How we’re making security easier for the average developer
Security should be native to your workflow, not a painful separate process.
Found means fixed: Reduce security debt at scale with GitHub security campaigns
Starting today, security campaigns are generally available for all GitHub Advanced Security and GitHub Code Security customers—helping organizations take control of their security debt and manage risk by unlocking collaboration between developers and security teams.
Piecing together the Agent puzzle: MCP, authentication & authorization, and Durable Objects free tier
Cloudflare delivers the toolkit for AI agents with new Agents SDK support for MCP (Model Context Protocol) clients, authentication/authorization/hibernation for MCP servers, and Durable Objects free tier.
Protectd: Evolving Vercel’s always-on denial-of-service mitigations
Protectd is our new real-time security engine that blocks DDoS attacks faster than ever—built to detect, learn from, and stop threats before they reach your app. Now powering sub-second protection across all regions by default.
Designing for security and usability: Figma's modern endpoint strategy
At Figma, security doesn’t have to slow you down. We’ve designed our corporate endpoint security with UX in mind, making it seamless and self-serve.
Localhost dangers: CORS and DNS rebinding
What is CORS and how can a CORS misconfiguration lead to security issues? In this blog post, we’ll describe some common CORS issues as well as how you can find and fix them.
GitHub found 39M secret leaks in 2024. Here’s what we’re doing to help
Every minute, GitHub blocks several secrets with push protection—but secret leaks still remain one of the most common causes of security incidents. Learn how GitHub is making it easier to protect yourself from exposed secrets, including today’s launches of standalone Secret Protection, org-wide scanning, and better access for teams of all sizes.
Build and deploy Remote Model Context Protocol (MCP) servers to Cloudflare
You can now build and deploy remote MCP servers to Cloudflare, and we handle the hard parts of building remote MCP servers for you. Unlike local MCP servers you may have previously used, remote MCP servers are Internet-accessible. People simply sign in and grant permissions to MCP clients using familiar authorization flows.
Security Week 2025: in review
Security Week 2025 has officially come to a close. Our updates for the week included a deep dive on our AI offering, a unified navigation experience, and an introduction to our AI Agent Cloudy. Read about the latest updates from the team and discover how Cloudflare is helping build a better Internet.
What to do when you receive a vulnerability report: A step-by-step guide for maintainers
A step-by-step guide for open source maintainers on how to handle vulnerability reports confidently from the start.
Prepping for post-quantum: a beginner’s guide to lattice cryptography
This post is a beginner's guide to lattices, the math at the heart of the transition to post-quantum (PQ) cryptography. It explains how to do lattice-based encryption and authentication from scratch.
RDP without the risk: Cloudflare's browser-based solution for secure third-party access
Cloudflare now provides clientless, browser-based support for the Remote Desktop Protocol (RDP). It natively enables secure, remote Windows server access without VPNs or RDP clients, to support third-party access and BYOD security.
Making Application Security simple with a new unified dashboard experience
We’re introducing a new Application Security experience in the Cloudflare dashboard, with a reworked UI organized by use cases, making it easier for customers to navigate and secure their accounts, APIs, and more.
Cloudflare for AI: supporting AI adoption at scale with a security-first approach
With Cloudflare for AI, developers, security teams and content creators can leverage Cloudflare’s network and portfolio of tools to secure, observe and make AI applications resilient and safe to use.
Take control of public AI application security with Cloudflare's Firewall for AI
Firewall for AI discovers and protects your public LLM-powered applications, and is seamlessly integrated with Cloudflare WAF. Join the beta now and take control of your generative AI security.
One platform to manage your company’s predictive security posture with Cloudflare
Cloudflare introduces a single platform for unified security posture management, helping protect SaaS and web applications deployed across various environments. With asset discovery and threat detection, security risks can be easily managed for predictive security.
Extending Cloudflare Radar’s security insights with new DDoS, leaked credentials, and bots datasets
For Security Week 2025, we are adding several new DDoS-focused graphs, new insights into leaked credential trends, and a new Bots page to Cloudflare Radar. We are also refactoring Radar’s Security & Attacks page, breaking it out into Application Layer and Network Layer sections.
Upgraded Turnstile Analytics enable deeper insights, faster investigations, and improved security
Introducing new Turnstile Analytics: Gain insight into your visitor traffic, bot behavior patterns, traffic anomalies, and attack attributes. Stay equipped with visitor attributes and the outcome of Turnstile challenges against ever-evolving attacks.
Chaos in Cloudflare’s Lisbon office: securing the Internet with wave motion
Cloudflare is now using a wall of waves in our Lisbon, Portugal office to create entropy and strengthen Internet security, turning liquid chaos into secure, unpredictable encryption.
Password reuse is rampant: nearly half of observed user logins are compromised
Nearly half of observed login attempts across websites protected by Cloudflare involved leaked credentials. The pervasive issue of password reuse is enabling automated bot attacks and account takeovers on a massive scale.
Enhanced security and simplified controls with automated botnet protection, cipher suite selection, and URL Scanner updates
Enhanced security, simplified control! This Security Week, Cloudflare unveils automated botnet protection, flexible cipher suites, and an upgraded URL Scanner.
Email Security now available for free for political parties and campaigns through Cloudflare for Campaigns
We’re excited to announce that Cloudflare for Campaigns now includes Email Security, adding an extra layer of protection to email systems that power political campaigns.
Advancing account security as part of Cloudflare’s commitment to CISA’s Secure by Design pledge
A year after signing CISA’s Secure by Design pledge, Cloudflare has made significant progress in boosting multi-factor authentication (MFA) adoption. With the recent addition of Apple and Google social logins, we’ve made secure access easier for our users.
Welcome to Security Week 2025!
The layer of security around today’s Internet is essential to safeguarding everything. Over the next week, we will discuss the latest trends in cyber security, announce new products and partnerships, and showcase the latest in Cloudflare technology. Welcome to Security Week 2025!
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials
Critical authentication bypass vulnerabilities (CVE-2025-25291 + CVE-2025-25292) were discovered in ruby-saml up to version 1.17.0. In this blog post, we’ll shed light on how these vulnerabilities that rely on a parser differential were uncovered.
Full exposure: A practical approach to handling sensitive data leaks
Treating exposures as full and complete can help you respond more effectively to focus on what truly matters: securing systems, protecting sensitive data, and maintaining the trust of stakeholders.
Video: How to run dependency audits with GitHub Copilot
Learn to automate dependency management using GitHub Copilot, GitHub Actions, and Dependabot to eliminate manual checks, improve security, and save time for what really matters.
Vercel security roundup: Faster defenses and better visibility for your apps
Learn how Vercel's security product updates improved traffic visibility, enhanced mitigation techniques, and resulted in blocking billions of malicious attacks.
Protecting user data through source code analysis at scale
Meta’s Anti Scraping team focuses on preventing unauthorized scraping as part of our ongoing work to combat data misuse. In order to protect Meta’s changing codebase from scraping attacks, we have introduced static analysis tools into our workflow. These tools allow us to detect potential scraping vectors at scale across our Facebook, Instagram, and even […]
How OWASP Helps You Secure Your Full-Stack Web Applications — Smashing Magazine
The OWASP vulnerabilities list is the perfect starting point for web developers looking to strengthen their security expertise. Let’s discover how these vulnerabilities materialize in full-stack web applications and how to prevent them.
Helping civil society monitor cyber attacks with the CyberPeaceTracer and Cloudflare Email Security
At Cloudflare, we’re proud to collaborate with the CyberPeace Institute by powering its latest initiative, the CyberPeace Tracer, a platform that enables civil society organizations to proactively report cyber threats.
Looking back at our Bug Bounty program in 2024
In 2024, our bug bounty program awarded more than $2.3 million in bounties, bringing our total bounties since the creation of our program in 2011 to over $20 million. As part of our defense-in-depth strategy, we continued to collaborate with the security research community in the areas of GenAI, AR/VR, ads tools, and more. We […]
How GitHub uses CodeQL to secure GitHub
How GitHub’s Product Security Engineering team manages our CodeQL implementation at scale and how you can, too.
The case for sans-io
The most popular option to decompress ZIP files from the Rust programming language is a crate simply named zip — At the time of this writing, it has 48 million downloads. It’s fully-featured, supporting various compression methods, encryption, and even supports writing zip files. However, that’s not the crate everyone uses to read ZIP files. Some applications benefit from using asynchronous I/O, e
From finding to fixing: GitHub Advanced Security integrates Endor Labs SCA
The partnership between GitHub and Endor Labs enables application security engineers and developers to drastically reduce time spent on open source vulnerabilities, and gives them the tools to go from finding to fixing.
Cloudflare’s commitment to advancing Public Sector security worldwide by pursuing FedRAMP High, IRAP, and ENS
Cloudflare achieves ENS certification, and intends to pursue FedRAMP High and IRAP.
Data logs: The latest evolution in Meta’s access tools
We’re sharing how Meta built support for data logs, which provide people with additional data about how they use our products. Here we explore initial system designs we considered, an overview of the current architecture, and some important principles Meta takes into account in making data accessible and easy to understand. Users have a variety […]
What does a cybersecurity researcher do and how do you get started?
Discover the exciting world of cybersecurity research: what researchers do, essential skills, and actionable steps to begin your journey toward protecting the digital world.
Attacks on Maven proxy repositories
Learn how specially crafted artifacts can be used to attack Maven repository managers. This post describes PoC exploits that can lead to pre-auth remote code execution and poisoning of the local artifacts in Sonatype Nexus and JFrog Artifactory.
How Meta discovers data flows via lineage at scale
Data lineage is an instrumental part of Meta’s Privacy Aware Infrastructure (PAI) initiative, a suite of technologies that efficiently protect user privacy. It is a critical and powerful tool for scalable discovery of relevant data and data flows, which supports privacy controls across Meta’s systems. This allows us to verify that our users’ everyday interactions […]
Record-breaking 5.6 Tbps DDoS attack and global DDoS trends for 2024 Q4
2024 ended with a bang. Cloudflare mitigated another record-breaking DDoS attack peaking at 5.6 Tbps. Overall, Cloudflare mitigated 21.3 million DDoS attacks in 2024, representing a 53% increase compared to 2023.
How Stripe Radar responded to a new wave of card testing
While Radar’s models predict the likelihood of fraud, we needed a new way to recognize verification attacks that were causing higher-than-average authorization rates. Learn about our three-layered approach to combatting this new fraud trend.
How to scan GitHub Actions workflows for security issues
In the last few months, we secured 75+ GitHub Actions workflows in open source projects, disclosing 90+ different vulnerabilities. Out of this research we produced new support for workflows in CodeQL, empowering you to secure yours.
Announcing CodeQL Community Packs
We are excited to introduce the new CodeQL Community Packs, a comprehensive set of queries and models designed to enhance your code analysis capabilities. These packs are tailored to augment…
The role of email security in reducing user risk amid rising threats
As threats evolve, SOC teams must adapt their operations. With Cloudflare’s holistic approach to managing user-based risk, SOC teams can operate more efficiently and reduce the likelihood of a breach.
Enhance build security and reach SLSA Level 3 with GitHub Artifact Attestations
Learn how GitHub Artifact Attestations can enhance your build security and help your organization achieve SLSA Level 3. This post breaks down the basics of SLSA, explains the importance of artifact attestations, and provides a step-by-step guide to securing your build process.
Uncovering GStreamer secrets
In this post, I’ll walk you through the vulnerabilities I uncovered in the GStreamer library and how I built a custom fuzzing generator to target MP4 files.
Migration Automation: Easing the Jenkins → GHA shift with help from AI
Overview The past few months have been exciting times for Slack’s CI infrastructure. After years of developer frustration with Jenkins (everything from security issues to downtime to generally poor UX) internal pressure led us to move a majority of Slack’s CI jobs from Jenkins to GitHub Actions. My intern project at Slack this summer involved…
CodeQL zero to hero part 4: Gradio framework case study
Learn how I discovered 11 new vulnerabilities by writing CodeQL models for Gradio framework and how you can do it, too.
CYPEX Academy - Application Authentication Section
Authentication overview of the CYPEX Online Academy - find out how to manage users & roles, configure login settings, LDAP and repositories.
From deals to DDoS: exploring Cyber Week 2024 Internet trends
How significant are Cyber Week shopping days on the Internet? Is it a global phenomenon? Does E-commerce interest peak on Black Friday or Cyber Monday, and are attacks increasing during this time? We try to answer these questions and more.
Just cracking an embedded root password, no big deal
WordPress Multi-Multisite: A Case Study
What's it look like to create a dashboard within the WordPress admin for analyzing Google Analytics data across 900 blogs across 25 multisite instances? It involves designing a user-friendly interface, leveraging the WordPress REST API, implementing a plugin for data retrieval, and addressing challenges like rate limits and authentication.
Bigger and badder: how DDoS attack sizes have evolved over the last decade
If we plot the metrics associated with large DDoS attacks observed in the last 10 years, does it show a straight, steady increase in an exponential curve that keeps becoming steeper, or is it closer to a linear growth? Our analysis found the growth is not linear but rather is exponential, with the slope varying depending on the metric (rps, pps or bps).
DO it again: how we used Durable Objects to add WebSockets support and authentication to AI Gateway
We used Cloudflare’s Developer Platform and Durable Objects to build authentication and a WebSockets API that developers can use to call AI Gateway, enabling continuous communication over a single, persistent connection.
Using ML to comply with SCA requirements
By applying ML to the process of navigating SCA requirements, we’re helping users reduce checkout friction while lowering fraud and increasing authorization rates.
How Meta built large-scale cryptographic monitoring
Cryptographic monitoring at scale has been instrumental in helping our engineers understand how cryptography is used at Meta. Monitoring has given us a distinct advantage in our efforts to proactively detect and remove weak cryptographic algorithms and has assisted with our general change safety and reliability efforts. We’re sharing insights into our own cryptographic monitoring […]
Empowering Engineers with AI
Background and motivation In the fast-paced world of software development, having the right tools can make all the difference. At Slack, we’ve been working on a set of AI-powered developer tools that are saving 10,000+ hours of developer time yearly, while meeting our strictest requirements for security, data protection, and compliance. In this post, we’ll…
Exploring Internet traffic shifts and cyber attacks during the 2024 US election
Election Day 2024 in the US saw a surge in cyber activity. Cloudflare blocked several DDoS attacks on political and election sites, ensuring no impact. In this post, we analyze these attacks, as well Internet traffic increases across the US and other key trends.
Attacking browser extensions
Learn about browser extension security and secure your extensions with the help of CodeQL.