cloudflare's contribution is a patch for OpenSSL that allows RC4 to be used only for TLS v1.0 connections, while disabling it for newer, more secure protocols, thereby improving overall website security and SSL Labs ratings.
  773. Protect Your Sites With Rapidly Deployed WAF RulesThis post details the rapid deployment of custom Web Application Firewall (WAF) rules to protect specific customers and address widespread threats. It showcases examples of custom rules written to block botnets targeting specific URLs with randomized query strings, "Anonymous" attacks, and POST requests to non-existent URLs. It also highlights the deployment of global rules to protect against zero-day exploits like the WHMCS vulnerability. The WAF's custom rule language and rapid deployment capability (under 30 seconds) are emphasized as key features for responding to attacks.
  774. Understanding and mitigating NTP-based DDoS attacksThis post introduces NTP-based DDoS attacks as a new threat vector, explaining their mechanism of reflection and amplification. It details how the NTP protocol, specifically the 'monlist' command, can be exploited for these attacks. The post also provides guidance on how to mitigate these attacks by configuring NTP servers and firewalls, and by implementing BCP-38 to prevent source IP spoofing. Cloudflare's role in defending against these attacks is highlighted.
  775. How the NSA (may have) put a backdoor in RSA’s cryptography: A technical primerThis post delves into the technical details of cryptographic backdoors, specifically focusing on the Dual_EC_DRBG algorithm and how a pseudo-random number generator can be intentionally weakened. It explains the concept of backdoors, the importance of unpredictable random number generation for security (especially in SSL/TLS), and illustrates how elliptic curves can be manipulated to create predictable outputs. The post highlights the risks associated with proprietary or un-auditable cryptographic components and implicitly advocates for transparency and open-source solutions in security.
  776. A (Relatively Easy To Understand) Primer on Elliptic Curve CryptographyThis post introduces Elliptic Curve Cryptography (ECC) as a key technology used by Cloudflare for securing HTTPS connections and internal data center communications. It explains ECC as a next-generation public-key cryptography system that offers significantly more security than RSA with smaller key sizes, making it ideal for performance-sensitive applications and devices with limited computational power. The post contrasts ECC with RSA by explaining the underlying mathematical principles and the limitations of RSA's trapdoor function (factoring) in the face of increasing computational resources, positioning ECC as a more sustainable and secure cryptographic foundation.
  777. Patching a WHMCS zero day on day zeroThis post details the addition of a Web Application Firewall (WAF) ruleset to block a specific zero-day vulnerability affecting WHMCS. It recommends enabling this ruleset for hosting partners using WHMCS behind Cloudflare's WAF and advises applying the official WHMCS patch or updating to version 5.2.8.
  778. Ensuring Randomness with Linux's Random Number GeneratorThis post contributes to the Website Security & Threat Management thread by detailing the critical role of a robust random number generator for secure systems. It explains how Cloudflare relies on Linux's kernel entropy pool, its mechanisms for gathering and mixing entropy (timestamps, XOR), and the use of cryptographic hash functions (SHA-1) to generate high-entropy random numbers essential for SSL connections and other cryptographic operations. It also highlights the importance of monitoring entropy levels to maintain security guarantees.
  779. Why some cryptographic keys are much smaller than othersThis post explains the fundamental differences between symmetric and asymmetric cryptography, specifically in the context of TLS connections. It clarifies why symmetric keys (like those used in RC4 and AES) can be relatively short (e.g., 128-bit or 256-bit) because their security relies on brute-forcing a large number of random possibilities. In contrast, it details why asymmetric keys (like those used in RSA and ECDHE_RSA) must be much larger (e.g., 2048-bit) due to their reliance on mathematical problems like prime factorization, which have more efficient attack vectors. This understanding is vital for configuring and managing secure web traffic.
  780. Why secure systems require random numbersThis post significantly deepens the understanding of the foundational security mechanisms underpinning Cloudflare's offerings by explaining the critical importance of random number generation in secure systems. It details how vulnerabilities in pseudo-random number generators (PRNGs) can be exploited, using the Hacker News session ID vulnerability as a prime example. The post also outlines the role of random numbers in various cryptographic protocols like SSL/TLS and WPA2, and introduces Cloudflare's initiative to improve its own random number generation by incorporating truly random data sources to enhance customer security.
  781. CloudFlare's new WAF: compiling to LuaThis post details the technical implementation of Cloudflare's new Web Application Firewall (WAF) which is written in Lua and embedded within Nginx using the HttpLuaModule. It describes the compilation process of WAF rules from mod_security and a new Cloudflare rule language into Lua code, including optimizations like clause reordering and regex simplification. The post also highlights the use of performance analysis tools like lulip and flame graphs to identify and address bottlenecks, leading to a median WAF decision time under 1ms. It also mentions the use of local variables, memoization, and caching for further optimization.
  782. Heuristics and Rules: Why We Built a New Old WAFThis post details the rationale and technical approach behind augmenting Cloudflare's heuristic-based Web Application Firewall (WAF) with a traditional, rules-based WAF. It explains the historical limitations of rules-based systems (like SpamAssassin and ModSecurity) and the advantages of heuristic-based approaches. However, it acknowledges the need for rules-based systems for testing, compliance (e.g., PCI), and rapid response to new attack vectors. The new WAF was designed to be user-configurable, accept ModSecurity rule sets, add less than 1ms of latency, update globally within 30 seconds, provide feedback on triggered rules, and scale to handle billions of requests. The post also mentions rearchitecting some security systems for more visibility and flexibility.
  783. DDoS Prevention: Protecting The OriginThis post elaborates on Cloudflare's DDoS prevention capabilities by explaining how the proxy service shields the origin server from direct attacks. It highlights the critical need to keep the origin IP address secret and provides actionable advice on how to achieve this, including managing subdomains, reviewing DNS records, isolating services, and preventing information disclosure vulnerabilities. This adds a crucial layer of detail to the existing understanding of Cloudflare's threat management by focusing on origin protection strategies.
  784. Staying on top of TLS attacksThis post details Cloudflare's proactive approach to TLS security by reevaluating and configuring ciphersuites to mitigate new attacks against the RC4 cipher. It explains the technical aspects of TLS, ciphersuites, and the importance of forward secrecy, highlighting Cloudflare's preference for ECDHE ciphers and its readiness for TLSv1.2, while acknowledging the ongoing challenges with widespread adoption and the vulnerabilities in commonly used ciphers like RC4 and AES-CBC.
  785. CloudFlare, PRISM, and Securing SSL CiphersThis post addresses concerns about government surveillance programs like PRISM and their potential impact on SSL/TLS security. It explains how Cloudflare's default use of 2048-bit keys and preference for ECDHE cipher suites (which use a different private key for each session) significantly enhances security against potential decryption of historical traffic. The post also discusses the technical feasibility of breaking SSL keys and suggests alternative theories for how surveillance might occur, emphasizing Cloudflare's commitment to trust, security, and transparency.
  786. W3TC and WP Super Cache Vulnerability Discovered, We've Automatically PatchedCloudflare automatically applied a network rule to protect all accounts against a remote code execution vulnerability in W3 Total Cache (versions 0.9.2.8 and below) and WP Super Cache (versions 1.2 and below). The vulnerability, discovered by Sucuri, allows attackers to execute arbitrary PHP code on a server by exploiting functions like mfunc, mclude, and dynamic-cached-content. The post emphasizes the importance of immediate plugin upgrades despite the network-level protection.
  787. Patching the Internet in Realtime: Fixing the Current WordPress Brute Force AttackThis post details the real-time deployment of a WAF rule to detect and block a specific WordPress brute-force attack targeting administrative portals. It highlights Cloudflare's ability to 'patch the Internet in realtime' by automatically rolling out this fix to all customers, including free tier users, demonstrating a rapid response mechanism for emerging security threats.
  788. How the CloudFlare Team Got Into Bondage (It's Not What You Think)This post details the implementation of 'Project Bondage,' which involves port bonding (specifically 802.3ad Dynamic Link Aggregation) and custom IRQ handling on servers. This significantly increases network throughput and improves the ability to handle large SYN flood attacks by intelligently spreading network interrupts across multiple CPU cores and isolating internal LAN traffic from external traffic. This directly enhances Cloudflare's capacity to mitigate sophisticated DDoS attacks and protect customers.
  789. The DDoS that almost broke the InternetThis post details Cloudflare's mitigation of the massive Spamhaus DDoS attack, which peaked at 120Gbps and threatened to disrupt internet infrastructure. It highlights Cloudflare's Anycast technology's ability to absorb such attacks and details how attackers shifted tactics to target Cloudflare's upstream peers and Internet Exchanges (IXs), including LINX, AMS-IX, and DE-CIX. The post emphasizes the scale of the attack, its impact on Tier 1 networks and IXs, and Cloudflare's role in developing best practices to secure IX infrastructure. It also reiterates the critical problem of open DNS recursors as an enabler of these large-scale attacks.
  790. Page Rules Reordering Now AvailableIntroduced the ability to reorder Page Rules by dragging and dropping them in the dashboard, eliminating the need to delete and re-add rules. This simplifies the management of Page Rules, which are applied in the order they appear, with the first matching rule taking precedence.
  791. The DDoS That Knocked Spamhaus Offline (And How We Mitigated It)This post details Cloudflare's mitigation of a massive 75Gbps Layer 3 DDoS attack against Spamhaus, highlighting the use of DNS reflection and ACK reflection techniques by attackers. It showcases how Cloudflare's Anycast network effectively dilutes and absorbs such large-scale attacks, preventing them from reaching the customer's servers. The post also emphasizes the importance of educating network operators to close vulnerabilities like open DNS resolvers, which are a major source of these attacks.
  792. Good Web Security News: Open DNS Resolvers Are Getting ClosedThis post highlights Cloudflare's proactive efforts to combat DDoS amplification attacks by identifying and working with network providers to close open DNS resolvers. It demonstrates a shift from solely absorbing attacks to addressing their underlying causes, contributing to a more secure internet infrastructure. The post also showcases the positive impact of Cloudflare's 'name-and-shame' approach and its partnerships with organizations like Team Cymru and SoftLayer in achieving this goal.
  793. When the Attackers Name Malware After You, You Know You're Doing Something RightThis post details the evolution of Cloudflare's 'I'm Under Attack' Mode (IUAM). It highlights how the initial simple math challenge was reverse-engineered by malware named 'OutFlare', prompting Cloudflare to immediately deploy an updated, more complex version. The post also introduces the concept of 'proof of work' challenges, inspired by Bitcoin, as a future enhancement to combat sophisticated attacks, emphasizing Cloudflare's advantage in real-time updates and adaptation within its cloud service.
  794. Facebook Bug Redirects the Web Through Javascript Widget ErrorThis post details how a bug in Facebook's Connect script caused widespread website redirects, highlighting the risk of JavaScript widgets acting as single points of failure. It explains how Cloudflare's Rocket Loader feature, an on-page JavaScript optimizer with failsafes, and the Cloudflare Apps Program, which ensures apps are performant and centrally manageable, help mitigate such risks by preventing misbehaving widgets from hijacking sites and causing outages.
  795. New "Lucky Thirteen" SSL Vulnerabilities: CloudFlare Users ProtectedThis post details Cloudflare's proactive protection against the 'Lucky Thirteen' SSL vulnerability, which was announced shortly after Cloudflare received early notification. It highlights Cloudflare's default SSL configuration's inherent protection by deprioritizing vulnerable ciphers, and provides recommendations for users to secure their own servers by upgrading OpenSSL and prioritizing RC4 ciphers.
  796. What We Just Did to Make SSL Even FasterThis post details Cloudflare's efforts to significantly improve SSL/TLS handshake performance. It describes the implementation of OCSP stapling and, more importantly, the development of an automated system for intelligently bundling SSL certificates. This system optimizes certificate chains by finding the shortest, most ubiquitous, and secure path from a user-uploaded certificate to a trusted root, reducing data transmission and improving connection speeds. Cloudflare also committed to sharing their findings and tools, like an intermediate certificate directory and an SSL bundler, with the wider community.
  797. Choosing a Two-Factor Authentication SystemThis post details Cloudflare's exploration and adoption of two-factor authentication (2FA) to enhance account security. It highlights the decision to implement Time-based One-time Password (TOTP) based solutions, specifically favoring Authy over alternatives like SMS or Google Authenticator due to security concerns (e.g., carrier network insecurity, Google's past flaws, inability to revoke tokens, sync issues, and cumbersome phone upgrades). The post emphasizes Authy's superior implementation, including better token revocation, clock synchronization, seamless phone upgrades, and stronger cryptographic standards, ultimately leading to the rollout of 2FA as a feature for all customers.
  798. Two-factor Authentication Now AvailableThis post introduces two-factor authentication (2FA) as a new layer of account security for Cloudflare customers. It details the integration with Authy to provide a free, mobile-based token generation service, significantly enhancing login security beyond just email and password.
  799. CloudFlare Works with GlobalSign to Make SSL Faster Across the WebThis post details Cloudflare's partnership with GlobalSign to significantly improve SSL performance by caching OCSP and CRL requests. This initiative reduces the latency of SSL certificate validation from an average of 500ms to under 100ms, saving approximately 1.5 years of time daily across the web. This directly contributes to making HTTPS connections faster and promotes the adoption of secure protocols like SPDY, aligning with Cloudflare's mission to create a faster and safer internet.
  800. What Happens When a Hurricane Hits the WebThis post details Cloudflare's infrastructure resilience during Hurricane Sandy, highlighting the robustness of its data centers against power outages and network failures. It showcases how the network automatically rerouted traffic around undersea cable failures and how the 'Always Online' feature served static content when origin servers were impacted. The post also notes the minimal impact on traffic to Cloudflare's own data centers in the affected region, suggesting that users with connectivity remained highly engaged.
  801. Deep Inside a DNS Amplification DDoS AttackThis post provides a deep dive into DNS amplification DDoS attacks, explaining their mechanics and how they leverage open DNS resolvers to amplify traffic. It highlights how Cloudflare's global network and wholesale bandwidth purchasing model inherently protect it and its customers from such attacks, as the distributed nature of the network dilutes the attack's impact and the cost model prevents bandwidth overages from being a concern. The post also contrasts these modern amplification attacks with older SMURF attacks, showcasing the evolution of threat vectors and Cloudflare's ability to adapt.
  802. OCSP Stapling: How CloudFlare Just Made SSL 30% FasterThis post introduces OCSP Stapling as a significant performance enhancement for SSL connections. It explains the overhead associated with traditional OCSP/CRL checks for certificate revocation and details how OCSP Stapling reduces this overhead by 'stapling' the OCSP response to the SSL handshake, making HTTPS connections approximately 30% faster. Cloudflare's network-wide implementation of this feature is highlighted as a key contribution to making SSL adoption more appealing.
  803. Post Mortem: What Yesterday's Network Outage Looked LikeThis post details a significant network outage caused by a misapplied network rate limit during a large DDoS attack. It highlights the challenges of manual mitigation during high-traffic events and underscores the importance of automated systems and rigorous testing for network changes to prevent future disruptions and ensure reliability.
  804. Saturday Night Fever: Layer 7 attacks against CloudFlare sitesThis post details the nature and prevalence of Layer 7 Distributed Denial of Service (DDoS) attacks against Cloudflare sites. It highlights that these attacks, while less common in terms of originating IP addresses, constitute the vast majority of DoS attacks. The post analyzes attack patterns by day of the week, time of day, and across the year, identifying specific trends and dips. It also provides insights into the geographical origins of these attacks and the types of networks commonly used. The post underscores Cloudflare's ongoing efforts to defend against these sophisticated attacks and its mission to keep customer websites online.
  805. Mars Attacks!This post analyzes attack statistics from July 2012, highlighting that a significant portion of attacks originate from 'Martian IP addresses' (invalid on the public internet, often due to spoofing or internal network usage). It details the mechanics of IP spoofing and explains how reflection attacks, particularly DNS amplification, are used to amplify attack bandwidth and obscure the true source. The post emphasizes that source IP addresses in Layer 3/4 attacks are often unreliable, contributing to Cloudflare's understanding of threat landscapes.
  806. Always Online v.2This post introduces Always Online v.2, a significant improvement to the "Always Online" feature. It details the history of the feature, explaining its accidental origin from bot caching strategies and its initial limitations due to reliance on search engine crawlers. The post announces the release of v.2, which addresses these limitations by implementing an active crawling mechanism to build and maintain the cache, ensuring greater reliability when origin servers are down. It also outlines the different crawl frequencies for various customer plans and hints at future user control over caching.
  807. The Wednesday Witching Hour: CloudFlare DoS StatisticsThis post provides a detailed statistical analysis of Denial of Service (DoS) attacks targeting Cloudflare's network in 2012. It highlights the timing of these attacks (peaking mid-week and during US night hours), the protocols used (UDP and TCP), common attack vectors (SYN flooding, DNS and SNMP reflection), and the increasing intensity of attacks through methods like 'carpet bombing'. It also notes the emergence of 'booter' websites for short-duration attacks and the adaptation of attackers to other methods beyond simple DoS. The post underscores the continuous nature of these threats and Cloudflare's ongoing efforts to combat them.
  808. Protecting CloudFlare sites from phishingThis post details the initial implementation of a process to identify and block phishing URLs hosted on Cloudflare sites. It describes the manual process of notifying site owners and serving a warning page, and outlines the benefits of this new anti-phishing process for site visitors and owners. It also provides steps for site owners to protect their sites from future hacks and phishing attempts, and instructions on how to report phishing pages on the Cloudflare network.
  809. Dome9 + CloudFlare = Combined Security For Your Website and Web ServerThis post introduces an integration with Dome9, a third-party security service, to enhance server firewall management. It details how Dome9's 'Magic IPs' feature can be used to create security policies that allow traffic only from Cloudflare's IP addresses to specific ports (80, 443) on the origin server. It also explains how Dome9 can be used to restrict access to other administrative services (SSH, phpMyAdmin) to on-demand access, improving the overall security posture of the web server.
  810. A note about Kerckhoff's PrincipleThis post introduces and explains Kerckhoff's Principle, emphasizing that security systems should rely on the strength of their algorithms and the secrecy of keys, not on the obscurity of their design. It applies this principle to Cloudflare's password storage practices, highlighting the use of bcrypt and random salts as secure methods that do not require secrecy of the system's details.
  811. Keeping passwords safe by staying up to dateThis post significantly deepens the understanding of website security by focusing on the critical aspect of password storage. It explains the evolution of password security from insecure plain text and basic hashing to more robust methods like salted hashing and finally introduces bcrypt as a solution for future-proofing against increasingly sophisticated password cracking techniques. It highlights the importance of both secure storage algorithms and strong user passwords.
  812. Taming BEAST: Faster, Safer SSL now on CloudFlareThis post addresses the BEAST SSL attack by implementing TLS 1.1 and 1.2, and prioritizing RC4 cipher suites across the Cloudflare network. It also enhanced SSL cipher support, leading to a 30% improvement in SSL performance and achieving a 90 (A) score from SSL Labs, surpassing major websites.
  813. CloudFlare & OpenDNS Work Together to Help the WebThis post introduces the "Visitor DNSChanger Detector App," a proactive security measure developed by Cloudflare. This app, deployable via the Cloudflare Apps marketplace or as open-source JavaScript, identifies users whose systems are infected with DNSChanger malware and are using compromised DNS servers. It informs these users about their infection and directs them to resources for remediation, thereby preventing potential internet access loss and protecting them from malicious redirection. This initiative highlights Cloudflare's role in broader internet health and user safety, extending beyond direct website security to address systemic threats.
  814. CloudFlare —WebOps for everyoneThis post introduces Cloudflare's foundational WebOps capabilities, covering security, metrics, acceleration, reach, and transformation. It highlights automated attack blocking, DDoS mitigation, one-click SSL enablement, and content protection against scraping. The service aims to provide enterprise-grade security and performance tools to all website owners, regardless of size, through a simple five-minute configuration change.
  815. Introducing: I'm Under Attack ModeIntroduced 'I'm Under Attack Mode,' a new security level that adds an additional set of protections against potentially malicious HTTP traffic. This mode presents an interstitial page to visitors for approximately 5 seconds while automated security checks are performed, requiring JavaScript and cookies. It is designed to not negatively impact SEO or known legitimate visitors, and data from failed checks is fed back into Cloudflare's system to enhance traditional protections.
  816. ScrapeShield: The scaled up, deep intelligence anti-scraping serviceIntroduced ScrapeShield, a new anti-scraping service that leverages Cloudflare's existing bot profiling intelligence and infrastructure. ScrapeShield builds on the foundation of Project Honeypot, which has been profiling bots since 2004, to detect and alert website owners to content scraping. It also provides insights into how content is consumed off-site (e.g., RSS feeds, translation apps).
  817. Introducing ScrapeShield: Discover, Defend & Deter Content ScrapingIntroduced ScrapeShield, a new app that combines existing features (email obfuscation, hotlink protection) with new capabilities to detect, defend, and deter content scraping. New features include invisible tracking beacons to identify scraped content, automatic blocking of identified scraping bots, and a 'Maze' feature to tie up scraper resources by routing them into a labyrinth of gibberish. Also added a 'no-pinning' option to prevent image pinning.
  818. CloudFlare Now Supporting More PortsThis post addresses a common customer pain point by expanding the range of supported web ports beyond 80 and 443 to include common control panel ports. While these ports are proxied, they do not undergo caching or performance transformations. The post also clarifies why non-web protocols like FTP and SSH cannot be proxied due to the lack of HOST headers, and highlights the security benefit of this limitation. It also mentions that traffic data from attempted attacks on these blocked protocols is fed back into Cloudflare's system for learning.
  819. Post Mortem: The Ugly, the Bad & the GoodThis post details a major incident involving a failed DNS infrastructure update that caused significant downtime for customers. It highlights the challenges of DNS propagation, the impact of external caches (like ISPs), and how concurrent DDoS attacks exacerbated the issue. The post also discusses the immediate response, the process of recovery, and the implementation of new safeguards to prevent similar incidents, particularly focusing on improving DNS update speed and hardening against DNS-directed DDoS attacks.
  820. TODAY Show Traffic Spike No Problem For KhatalandThis post highlights Cloudflare's capability to handle significant traffic surges, specifically for Khataland.com during a TODAY Show promotion. It details how Cloudflare absorbed a large majority of bandwidth usage and protected the site from potential denial-of-service attacks, ensuring the website remained fast, available, and secure. The setup process is described as simple and quick, with immediate positive results in handling over 60,000 views and significant sales within the first hour.
  821. What Is CloudFlare?This post introduces Cloudflare's core functionality, differentiating it from traditional CDNs. It highlights that Cloudflare handles all requests to a website, enabling features like attack stopping, dynamic content modification, application insertion, rich analytics, automatic static content caching, protocol gateway functionality (IPv6 <-> IPv4), and simplified SSL installation. The post positions CDN as a feature of Cloudflare rather than its sole description and seeks community input for a new category name.
  822. Cloudflare Tips: Troubleshooting Common ProblemsThis post provides troubleshooting guidance for common website issues encountered by Cloudflare users. It details how to diagnose server unavailability using `curl`, explains how to access cPanel and FTP when using Cloudflare as a reverse proxy, and addresses potential conflicts with features like Rocket Loader and Auto Minify. It also covers cache management strategies, including the use of Development Mode and cache purging, and emphasizes the importance of allowlisting Cloudflare IPs and installing `mod_cloudflare` for proper logging and IP restoration. Finally, it outlines procedures for reporting Cloudflare-specific issues and temporarily deactivating the service for debugging.
  823. Easiest SSL Ever, Now Included Automatically with Every Paid PlanThis post introduces a significant simplification and enhancement to Cloudflare's SSL offering. Previously a complex, paid add-on requiring manual configuration and waiting periods, SSL is now automatically included with every paid plan at no additional cost. It introduces a 'flexible' SSL mode that encrypts traffic between visitors and Cloudflare's network, making SSL accessible even for platforms that don't support server-side certificate installation. This dramatically lowers the barrier to entry for website security.
  824. Robust, Free DNS FTWThis post introduces Cloudflare's authoritative DNS service, emphasizing its robustness, speed, and free availability. It explains the distinction between recursive and authoritative DNS and highlights how Cloudflare's Anycast-powered DNS, distributed across its global data centers, provides a significant advantage in performance and reliability compared to typical registrar-provided services. This foundational DNS capability is presented as a key enabler for Cloudflare's broader mission of protecting websites.
  825. CloudFlare Tips: 5 Frequently used CloudFlare API callsThis post introduces the Cloudflare API as a tool for customers to programmatically manage their Cloudflare settings. It highlights five frequently used API calls: enabling development mode, purging the cache, pulling basic statistics, reporting spam, and updating the challenge page screen capture. The spam reporting feature is explicitly linked to improving Cloudflare's threat intelligence and making the system smarter for all users.
  826. Globalsign, CloudFlare & Hacking SSLThis post introduces Cloudflare's integration with GlobalSign for SSL certificate issuance and highlights Cloudflare's capability to automatically manage and reissue SSL certificates for its users in the event of a Certificate Authority (CA) compromise. It explains the importance of SSL for encryption and identity validation and discusses the risks associated with compromised CAs, emphasizing Cloudflare's resilience and automated response mechanisms.
  827. Apache Killer Terminated: Zero Day Exploit, Zero Day FixThis post details Cloudflare's rapid response to the 'Apache Killer' zero-day exploit. It highlights how Cloudflare, by analyzing the exploit's mechanism (malformed byte-range headers), was able to implement a network-wide fix within 24 hours, protecting users automatically without requiring any configuration changes. This demonstrates Cloudflare's ability to act as a shield against emerging threats by patching its network edge.
  828. Breaking the Cycle of MalwareThis post introduces Cloudflare's capability to identify and notify users running infected machines, providing them with tools to clean up malware. This is presented as a mechanism to break the 'cycle of malware' by preventing compromised websites from distributing infectious code and by empowering websites to inform their infected users. The security settings (Low, Medium, High) are discussed in the context of challenging visitors with CAPTCHAs.
  829. CloudFlare and SEOThis post details how Cloudflare addressed an issue where search engine crawlers were reducing crawl rates for sites behind Cloudflare due to issues with a single origin server. Cloudflare developed a new technology to automatically change a site's Cloudflare IP addresses to isolate it from other sites when a problem is detected. They also collaborated with search engine crawl teams to ensure Cloudflare's IP ranges were categorized correctly, allowing search engines to crawl at maximum velocity without overburdening origin servers. This resulted in improved SEO rankings and page speed scores for users.
  830. Introducing CloudFlare Apps: Fast, Safe, and One-Click SimpleThis post introduces Cloudflare Apps, a new service that allows users to integrate third-party web applications and widgets into their websites with a single click, without requiring code changes. This directly addresses user concerns about the performance and security risks associated with manual code insertions, enhancing the overall security posture of websites by simplifying the integration of external services and ensuring they are automatically updated.
  831. Using the CloudFlare API to pull visitor IPsThis post introduces the ability for users to query individual visitor IP addresses through the Cloudflare API. This feature allows users to gain insights into traffic origins, identify potential attacks by analyzing IP hit frequency, and proactively add malicious IPs to the Block List via the Threat Control panel. This directly contributes to the community-driven threat intelligence by enabling users to take action against identified threats.
  832. Smarter Web Security, With Your HelpThis post describes the foundational security architecture of Cloudflare, emphasizing a distributed, community-driven approach to threat detection and mitigation. It details the analysis of log data for anomalies like 404 error rates, crawler behavior, known attack signatures, and botnet activity. It also introduces the concept of positive scoring for legitimate user behavior and the feedback loop from user trust/block actions to improve the security engine. The post highlights the careful monitoring of false negative and false positive metrics.
  833. Cloudflare Threat Control: Making your website saferThis post introduces the 'Threat Control' panel within the Cloudflare dashboard, which provides users with insight into malicious traffic targeting their websites. It details the types of threats monitored (spammers, exploit attackers, botnet zombies, email harvesters, bad bots/crawlers), the information displayed for each threat (date, time, IP address, country, status, action), and how to interact with high-priority alerts. It also explains how to manually block or trust IP addresses, IP ranges, and countries via custom rules, and differentiates between challenged visitors and blocked visitors. Recommendations are provided for regular review of the Threat Control panel, including handling allowlisting requests, correcting false positives, and managing dynamic IP addresses.
  834. CloudFlare Guest Blog Post: Steven Nims of Streamline ConsultingThis post details the early benefits of Cloudflare's traffic blocking and acceleration for small businesses. It quantifies the reduction in bad requests (9,000 from 1600 threats), saved visitor browsing time (10.3 days), bandwidth saved (29.9 GB), and improved average page load time (from 2.03s to 1.2s, a 40% improvement). It also mentions the ease of integration via DNS changes and the optional `mod_cloudflare` Apache module for restoring original visitor IPs.