Cloudflare Launches Zero Wire, a Free Feed for Critical Flaws

Cloudflare has launched Zero Wire, a free public feed that explains critical internet-facing vulnerabilities in plain language and tells security teams what to do next. Announced in a Cloudflare blog post on 3 November by Daniele Molteni and Celso Martinho, it sits in the security section of Cloudflare Radar, the company’s public internet data site.

Cloudflare describes it as bringing “the clarity of a news wire service” to security. Each entry is a short briefing rather than a raw database record, and the company says the information is useful whether or not readers are Cloudflare customers.

What a Zero Wire briefing contains

Cloudflare says the format is “deliberately simple: an index card with what you need to know, without the drama”. A chief information security officer should be able to grasp the issue quickly, and an engineer should be able to follow the same page to the technical fix.

Each briefing has an overview of what happened and why it matters, a list of teams that should investigate, and a short “What to do now” checklist. An evidence section links to CVE records, research and vendor advisories, including CISA’s catalogue of known exploited vulnerabilities. An update log records what has changed since the last check.

Where it applies, Cloudflare adds data from its own network, such as charts of requests matching its Web Application Firewall (WAF) rules. The company stresses that these show attack attempts, not compromised systems. A lack of attempts on its network also does not prove exploitation is absent elsewhere.

There is also a pre-written prompt for an AI agent with access to a team’s own systems. Cloudflare says the prompt asks for a read-only assessment, and that copying it “does not itself scan or change systems”.

Which flaws make the list

The feed is not a catalogue of every CVE. Cloudflare says it focuses on critical flaws in web applications, the runtimes and libraries they depend on, and other services exposed to the internet. A dedicated Cloudflare protection is not required for inclusion.

The feed’s homepage splits briefings into “Needs attention” and “Reference”. When TSN checked it on 3 November, five briefings needed attention. They included a Linux kernel TCP flaw, the php2shell bugs in PHP, compromised eMudhra intermediate certificates, a Citrix NetScaler flaw and a Brotli decoder bug that TSN covered when CISA listed it as exploited. One WordPress briefing sat under Reference. Cloudflare notes that moving to Reference “does not mean every affected system has been patched”.

The php2shell example

The launch post uses php2shell as its worked example. The PHP project’s advisory of 21 October said two critical flaws, CVE-2026-109618 and CVE-2026-109619, could allow unauthenticated remote code execution, and urged all users to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. CISA added both to its Known Exploited Vulnerabilities catalogue on 26 October.

The php2shell briefing makes a point that is easy to miss: updating WordPress or a plugin does not fix a flaw in the PHP runtime underneath. It also treats a later, narrower issue, CVE-2026-115560, separately, and says exploitation of that one is not established. TSN reported earlier on honeypots logging php2shell attacks and on a minister’s statement that 32 UK government services went offline after it.

Zero Wire is useful because it keeps severity, exploitation and exposure apart

Vulnerability alerts can blur three different questions: how bad a flaw could be, whether attackers are using it, and whether a given organisation is exposed. Cloudflare’s format keeps them separate. On the php2shell page, the known-exploited label applies only to the two CVEs on CISA’s list, not to the follow-up bug. That kind of precision helps small teams decide what to patch first without overreacting.

The free access matters too. Many organisations running PHP, WordPress or edge appliances have no dedicated threat-intelligence budget. A plain-language briefing that links straight to the vendor’s fix lowers the cost of getting the basics right.

There are limits. The feed is curated by one company, so its selection reflects what Cloudflare judges significant, and its traffic charts come from Cloudflare’s network only. Each briefing also includes a section on Cloudflare’s own controls, which makes it partly a route to its products. The company is clear that a WAF rule “is not a replacement for fixing vulnerable software”, and readers should treat the vendor advisory as the authority. Freshness is the other test. The Brotli briefing, last checked on 25 October, still said active exploitation was not established in the sources reviewed, yet CISA’s catalogue shows that flaw, CVE-2026-111497, was added as known exploited on 27 October. As with Cloudflare’s quarterly DDoS reports, the feed’s value will depend on how quickly and accurately it is kept up to date.

Sources

• Cloudflare: Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities (3 November 2026)
• Cloudflare Radar: Zero Wire
• Cloudflare Radar: Zero Wire php2shell briefing
• PHP: Security advisory, critical remote code execution vulnerabilities (21 October 2026)
• CISA: Known Exploited Vulnerabilities Catalog

Related stories

• PHP2Shell: Honeypots Log 35 Confirmed RCEs, but No Victim Breach Yet
• Brotli Flaw Now on CISA’s Exploited List: Patch Node, Bun and Envoy
• Cloudflare Q3 DDoS Report: Giant Attacks Fall, Short Bursts Surge