Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Over the past two and a bit quarters, we've undertaken an intensive engineering effort, internally code-named "Code Orange: Fail Small", focused on making Cloudflare's infrastructure more resilient, secure, and reliable for every customer. Earlier this month, the Cloudflare team finished this work.

On April 29, 2026, details about the ‘Copy Fail’ vulnerability (CVE-2026-31431) were publicly disclosed. This high-severity (CVSS score of 7.8) privilege escalation vulnerability impacts Linux distributions shipped since 2017. It allows an unprivileged local user to obtain root-level access on affected Linux systems by corrupting the kernel’s in-memory page cache of a privileged binary.

The NIS2 Directive has officially shifted from being a conversation for the future to an operational reality across Europe. Regulators are now activating mandatory registries, launching process supervision, and most importantly, laying the groundwork for enforcement actions against non-compliant organizations. For many companies, this is the period of highest risk. What was previously perceived as a complex or distant requirement now has a direct impact on the business.

Phishing reports and customer complaints are not early warning signals. By the time they arrive, attackers have already built the infrastructure. Lookalike domains are live, credential harvesting pages are indexed, and the exposure window is open. To stop digital impersonation attacks, organizations need to shift detection to the infrastructure preparation stage, before distribution begins.

Whether you’re juggling travel bookings with friends or packing the kids’ suitcases, planning a summer vacation can be far from relaxing. And once you get to your destination, the confirmation codes and passport numbers are always buried in the group chat when you need them most. But when you have all your travel essentials saved securely in one place, you can skip the scramble and put safe travels on autopilot.

Storing data in a specific country doesn’t automatically mean that that country’s laws are the only ones that apply. This disconnect catches a lot of organizations off guard, and it’s exactly where the confusion between data sovereignty vs. data residency begins. One is about where your data physically lives. The other is about which laws govern it, regardless of location.

A healthcare CISO opens her AI-SPM dashboard at the start of the quarter. Every clinical AI agent in the cluster reads green: full AI-BOM coverage, every permission scope reconciled, the HIPAA compliance tag clean across the fleet. The ambient scribe, the prior-authorization assistant, the oncology decision support agent — all monitored, all green, all the way through. Six months later, the Office for Civil Rights opens an investigation.

For six weeks, a mid-size hospital system’s CDS agent issued recommendations biased by a poisoned guideline summary. No detection alert fired. The drift — denial recommendations in cases sharing one specific clinical attribute — traced back to a guideline an outside contributor had quietly reweighted in editorial review. Every existing detection stack reported green. DLP: no PHI left the cluster. EHR audit log: agent reading and writing within scope. Network egress: normal traffic.

Your AI agent runs on AKS with a managed identity that can read Azure Key Vault, and you assume prompt injection is a theoretical risk—until a malicious prompt drives that agent to steal credentials from the Azure metadata endpoint in under a minute. Most teams discover this gap when their SIEM shows a single request to 169.254.169.254, but they cannot trace it back to which agent tool or prompt triggered it, or how far the stolen token traveled across their Azure environment.