HTTP/2 Rapid Reset: deconstructing the record-breaking attack
October 10, 2023
This post dives into the details of the HTTP/2 protocol, the feature that attackers exploited to generate the massive Rapid Reset attacks...
HTTP/2 Zero-Day vulnerability results in record-breaking DDoS attacks
October 10, 2023
The “HTTP/2 Rapid Reset” attack exploits a weakness in the HTTP/2 protocol to generate enormous, hyper-volumetric DDoS attacks. Cloudflare has mitigated a barrage of these attacks in recent months, including an attack three times larger than any previous attack we’ve observed...
Uncovering the Hidden WebP vulnerability: a tale of a CVE with much bigger implications than it originally seemed
October 05, 2023
Google announced a security issue in Chrome titled "Heap buffer overflow in WebP in Google Chrome." At first it seemed like just another bug, but has implications that extended well beyond Chrome....
Unmasking the top exploited vulnerabilities of 2022
August 04, 2023
The Cybersecurity and Infrastructure Security Agency (CISA) just released a report highlighting the most commonly exploited vulnerabilities of 2022. ...
How Cloudflare is staying ahead of the AMD vulnerability known as “Zenbleed”
July 25, 2023
The Google Information Security Team revealed a new flaw in AMD's Zen 2 processors in a blog post today. The 'Zenbleed' flaw affects the entire Zen 2 product stack, from AMD's EPYC data center processors to the Ryzen 3000 CPUs, and can be exploited to steal sensitive data processed in the CPU, ...
MORE POSTS
April 25, 2023
SLP: a new DDoS amplification vector in the wild
Researchers have recently published the discovery of a new DDoS reflection/amplification attack vector leveraging the SLP protocol. Cloudflare expects the prevalence of SLP-based DDoS attacks to rise in the coming weeks...
- By
January 31, 2023
CVE-2022-47929: traffic control noqueue no problem?
In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands....
- By
November 02, 2022
Cloudflare is not affected by the OpenSSL vulnerabilities CVE-2022-3602 and CVE-2022-3786
Information on CVE-2022-3602 and CVE-2022-3786, and why Cloudflare was not impacted...
- By
June 05, 2022
Cloudflare observations of Confluence zero day (CVE-2022-26134)
UTC Atlassian released a Security Advisory relating to a remote code execution (RCE) vulnerability affecting Confluence Server and Confluence Data Center products....
- By
June 03, 2022
Cloudflare customers are protected from the Atlassian Confluence CVE-2022-26134
On June 02, 2022 Atlassian released a security advisory for their Confluence Server and Data Center applications, highlighting a critical severity unauthenticated remote code execution vulnerability....
- By
May 26, 2022
Cloudflare’s approach to handling BMC vulnerabilities
Cloudflare’s approach to handling firmware vulnerabilities and how we keep our internal data protected...
- By
May 06, 2022
The Cloudflare Bug Bounty program and Cloudflare Pages
The Cloudflare Bug Bounty has resulted in numerous security improvements to Cloudflare Pages...
- By
March 31, 2022
WAF mitigations for Spring4Shell
Cloudflare Managed Ruleset updates for the recent vulnerabilities affecting the Java Spring framework and related software components...
- By
March 29, 2022
CVE-2022-1096: How Cloudflare Zero Trust provides protection from zero day browser vulnerabilities
CVE-2022-1096 is yet another zero day vulnerability affecting web browsers. Cloudflare zero trust mitigates the risk of zero day attacks in the browser and has been patched...
- By
March 08, 2022
CVE-2022-26143: A Zero-Day vulnerability for launching UDP amplification DDoS attacks
A zero-day vulnerability in the Mitel MiCollab business phone system has recently been discovered (CVE-2022-26143). This vulnerability, called TP240PhoneHome, which Cloudflare customers are already protected against, can be used to launch UDP amplification attacks...
- By
March 08, 2022
CVE-2022-26143: TP240PhoneHome reflection/amplification DDoS attack vector
A new reflection/amplification distributed denial-of-service (DDoS) vector with a record-breaking potential amplification ratio of 4,294,967,296:1 has been abused by attackers in the wild to launch multiple high-impact DDoS attacks...
- By
February 01, 2022
Announcing the public launch of Cloudflare's bug bounty program
Today we are launching Cloudflare’s paid public bug bounty program. We believe bug bounties are a vital part of every security team’s toolbox....
- By
December 15, 2021
Protection against CVE-2021-45046, the additional Log4j RCE vulnerability
This vulnerability is actively being exploited and anyone using Log4J should update to version 2.16.0 as soon as possible. Latest version is available on the Log4J download page....
- By
December 14, 2021
Exploitation of Log4j CVE-2021-44228 before public disclosure and evolution of evasion and exfiltration
This article covers WAF evasion patterns and exfiltration attempts, trend data on attempted exploitation, and information on exploitation that we saw prior to the public disclosure of CVE-2021-44228....
- By