Vulnerabilities

March 29, 2022 4:51PM

CVE-2022-1096 is yet another zero day vulnerability affecting web browsers. Cloudflare zero trust mitigates the risk of zero day attacks in the browser and has been patched...

By 
• Tim Obezuk

March 08, 2022 3:22PM

A zero-day vulnerability in the Mitel MiCollab business phone system has recently been discovered (CVE-2022-26143). This vulnerability, called TP240PhoneHome, which Cloudflare customers are already protected against, can be used to launch UDP amplification attacks...

By 
• Omer Yoachimik
• ,  Alex Forster

March 08, 2022 2:59PM

A new reflection/amplification distributed denial-of-service (DDoS) vector with a record-breaking potential amplification ratio of 4,294,967,296:1 has been abused by attackers in the wild to launch multiple high-impact DDoS attacks...

By 
• Alex Forster

February 01, 2022 5:28PM

Today we are launching Cloudflare’s paid public bug bounty program. We believe bug bounties are a vital part of every security team’s toolbox and have been working hard on improving and expanding our private bug bounty program over the last few years...

By 
• Rushil Shah

December 15, 2021 1:56PM

This vulnerability is actively being exploited and anyone using Log4J should update to version 2.16.0 as soon as possible, even if you have previously updated to 2.15.0. The latest version can be found on the Log4J download page....

By 
• Gabriel Gabor
• ,  Andre Bluehs

December 14, 2021 5:48PM

In this blog post we will cover WAF evasion patterns and exfiltration attempts seen in the wild, trend data on attempted exploitation, and information on exploitation that we saw prior to the public disclosure of CVE-2021-44228....

By 
• John Graham-Cumming
• ,  Celso Martinho

December 14, 2021 10:23AM

Many Cloudflare customers consume their logs using software that uses Log4j, so we are mitigating any exploit attempts via Cloudflare Logs....

By 
• Jon Levine
• ,  Sohei Okamoto

December 10, 2021 11:39PM

Yesterday, December 9, 2021, when a serious vulnerability in the popular Java-based logging package log4j was publicly disclosed, our security teams jumped into action to help respond to the first question and answer the second question. This post explores the second....

By 
• Rushil Shah
• ,  Thomas Calderon

December 10, 2021 9:06PM

I wrote earlier about how to mitigate CVE-2021-44228 in Log4j, how the vulnerability came about and Cloudflare’s mitigations for our customers. As I write we are rolling out protection for our FREE customers as well because of the vulnerability’s severity....

By 
• John Graham-Cumming