Cloudforce One

The official threat intelligence account for @Cloudflare. Follow for threat research, incident assessments, WAF rule updates for emerging threats, and more.

[Cloudforce One @Cloudforce_One]

Cloudforce One conducted research into how linguistic deception and file structure can be used to bypass AI-driven code auditors across 18,400 API calls. The findings show that malicious detection rates drop when deceptive comments make up less than 1% of a file and that burying payloads in files larger than 3MB effectively blinds models to malicious intent. Read the full report here: https://t.co/70M380p6W8

[Cloudforce One @Cloudforce_One]

Cloudflare has released a new emergency WAF rule addressing the following CVE to enhance customer protection.  

cPanel - Auth Bypass (CVE-2026-41940)
https://t.co/orEfADhF2X

[Cloudforce One @Cloudforce_One]

Cloudflare offers proactive protection against CVE-2026-23869 through existing WAF rule aaede80b4d414dc89c443cea61680354.

[Cloudflare @Cloudflare]

Cloudforce One has identified a fundamental shift in the threat landscape: the era of industrialized cyber threats. This era focuses on high-trust exploitation and prioritizes results at all costs.

To help organizations counter these changes, today we are releasing the 2026 Cloudflare Threat Report. This report equips organizations with the intelligence they need to build a strategic 2026 roadmap.

Get the report: https://t.co/ie8MLQJQEf

[Cloudforce One @Cloudforce_One]

Cloudforce One has successfully disrupted the criminal enterprise known as Tycoon 2FA, one of the most popular Phishing-as-a-Service (PhaaS) kit providers, in coordination with industry partners. Read here: https://t.co/nIMA83dyfv

[Cloudforce One @Cloudforce_One]

Cloudflare has released new WAF rules addressing the following CVEs to enhance customer protection.

SmarterMail - Arbitrary File Upload (CVE-2025-52691)
SmarterMail - Authentication Bypass (CVE-2026-23760)
https://t.co/PZnybPuWA1

[Cloudforce One @Cloudforce_One]

Why waste a zero-day when session tokens grant direct access?
Why build a custom server when a reputation shield provides nearly untraceable infrastructure with a high delivery rate?
Why attack the network when you can use deepfakes to embed insiders directly within your target?

[Cloudforce One @Cloudforce_One]

Introducing the 2026 Cloudflare Threat Report.

The top finding? Threat actors have industrialized, and they’re prioritizing ROI at all costs.
https://t.co/SRvUJ5HfZG

[Cloudforce One @Cloudforce_One]

The top metric? Measure of effectiveness.
In 2026, the most dangerous actors aren’t the ones with the most advanced code; it’s the ones who can integrate intelligence and technology into a single, continuous system that achieves their mission in the shortest time possible.

[Cloudforce One @Cloudforce_One]

Of particular note is the growth in hyper-volumetric DDoS attacks, increasing by over 700% compared to the large attacks we observed in late 2024

[Cloudforce One @Cloudforce_One]

NEW: The total number of DDoS attacks more than doubled in 2025. And the world-record for largest DDoS attack observed by @Cloudflare was broken 19 times this year, with the current record-holder at 31.4 Tbps
https://t.co/02ycASkpT7

[Cloudforce One @Cloudforce_One]

Cloudflare has released new WAF rules to improve customer protection against the following vulnerability:

React DoS (CVE-2026-23864)

[Cloudforce One @Cloudforce_One]

We thank @Vercel for coordinating with us to protect Internet users worldwide.

[Cloudforce One @Cloudforce_One]

NEW: Threat actors are abusing Vercel to bypass email filters and deploy RMM tools. Our report details a sophisticated Telegram-gated delivery chain used to evade detection. https://t.co/JFb8zlbcpz

[Cloudforce One @Cloudforce_One]

Upon discovering this attack we worked with the Vercel Trust and Safety Team to ensure the threat was mitigated.

[Cloudforce One @Cloudforce_One]

Iranian Protest Update:

We have observed Iranian authorities targeting Instagram accounts with tools that perform bulk extraction of follower lists and account activity

[Cloudforce One @Cloudforce_One]

NEW: Cloudflare detected the largest UDP DDoS attacks of the year—peaking at 29.7 Tbps. Aisuru's "short-burst" UDP carpet-bombing tactics are designed to maximize impact while evading traditional mitigation. https://t.co/iu35UjemTz

[Cloudforce One @Cloudforce_One]

.christmas at the top of the naughty list

[Cloudflare Radar @CloudflareRadar]

That email from the .christmas TLD is probably naughty. In 2025, 99.8% of messages from that domain analyzed by @Cloudflare Email Security were classified as malicious or spam. The .lol TLD wasn't much better -- it's no laughing matter.

Find out more at https://t.co/rUiybXMpyD

[Cloudforce One @Cloudforce_One]

React2Shell has surpassed 1 billion exploitation attempts in just 11 days. We are seeing sustained pressure averaging 4.35M hits per hour — with peaks more than tripling that volume.