Securing data in your Next.js app with Okta and OpenFGA
Learn how to integrate a Data Access Layer in your Next.js app and use it to implement a fine-grained authorization model with OpenFGA.
Treasury and PNNL threat data now available for Financial sector customers to secure applications
Cloudflare proudly partners with the U.S. Department of the Treasury and PNNL to empower financial institutions to deploy DNS filtering policies through Cloudflare’s Gateway, using threat data from these agencies to protect against malicious links and phishing
Where does your software (really) come from?
GitHub is working with the OSS community to bring new supply chain security capabilities to the platform.
CodeQL zero to hero part 3: Security research with CodeQL
Learn how to use CodeQL for security research and improve your security research workflow.
Securing millions of developers through 2FA
We’ve dramatically increased 2FA adoption on GitHub as part of our responsibility to make the software ecosystem more secure. Read on to learn how we secured millions of developers and why we’re urging more organizations to join us in these efforts.
Cloudflare named in 2024 Gartner® Magic Quadrant™ for Security Service Edge
Gartner has once again named Cloudflare to the Gartner® Magic Quadrant™ for Security Service Edge (SSE) report
How Cloudflare Cloud Email Security protects against the evolving threat of QR phishing
Learn about how Cloudflare's Cloud Email Security tackles QR phishing, why attackers favor QR codes, and Cloudflare's proactive defense strategy against evolving threats
DDoS threat report for 2024 Q1
2024 started with a bang. Cloudflare’s autonomous systems mitigated over 4.5 million DDoS attacks in the first quarter of the year — a 50% increase compared to the previous year. Read the full coverage
How to find, verify, and report open source vulnerabilities using GitHub tools
This blog post is an in-depth walkthrough on how we perform security research leveraging GitHub features, including code scanning, CodeQL, and Codespaces.
Bringing enterprise-level security and even more power to GitHub-hosted runners
GitHub-hosted runners now support Azure private networking. Plus, we’ve added 2 vCPU Linux, 4 vCPU Windows, macOS L, macOS XL, and GPU hosted runners to our runner fleet.
Why Workers environment variables contain live objects
Bindings don't just reduce boilerplate. They are a core design feature of the Workers platform which simultaneously improve developer experience and application security in several ways. Usually these two goals are in opposition to each other, but bindings elegantly solve for both at the same time
From .com to .beauty: The evolving threat landscape of unwanted email
In this 2023-early 2024 email analysis, we examine how certain generic Top-Level Domains (TLDs) are primarily used for spam and phishing, and their evolution over a year.
Protecting AI apps from bots and bad actors with Vercel and Kasada
Learn how Vercel protects the AI SDK Playground using our best-in-class DDoS mitigation, Next.js Middleware, and our partner Kasada.
Found means fixed: Introducing code scanning autofix, powered by GitHub Copilot and CodeQL
Now in public beta for GitHub Advanced Security customers, code scanning autofix helps developers remediate more than two-thirds of supported alerts with little or no editing.
Gaining kernel code execution on an MTE-enabled Pixel 8
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulnerability can be exploited even when Memory Tagging Extension (MTE), a powerful mitigation, is enabled on the device.
Mitigating a token-length side-channel attack in our AI products
The Workers AI and AI Gateway team recently collaborated closely with security researchers at Ben Gurion University regarding a report submitted through our Public Bug Bounty program. Through this process, we discovered and fully patched a vulnerability affecting all LLM providers. Here’s the story
Security Week 2024 wrap up
A summary of the blog posts and product announcements released during Security Week 2024
Log Explorer: monitor security events without third-party storage
With the combined power of Security Analytics + Log Explorer, security teams can analyze, investigate, and monitor for security attacks natively within Cloudflare, reducing time to resolution and overall cost of ownership for customers by eliminating the need to forward logs to third-party SIEMs
Launching email security insights on Cloudflare Radar
The new Email Security section on Cloudflare Radar provides insights into the latest trends around threats found in malicious email, sources of spam and malicious email, and the adoption of technologies designed to prevent abuse of email
Network performance update: Security Week 2024
Cloudflare is the fastest provider in 44% of networks around the world for 95th percentile connection time. Let’s dig into the data and talk about how we do it
Introducing Requests for Information (RFIs) and Priority Intelligence Requirements (PIRs) for threat intelligence teams
Our Security Center now houses Requests for Information (RFIs) and Priority Intelligence Requirements (PIRs). These features are available via API as well and Cloudforce One customers can start leveraging them today for enhanced security analysis
Cloudflare’s URL Scanner, new features, and the story of how we built it
Discover the enhanced URL Scanner API: Now with direct access from the Security Center Investigate Portal, enjoy unlisted scans, multi-device screenshots, and seamless integration within the Cloudflare ecosystem
Advanced DNS Protection: mitigating sophisticated DNS DDoS attacks
We're proud to introduce the Advanced DNS Protection system, a robust defense mechanism designed to protect against the most sophisticated DNS-based DDoS attacks
Collect all your cookies in one jar with Page Shield Cookie Monitor
Protecting online privacy starts with knowing what cookies are used by your websites. Page Shield extends transparent monitoring to HTTP cookies, empowering security and compliance teams with an easy overview without the need for an external scanner, nor changing existing web applications
Magic Cloud Networking simplifies security, connectivity, and management of public clouds
Introducing Magic Cloud Networking, a new set of capabilities to visualize and automate cloud networks to give our customers secure, easy, and seamless connection to public cloud environments
Linux kernel security tunables everyone should consider adopting
This post illustrates some of the Linux Kernel features, which are helping us to keep our production systems more secure. We will deep dive into how they work and why you may consider enabling them as well
Eliminate VPN vulnerabilities with Cloudflare One
The Cybersecurity & Infrastructure Security Agency (CISA) recently issued an Emergency Directive due to the Ivanti Connect Secure and Policy Secure vulnerabilities. In this blog, we discuss the threat actor tactics exploiting these vulnerabilities
GitHub Enterprise Server 3.12 is now generally available
With this version, customers can choose how to best scale their security strategy, gain more control over deployments, and so much more.
Making messaging interoperability with third parties safe for users in Europe
To comply with a new EU law, the Digital Markets Act (DMA), which comes into force on March 7th, we’ve made major changes to WhatsApp and Messenger to enable interoperability with third-party messaging services. We’re sharing how we enabled third-party interoperability (interop) while maintaining end-to-end encryption (E2EE) and other privacy guarantees in our services as […]
Secure your unprotected assets with Security Center: quick view for CISOs
Today we are excited to introduce a new set of capabilities within the Security Center to directly address a common challenge: ensuring comprehensive deployment across your infrastructure. Gain precise insights into where and how to optimize your security posture
Protecting APIs with JWT Validation
Cloudflare customers can now protect their APIs from broken authentication attacks by validating incoming JSON Web Tokens (JWTs) with API Gateway
Changing the industry with CISA’s Secure by Design principles
Security considerations should be an integral part of software’s design, not an afterthought. Explore how Cloudflare adheres to CISA’s Secure by Design principles to shift the industry
Defensive AI: Cloudflare’s framework for defending against next-gen threats
From identifying phishing attempts to protect applications and APIs, Cloudflare uses AI to improve the effectiveness of its security solutions to fight against new and more sophisticated attacks
Cloudflare launches AI Assistant for Security Analytics
Introducing AI Assistant for Security Analytics. Now it is easier than ever to get powerful insights about your web security. Use the new integrated natural language query interface to explore Security Analytics
Introducing behavior-based user risk scoring in Cloudflare One
Cloudflare One is introducing user risk scoring, a new set of capabilities to detect risk based on user behavior, so that you can improve security posture across your organization
Dispelling the Generative AI fear: how Cloudflare secures inboxes against AI-enhanced phishing
Generative AI is being used by malicious actors to make phishing attacks much more convincing. Learn how Cloudflare’s email security systems are able to see past the deception using advanced machine learning models
Navigating the maze of Magecart: a cautionary tale of a Magecart impacted website
E-commerce websites were targeted by a sophisticated Magecart attack, involving a hidden JavaScript code designed to secretly steal Personally Identifiable Information (PII) and credit card details from users
Welcome to Security Week 2024
Cloudflare’s Chief Security Officer introduces 2024 Security Week by sharing insights into the past year of threats, security incidents and key priorities and concerns for global CISOs
The Frontend Cloud: Resiliency for global web applications
Optimize your web presence for maximum uptime, scalability, and security. Discover the power of frontend clouds for enterprise resilience.
Repo-jacking explained: How it works and how to protect your GitHub projects
Repo-jacking is a specific type of supply chain attack. This blog post explains what it is, what the risk is, and what you can do to stay safe.
A vintage network attack called smurf
Fixing security vulnerabilities with AI
A peek under the hood of GitHub Advanced Security code scanning autofix.
Using OAuth 2.0 with offline access
Learn how to use the Dropbox OAuth 2.0 app authorization flow with offline access
The architecture of SAST tools: An explainer for developers
More developers will have to fix security issues in the age of shifting left. Here, we break down how SAST tools can help them find and address vulnerabilities.
GitHub’s Engineering Fundamentals program: How we deliver on availability, security, and accessibility
The Fundamentals program has helped us address tech debt, improve reliability, and enhance observability of our engineering systems.
AppSec is harder than you think. Here’s how AI can help.
In practice, shifting left has been more about shifting the burden rather than the ability. But AI is bringing its promise closer to reality. Here’s how.
Thanksgiving 2023 security incident
On Thanksgiving Day, November 23, 2023, Cloudflare detected a threat actor on our self-hosted Atlassian server. Our security team immediately began an investigation, cut off the threat actor’s access, and no Cloudflare customer data or systems were impacted by this event
Do you know if all your repositories have up-to-date dependencies?
Consider deploying the GitHub Action: Evergreen so that you know each of your repositories are leveraging active dependency management with Dependabot.
Introducing Cloudflare’s 2024 API security and management report
Today, we’re releasing our 2024 API Security and Management Report. This blog introduces and is a supplement to the API Security and Management Report for 2024 where we detail exactly how we’re protecting our customers, and what it means for the future of API security
DDoS threat report for 2023 Q4
Welcome to the sixteenth edition of Cloudflare’s DDoS Threat Report. This edition covers DDoS trends and key findings for the fourth and final quarter of the year 2023, complete with a review of major trends throughout the year
GitHub and the Ekoparty 2023 Capture the Flag
The GitHub Security Lab teamed up with Ekoparty once again to create some challenges for its yearly Capture the Flag competition!
Frenemies to friends: Developers and security tools
When socializing a new security tool, it IS possible to build a bottom-up security culture where engineering has a seat at the table. Let’s explore some effective strategies witnessed by the GitHub technical sales team to make this shift successful.
5 ways to make your DevSecOps strategy developer-friendly
Developers care about security, but poorly integrated tools and other factors can cause frustration. Here are five best practices to reduce friction.
GitHub’s top blog posts of 2023
As the year winds down, we’re highlighting some of the incredible work from GitHub’s engineers, product teams, and security researchers.
Australia’s cybersecurity strategy is here and Cloudflare is all in
In support of the Australian Cyber Security Strategy 2023-2030 (The Strategy), we want to share how we can help empower Australian organizations and individuals to become more secure
Scaling vulnerability management across thousands of services and more than 150 million findings
Learn about how we run a scalable vulnerability management program built on top of GitHub.
Securing our home labs: Frigate code review
This blog post describes two linked vulnerabilities found in Frigate, an AI-powered security camera manager, that could have enabled an attacker to silently gain remote code execution.
Enforcing device trust on code changes
How the Figma security engineering team protects GitHub release branches.
Cueing up a calculator: an introduction to exploit development on Linux
Using CVE-2023-43641 as an example, I’ll explain how to develop an exploit for a memory corruption vulnerability on Linux. The exploit has to bypass several mitigations to achieve code execution.
Building end-to-end security for Messenger
We are beginning to upgrade people’s personal conversations on Messenger to use end-to-end encryption (E2EE) by default. Meta is publishing two technical white papers on end-to-end encryption: Our Messenger end-to-end encryption whitepaper describes the core cryptographic protocol for transmitting messages between clients. The Labyrinth encrypted storage protocol whitepaper explains our protocol f