https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Cloudflare.Sun, 26 Jul 2026 22:32:51 GMThttps://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channelcst-3081Cisco Talos discovered msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that establishes command-and-control communications exclusively through Chrome DevTools Protocol rather than direct network connections. The malware is delivered via a malicious MSI installer disguised as a Windows update and leverages the browser, Cloudflare Workers, and Twilio TURN relays to create a covert WebRTC DataChannel for C2 communications. Chaos is a ransomware-as-a-service group active since February 2025 that uses phishing, vishing, and legitimate tools for post-compromise activities before deploying encryption.Thu, 23 Jul 2026 10:00:38 GMThttps://tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-executioncst-2848Two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, can be chained together to achieve unauthenticated remote code execution on WordPress 6.9.x and 7.0.x installations. Active exploitation began within days of the July 17, 2026 disclosure, with public proof-of-concept code circulating and multiple security firms confirming attacks in the wild. Patches are available in WordPress 7.0.2 and 6.9.5, with WordPress.org enabling forced automatic updates for affected installations.Mon, 20 Jul 2026 13:36:32 GMThttps://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.htmlcst-2783A critical vulnerability in WordPress core versions 6.9 and 7.0 allowed unauthenticated attackers to execute arbitrary code on unpatched installations. WordPress released patches (6.9.5 and 7.0.2) on Friday and deployed forced updates through its auto-update mechanism. Adam Kues at Assetnote discovered the flaw and coordinated its disclosure.Fri, 17 Jul 2026 21:20:10 GMThttps://helpnetsecurity.com/2026/07/17/new-infosec-products-of-the-week-july-17-2026cst-2734A weekly roundup highlighting new security product releases from vendors including Cloudflare, Lineation.ai, Nudge Security, and Polygraf AI. Polygraf AI's Meeting Guard is featured as a real-time deepfake detection solution for enterprise meetings that joins sessions as a participant to provide security analysis to attendees.Fri, 17 Jul 2026 04:00:15 GMThttps://helpnetsecurity.com/2026/07/13/cloudflare-precursorcst-2422Cloudflare announced general availability of Precursor, a bot management tool that uses continuous behavioral analysis running in web browsers to detect sophisticated bot automation in real time. The system monitors entire user sessions rather than relying on static CAPTCHAs, aiming to catch advanced bots while minimizing disruption to legitimate users.Mon, 13 Jul 2026 13:28:04 GMThttps://bleepingcomputer.com/news/security/artoken-phaas-exposes-eviltokens-microsoft-365-phishing-toolkitcst-6Researchers discovered ARToken, a phishing-as-a-service (PhaaS) platform operating as an affiliate of the EvilTokens phishing platform, which provides an extensive toolkit for targeting Microsoft 365 accounts. The discovery reveals the organized infrastructure and business model behind credential theft attacks against enterprise email systems.Fri, 03 Jul 2026 14:12:22 GMThttps://microsoft.com/en-us/security/blog/2026/06/25/photo-zip-campaign-targeting-hospitality-industry-delivers-node-js-implant-persistent-accesscst-329Microsoft Threat Intelligence has identified an active campaign targeting hospitality industry organizations in Europe and Asia since April 2026, delivering a Node.js-based implant through photo-themed ZIP archives containing fake image shortcuts. The attack chain uses obfuscated PowerShell, dual registry persistence, and command-and-control communications over non-standard ports, with phishing emails leveraging legitimate services like Calendly and Google to bypass email authentication. The campaign has evolved through two waves with increasing sophistication, including new obfuscation techniques and expanded infrastructure, though the ultimate objective remains unclear.Thu, 25 Jun 2026 22:30:29 GMThttps://arstechnica.com/information-technology/2026/06/executive-order-bumps-up-deadline-to-move-off-quantum-vulnerable-cryptocst-427The White House has shortened the deadline for government agencies and critical infrastructure operators to migrate from quantum-vulnerable encryption to post-quantum cryptographic systems, requiring key establishment schemes by the end of 2030 and digital signature schemes by the end of 2031. This accelerated timeline, roughly five years earlier than previous expectations, follows research indicating that building a cryptographically relevant quantum computer requires fewer resources and lower costs than previously estimated. Major technology companies including Google and Cloudflare have similarly advanced their own migration deadlines to 2029.Tue, 23 Jun 2026 22:30:57 GMThttps://darkreading.com/application-security/cordyceps-malicious-pull-requests-developer-workflowscst-117A campaign dubbed 'Cordyceps' exploits CI/CD pipeline weaknesses to inject malicious pull requests into high-profile open source projects including Azure Sentinel, Google's AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and Python's Black formatter. The attacks leverage automated workflows to introduce compromised code into widely-used developer tools and libraries. This represents a supply chain threat targeting projects with significant downstream dependents.Tue, 23 Jun 2026 19:16:42 GMThttps://volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewallcst-2103Volexity discovered that a Chinese threat actor tracked as VerdantBamboo had compromised an Egnyte Storage Sync appliance using the BRICKSTORM malware, with the initial compromise dating back at least 18 months. The actor used the compromised appliance to access the victim's Microsoft 365 environment while evading security controls, and later regained access via stolen firewall credentials to deploy additional malware. Investigation revealed the victim organization had been compromised through a breach of their managed services provider, whose pfSense firewall had also been infected with BRICKSTORM for at least 18 months.Thu, 04 Jun 2026 20:23:55 GMThttps://elastic.co/security-labs/tycoon-2fa-aitm-detection-engineeringcst-616Tycoon 2FA is a prolific phishing-as-a-service platform that performs adversary-in-the-middle attacks to bypass multi-factor authentication and steal authenticated session tokens from Microsoft 365 and Google Workspace. The kit operates as a reverse proxy that captures real-time authentication flows, including MFA challenges, and intercepts post-MFA session tokens before they reach the victim's browser. Despite a March 2026 takedown that seized over 300 domains, operators have adapted and continue deploying variants that use WebSocket-based proxying and OAuth device code abuse, employing sophisticated evasion techniques to avoid researcher detection.Tue, 26 May 2026 00:00:00 GMThttps://elastic.co/security-labs/detecting-web-server-probing-and-fuzzingcst-620A security practitioner describes using Traefik reverse proxy logs ingested into Elastic Security to detect web server probing and fuzzing activity through statistical analysis of HTTP 404 response codes. When suspicious patterns are identified, an automated workflow blocks the offending source IP addresses at the Cloudflare edge using the Cloudflare API, providing perimeter defense without requiring local tools like Fail2Ban.Fri, 08 May 2026 00:00:00 GMThttps://elastic.co/security-labs/tclbanker-brazilian-banking-trojancst-621Elastic Security Labs identified TCLBANKER, a Brazilian banking trojan that represents a significant evolution of the MAVERICK/SORVEPOTEL malware family. The malware uses a loader with extensive anti-analysis capabilities to deploy a banking trojan targeting 59 Brazilian financial institutions and a worm module that spreads via compromised WhatsApp and Outlook accounts. The infrastructure is hosted on Cloudflare Workers and shows signs of early-stage operations with debug artifacts and incomplete phishing pages.Thu, 07 May 2026 00:00:00 GMThttps://sentinelone.com/labs/labscon25-replay-are-your-chinese-cameras-spying-for-you-or-on-youcst-609Researchers Marc Rogers and Silas Cutler analyzed ultra-cheap Chinese smart home cameras and video doorbells sold globally under rotating brand names, revealing they share identical hardware platforms, contain hardcoded root passwords, and route user data through servers in China and Hong Kong despite claims of local processing. The devices are distributed through shell companies designed to evade regulatory oversight, with minimal security updates and rapid hardware iterations resembling malware distribution patterns. The investigation demonstrates a widespread, vulnerable Internet of Things (IoT) surface accessible to remote configuration from overseas actors.Wed, 22 Apr 2026 22:00:15 GMThttps://wiz.io/blog/wiz-cloudflare-ai-security-integrationcst-1313Wiz and Cloudflare have integrated their security platforms to provide unified visibility and protection for AI application endpoints and DNS exposure. The integration allows organizations to see which endpoints are protected by Cloudflare and identify gaps that require additional security measures.Tue, 14 Apr 2026 13:00:02 GMThttps://doublepulsar.com/cybersecurity-industry-overreacts-to-react-vulnerability-starts-panic-burns-own-house-down-again-e85c10ad1607?source=rss----8343faddf0ec---4cst-588CVE-2025-55182 affects React v19 with React Server Components enabled, a relatively new and niche configuration used by a minority of organizations. The security industry has generated widespread panic and false proofs of concept, with some vendors like Cloudflare implementing hasty patches that caused significant outages, despite the vulnerability having a narrow attack surface and straightforward mitigation path.Fri, 05 Dec 2025 11:21:36 GMThttps://huntress.com/blog/akira-ransomware-indicatorscst-940Huntress analysts have identified multiple indicators associated with Akira ransomware attacks, including threat actor workstation names, passwords used during account creation or modification, and CloudFlare tunnel tokens. Early detection of these artifacts in the attack chain enables organizations to prevent or block file encryption deployment.Fri, 20 Sep 2024 00:00:00 GMT