Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In December 2025, Cloudflare received reports of HTTP/1.x request smuggling vulnerabilities in the Pingora open source framework when Pingora is used to build an ingress proxy. Today we are discussing how these vulnerabilities work and how we patched them in Pingora 0.8.0. The vulnerabilities are CVE-2026-2833, CVE-2026-2835, and CVE-2026-2836. These issues were responsibly reported to us by Rajat Raghav (xclow3n) through our Bug Bounty Program.

Security is traditionally a game of defense. You build walls, set up gates, and write rules to block traffic that looks suspicious. For years, Cloudflare has been a leader in this space: our Application Security platform is designed to catch attacks in flight, dropping malicious requests at the edge before they ever reach your origin. But for API security, defensive posturing isn’t enough. That’s why today, we are launching the beta of Cloudflare’s Web and API Vulnerability Scanner.

For years, the cybersecurity industry has accepted a grim reality: migrating to a zero trust architecture is a marathon of misery. CIOs have been conditioned to expect multi-year deployment timelines, characterized by turning screws, manual configurations, and the relentless care and feeding of legacy SASE vendors. But at Cloudflare, we believe that kind of complexity is a choice, not a requirement. Today, we are highlighting how our partners are proving that what used to take years now takes weeks.

In its January 2026 report, Emerging Tech: Tech Innovators in Domain-Specific Language Models for SecOps, Gartner examines how domain-specific language models (DSLMs) are reshaping security operations. The report explains that DSLMs are designed to address the limitations of general-purpose language models by focusing on a particular task or use case – in this case, cybersecurity.

For a long time, data loss prevention (DLP) lived in the margins of security programs. It was something teams deployed to satisfy a requirement or reduce obvious risk. A handful of policies, some visibility into network traffic, maybe a scan of cloud storage. That was usually enough. That model reflected how work used to happen. Data moved more slowly, lived in fewer places, and followed more predictable paths. That is no longer true.

CrowdStrike Falcon for XIoT is extending its industry-leading protections to medical devices in healthcare environments. This will provide comprehensive security for patient care at a time when healthcare organizations are a key target for threat actors. As of January 2026, the HHS listed over 750 reported breaches within healthcare environments that were under investigation.

Imagine your lead Software Engineer walks into your office and says, “Good news! I just deployed that critical update to production. I wrote the code on my personal laptop, didn’t run it through CI/CD, skipped the security scan, and just copied the files directly to the server with a USB drive.” You would fire them. Or you would revoke their access immediately.

Why do traditional intrusion detection systems fail in Kubernetes? Legacy IDS tools were built for static servers with fixed IPs and clear network perimeters—Kubernetes breaks all of those assumptions. Ephemeral pods, east-west traffic, encrypted service mesh communication, and dynamic IP addresses make perimeter-focused, signature-based detection effectively blind inside clusters.

Why do traditional incident response playbooks break in Kubernetes? Pods spin up and disappear in seconds, destroying forensic evidence before you can investigate. Attackers exploit service account tokens and move laterally through east-west traffic that perimeter tools never see—over 50% of ransomware deploys within 24 hours of initial access, leaving no time for manual investigation methods built for static servers.