Cloudflare's new tools help spot the hidden dangers in your vibe code. Cloudflare is tackling corporate security risks from AI-generated code with Void, a new open-source self-hosted platform designed to give non-technical workers guardrails while vibe-coding internal apps. Oct 28, 2026 With the assistance of code building agents, nearly anyone can vibe-code and launch an app. Sometimes that's great - as in the case of smart TV owners jailbreaking their TVs to escape ads and surveillance. But AI-generated code comes with hidden dangers. The Cloud Security Alliance found that 45 percent to 70 percent of AI-generated code fails security tests. From the report: The core problem is structural: large language models produce code by predicting plausible continuations of patterns from their training data. They do not reliably reason about threat models, do not consistently apply authorization logic across multi-role systems, and do not spontaneously anticipate how a given code path will interact with the rest of a system under adversarial conditions. Security controls that require explicit, system-wide intent - such as row-level database access policies, API authentication middleware, or cross-service authorization checks - are exactly the category where AI code generators perform worst. They are also the controls most likely to be invisible to developers who lack a security background and are relying on AI tools to handle implementation details. The consequences are real, and for companies, they can come in the form of legal problems, reputational damage, and monetary loss. So imagine what happens when these tools are unleashed on the workplace with the expectation that non-technical workers can vibe code their own apps. Oftentimes because everyone has access to these tools at a company, people can unintentionally bypass IT and forgo important data security and accessibility concerns. Cloudflare is offering a way to bring some security and structure to the vibes. Enter Void, a new set of open-source programs derived from VoidZero available to those on the Cloudflare Workers for Platforms plan. This Morning The daily digest for entrepreneurs and business leaders Featured Video This Founder Built a Better Business by Refusing to Work All the Time VoidZero acquisition. Cloudflare acquired VoidZero in June 2026 and officially released the open-source programs on October 15. "Since Void is open source, other companies can adjust the platform to their needs," Christoph Nakazawa, former product lead at VoidZero and now director of engineering at Cloudflare, said to The New Stack. "After the Cloudflare acquisition of VoidZero, we rebuilt the platform from the ground up to work as a self-hosted platform that anyone can install and self-host on Cloudflare," Michael Dong, a strategy lead at Cloudflare who came over from VoidZero told The New Stack. "Companies want to encourage vibe-coded internal apps, but are concerned about security and do not want to give cloud access to every employee," Cloudflare said. "Void addresses this problem."

Cloudflare AI leak crossed customer boundaries - and access controls couldn't stop it. Oct 28, 2026 Cloudflare's AI data leak highlights security risks that access controls alone cannot address in shared inference infrastructure. Image: Generated via Google's Nano Banana 2 eWeek content and product recommendations are editorially independent. eWEEK may make money when you click on links to its partners. Learn More Cloudflare's AI data leak exposed a weakness that user permissions alone could not prevent. Some authenticated customers received AI responses containing information from other customers' requests, without needing access to those customers' credentials. In an Oct. 26 disclosure, Cloudflare confirmed that 155 responses from its GLM-5.3 model on Workers AI contained cross-customer information between Aug. 27 and Sept. 9, 2026. The failure occurred within shared AI inference infrastructure, where safeguards intended to separate customer workloads broke down. How Cloudflare's AI data leak happened. Security researcher Gadi Evron of Knostic reported the vulnerability through HackerOne on Sept. 8. Cloudflare reproduced the issue the following morning and temporarily disabled the affected model, according to its incident report. The problem involved SGLang, the open-source inference engine running GLM-5.3. Cloudflare configured a 1,048,576-token context window, but the GPU key-value (KV) cache could accommodate only 681,280 tokens. That cache temporarily stores information used during AI processing. Oversized requests should have returned errors. Instead, a software bug allowed rejected requests to proceed through the distributed inference pipeline, where response generation could draw on cached data belonging to earlier requests. In its independent investigation, Knostic documented responses containing names, invoice details, source-code information, filesystem paths, and AI agent records. Such information poses confidentiality risks for enterprises using AI in software development and other sensitive workflows. Cloudflare said GLM-5.3 was the only Workers AI model affected and found no evidence of deliberate exploitation. It restored service on Sept. 9 after correcting the configuration and patching the engine. Additional memory-management safeguards followed. An SGLang security advisory documents related fixes and deployment-specific guidance. Why access controls could not prevent the exposure. The failure occurred below the identity and access management layer. Enterprise AI agent identity controls restrict access and delegated permissions, but cannot independently enforce memory isolation inside shared inference infrastructure. The need for isolation testing also applies to enterprise platforms offering shared AI models. Broadcom says VMware Cloud Foundation supports tenant-specific data separation, although its published documentation does not establish how those protections compare with the inference-memory safeguards involved in Cloudflare's incident. Cloudflare's incident also differs from data exposure addressed by Microsoft's AI data protection controls, which help prevent sensitive information from reaching untrusted AI destinations. Here, information crossed customer boundaries after requests entered an authorized service. What eWeek Found: Successful API checks missed an isolation failure Cloudflare's configuration exposed a measurable gap between accepted context length and available memory. The 1,048,576-token limit exceeded prefill cache capacity by 367,296 tokens, approximately 54% more than the cache could accommodate. Engineers knew about the mismatch before launch but expected oversized requests to fail safely. Prelaunch benchmarks returned successful HTTP responses without validating generated output integrity. Knostic's later tests demonstrated that such responses could contain unrelated customer information. Cloudflare subsequently corrected the capacity mismatch, patched request handling, and added direct deployment checks. These changes addressed the reported failure without establishing that every potential memory-isolation vulnerability had been eliminated. Enterprise security assessments should therefore examine how providers validate cache ownership, reject oversized requests, and test isolation under failure conditions. Cloudflare has remediated the reported exposure, but the disclosures do not establish how widely comparable vulnerable configurations were deployed elsewhere. Want to learn more AI tips, tricks, and prompting techniques? Let eWEEK teach you How to Talk to AI for free! Try its six-minute course at The Neuron Academy, its practical learning platform designed to help professionals use AI more confidently at work. Learn a few simple ways to write better prompts and get more useful results from AI, or browse its other AI course for free for seven days. eWeek readers get free 7-day access. Check out all the lessons here

Researchers chain cloudflare security flaws to bypass CSP and execute malicious JavaScript. October 28, 2026 Security researchers at Searchlight Cyber chained several small flaws in Cloudflare's image feature. The chain let them run JavaScript on a site that was meant to block it. Kevin Gervot and Adam Kues published the work on October 28, 2026, in a write-up titled Cache Me If You Can. They showed a working cross-site scripting (XSS) bug through the /cdn-cgi/image/ endpoint on cloudflare.com. The write-up does not list a CVE or a patch status, so readers should check with Cloudflare. Discover more Cybersecurity news subscription Computer security consulting Cloudflare XSS flaws. Cloudflare sits in front of 24.3% of all websites. When a site joins Cloudflare, the company adds a managed /cdn-cgi/ path to that site's own domain. Features such as bot checks, Web Analytics, Access, and Image Transformations live there. Because these pages load from the customer's own domain, a bug in them runs with that site's trust. Other researchers had already found Content Security Policy (CSP) bypasses in this path. CSP is a browser rule set that limits which scripts a page may run. Cloudflare cleans SVG images with svg-hush, a Rust tool built on the xml-rs library. The tool checks the file, then writes it back out. The researchers found that xml-rs escapes normal attribute values but writes namespace values (the xmlns setting) raw. An attacker can hide a quote mark in that value and break out of it. The filter has already approved the file by then, so the script tag slips through. Cloudflare serves these images with a strict policy of default-src 'none', which blocks scripts. However, the endpoint passes along Cache-Control headers from the source image. The HTTP rules allow a form such as no-cache="Content-Security-Policy", which tells a cache to drop the named header. Only Chromium follows this rule, and it accepts any header name. The CSP stays in place on the first load. After Chromium saves the page, the policy is gone. A known CTF trick then forces Chromium to reload the saved copy. The attacker opens the page in a new window, moves that window to another site, and calls history.back. The opener link keeps the page out of the back/forward cache, so Chromium uses its disk cache, and the script runs. A related cache-based CSP bypass covered earlier by Cyber Security News relied on the same bfcache fallback. Image Transformations only fetches images from allowed sources. The default setting is "This zone only". The fetcher follows redirects without checking the final address. Any open redirect on an allowed site therefore lets an attacker load an image from anywhere. Discover more Buy Routers Computer security tools Cyber attack prevention The team wanted a method that needed no open redirect. They found that once Cloudflare Access is on for any hostname in a zone, /cdn-cgi/access/logout works on every hostname in that zone. Its returnTo setting accepts any cloudflare.com subdomain. A redirect on a Cloudflare research host then sent the fetcher to the attacker's file. That completed the chain on zones with strict source settings. The team then tested the cache trick elsewhere. On Netlify Image CDN, they used it to drop both the CSP and the Content-Type header. Chromium then guessed the file type from its content and treated an SVG starting with a doctype as HTML. A processing instruction hid the script from the SVGO cleaner, which only checks elements. The researchers say Netlify's hosted code is not public, so they could not confirm it matches the open-source version. Amazon S3 and Google Cloud Storage also allow signed links to override response headers. Such links can set response-content-type and response-cache-control. This matters for buckets behind custom domains or proxies that pass query strings along. The idea builds on earlier Content-Type override research and the S3 GetObject overrides. The main lesson is that you shouldn't trust only a file's body. Headers passed through by an image service or storage layer become part of your security. Teams should avoid forwarding Cache-Control and X-* headers from untrusted sources. They should also set X-Content-Type-Options: nosniff and review which sources their image tools may fetch. Closing open redirects helps too. Past work shows that even strong filters can fail, as in WAF bypass research on XSS payloads. Layered defenses still matter. Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. 0-Hour Cyber Security Alerts! Get the latest Cyber security News sent directly to your inbox. Discover more Cyber attack news Security alerts service Audit Security