Cloudflare
CompanyFacts
- Country
- United StatesSource: Wikidata
- Founded
- 2009Source: Wikidata
- Sector
- Information and communications technology, Software PublishersSource: Wikidata
- Official website
- www.cloudflare.comSource: Wikidata
Security timeline
- Malware reported by The RecordNetamLoader malware targets custom Windows 10 build used by Asian government bodies
- Vulnerability reported by Cloudflare Blog (Security)Cloudflare tracks exploitation and patching of eMudhra's weak intermediate CA keys
Recent news
Reddit plans mandatory logins to curb AI bot data scraping
Reddit CEO Steve Huffman announced in an October 29 post that the platform plans to become primarily a logged-in service to curb unauthorised scraping by AI bots. Reddit says licensed commercial access will continue, and it will test the change in selected markets outside the US. The company has not confirmed which pages will require an account or when a global rollout will happen.
NetamLoader malware targets custom Windows 10 build used by Asian government bodies
Kaspersky's GReAT team reported NetamLoader, a .NET and XAML-based loader found in a CAB archive in the Windows update download folder, built for a custom Windows 10 build used only by Asian government bodies. It abuses Microsoft-signed components, patches AMSI, cleans up logs and contacts its C2 server slowly to evade sandboxes and EDR. Kaspersky saw one victim, could not say how the archive was delivered and found no sign that Patch My PC was compromised.
Cloudflare tracks exploitation and patching of eMudhra's weak intermediate CA keys
Cloudflare reports that eMudhra's eight intermediate private keys, one of which was simply the number 4, can be recovered from the public certificates, letting anyone forge certificates that unpatched clients not enforcing Certificate Transparency would accept. Cloudflare patched high-priority systems, including Pingora origin-facing proxies, within hours and logged about 22,000 handshakes using the weak keys, all refused where verification was enabled. About 160 handshakes carried forged certificates, one dated less than an hour after Mozilla's bug report went public, but they appeared to be servers' own default certificates rather than interception attempts.
Weekly roundup covers Anthropic breach dispute, UEFI server flaw and Cloudflare AI data leak
A SecurityWeek roundup briefly flags several stories: a dispute linked to an Anthropic breach, a UEFI flaw said to affect most servers, a Cloudflare AI data leak, Iran being eyed in military freezer hacks, a Copenhagen University breach, and AI-powered malware. The teaser gives no technical detail, so the full articles are needed for specifics.