Cloudflare Containers Vulnerability Remediated

We treat DNS like the digital phonebook of the internet—essential, trusted, and rarely questioned by firewalls. But what happens when attackers turn that fundamental trust against us? In my latest article, "The Dark Side of DNS: Weaponizing Recursive Resolvers for Stealth Data Exfiltration," I explore how adversaries leverage standard DNS traffic to bypass perimeter security and siphon sensitive data completely undetected. Have a read: https://lnkd.in/disNXnGV

Claude Code got hacked by getting blocked by a firewall. Read that again. Cloudflare's WAF does its job, blocks a malicious request, logs the header word for word. Nothing wrong so far. Then an agent gets asked to review the blocked traffic. It reads that header as plain metadata, because that's literally what it is. No "ignore previous instructions." No fake system tags. Just a ticket number, a compliance citation, and two claims it can check itself (both true). Once it confirms those, it trusts everything else in the payload. Patches the DNS record. Adds a CNAME. Reports the issue resolved. 90% success rate against Claude Code, on Cloudflare's own recommended setup. WAF, EDR, IAM all did their job and none of it caught it, because nothing the agent did was outside its permissions. Tenet Security found the same pattern on Datadog and Sentry too. On Sentry it got worse, the coding agent never even saw the injected content, only a second AI's summary of it, and trusted that instead. The thing I can't stop thinking about, obvious injection attempts get refused all the time. It's the boring, structured, half true telemetry that gets through. If your agent has a read tool and a write tool in the same session pointed at any log or alert data, you already have this shape sitting in your stack. What's your bar for letting an agent act on "trusted" data with no human checking first?

Until now, proving that CDN-based DDoS protection worked, particularly at Layer 7, could be complex, disruptive and heavily dependent on network infrastructure. In some cases, the only real test came when an actual attack occurred. With MazeBolt RADAR’s newly released native Cloudflare integration, teams can quickly identify which attack vectors were mitigated and which may have reached the origin. No mirror ports. No network taps. No packet payloads. No maintenance window. Within hours, security teams can find the gaps, get actionable remediation guidance and revalidate the changes. It turns DDoS readiness from a slow, one-time testing exercise into a continuous cycle: Validate. Remediate. Revalidate. https://lnkd.in/ey4_EUec MazeBolt #DDoS #CyberSecurity #Cloudflare #SecurityValidation #CyberResilience

Six days of database access looked like an eight-hour outage CareCloud reported an eight-hour outage to the SEC. Its breach notice, four months later, described six days of database access nobody saw. Read the full article → https://lnkd.in/eWdADa_z #cybersecurity #infosec #incidentresponse #compliance

JetBrains disclosed that its hosted Cadence service was compromised through an unpatched TeamCity server running a vulnerability the company itself published on July 27 and warned customers was being exploited on August 7 — and stated plainly that the server should have been patched as part of its own response but was not. Attacker activity began August 8, was discovered August 23, and the server was taken offline August 24, with confirmed extraction of usernames, real names, email addresses, last-login timestamps, and last-accessed IP addresses, plus compromise of a full 2024 server backup whose credentials, configuration, artifacts, and logs must all be treated as exposed. Users are told to treat any secret stored in Cadence, contained in that backup, or used during an execution as compromised — cloud provider credentials, Git host tokens, package registry keys, SSH and deployment keys, service account credentials, signing keys — and to hunt for unexpected repository clones, unexpected commits, and changes to repository secrets, webhooks, collaborators, or permissions from August 8 onward. #DevSecOps #SupplyChainSecurity #IncidentResponse #PatchManagement #Cybersecurity https://lnkd.in/g6RihZ9w

This article discusses the importance of securing Red Hat OpenShift using the Layered Zero Trust Validated Pattern, which helps prevent common network policy mistakes and ensures verification of intent. I found it interesting that the approach emphasizes proactive strategies for network security, emphasizing the need for clarity between policy intent and implementation. How do you ensure your network policies align with your organization’s security objectives?

1. Read the book. Understand AWS services, architecture, IAM policies, and security controls. 2. Build it in AWS. Deploy the infrastructure. Configure permissions, create S3 buckets, enable logging, and understand how everything interacts. 3. Hunt suspicious activity. Investigate CloudTrail logs, reconstruct attack chains, and understand how legitimate AWS functionality can be abused. Just got done working through an AWS cloud security investigation involving a compromised IAM identity. The attacker accessed S3 resources, modified a bucket policy to enable public access, and created another IAM user with administrative group membership. Starting with enumeration: GetCallerIdentity → Who am I? ListUsers → Who exists? ListGroups → What groups exist? ListRoles → What roles exist? GetRole → Who can assume this role? ListBuckets → What buckets exist? ListObjects → What files are stored? GetBucketPolicy → Who can access this bucket? DescribeInstances → What EC2 instances exist? Now it's easier to figure out what's next in the chain. #CyberDefenders #CyberSecurity #DetroitTech #Detroit

When a team gets hit by an attack, one of the first places I look is the load-balancer configuration. A few patterns I keep coming back to when reviewing LB configurations: Rate limiting by IP is usually the first control people reach for. It's necessary but it's not enough when you're dealing with rotating proxies or a distributed botnet. I prefer thinking about rate limits by IP, session and endpoint where the application allows it. /login and /checkout shouldn't necessarily have the same threshold as /. SYN cookies can help protect connection resources during SYN floods, although the implementation depends on the load-balancing platform. Slowloris and slow-request attacks need sensible header, request and connection timeouts. The goal is to prevent clients from holding connections open indefinitely without breaking legitimate users on slower networks. Geo and ASN blocking are blunt instruments. I use them when the traffic pattern gives me a good reason, for example when legitimate traffic is concentrated in specific regions while attack traffic is heavily concentrated in a small number of hosting networks. Otherwise it's very easy to block legitimate users along with the attackers. TLS fingerprinting such as JA3/JA4 is another useful signal. It can help identify automated or suspicious clients even when the User-Agent has been spoofed. But the load balancer shouldn't try to become a WAF. SQL injection, XSS and other payload inspection belong at the WAF/application-security layer. Keeping those responsibilities separate makes the architecture easier to understand and operate. One failure mode I've seen repeatedly is this: An attack starts → someone changes the thresholds under pressure → legitimate customers get blocked → nobody has a tested rollback. The better approach is to understand normal traffic first, test thresholds against real traffic, monitor the impact, and have a rollback plan before an incident happens. Good traffic filtering isn't about blocking as much as possible. It's about stopping malicious traffic while keeping legitimate traffic flowing. What's in your load-balancer filtering playbook? #DevOps #CloudSecurity #AWS #CyberSecurity #SRE #LoadBalancer #WAF #CloudEngineering

CVE-2026-94127 is a critical F5 BIG-IP APM zero-day actively exploited in the wild, enabling unauthenticated remote code execution through a heap-based buffer overflow in vulnerable OAuth Authorization Server configurations. Because exploitation occurs through the data plane, restricting the BIG-IP management interface alone does not remove the attack surface, making patching and review of affected virtual servers a priority. Read the full article: https://lnkd.in/dCbwbdRX #Cybersecurity #CVE #Security

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials: JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," JetBrains said.