Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In December 2025, Cloudflare received reports of HTTP/1.x request smuggling vulnerabilities in the Pingora open source framework when Pingora is used to build an ingress proxy. Today we are discussing how these vulnerabilities work and how we patched them in Pingora 0.8.0. The vulnerabilities are CVE-2026-2833, CVE-2026-2835, and CVE-2026-2836. These issues were responsibly reported to us by Rajat Raghav (xclow3n) through our Bug Bounty Program.

Security is traditionally a game of defense. You build walls, set up gates, and write rules to block traffic that looks suspicious. For years, Cloudflare has been a leader in this space: our Application Security platform is designed to catch attacks in flight, dropping malicious requests at the edge before they ever reach your origin. But for API security, defensive posturing isn’t enough. That’s why today, we are launching the beta of Cloudflare’s Web and API Vulnerability Scanner.

For years, the cybersecurity industry has accepted a grim reality: migrating to a zero trust architecture is a marathon of misery. CIOs have been conditioned to expect multi-year deployment timelines, characterized by turning screws, manual configurations, and the relentless care and feeding of legacy SASE vendors. But at Cloudflare, we believe that kind of complexity is a choice, not a requirement. Today, we are highlighting how our partners are proving that what used to take years now takes weeks.

In its January 2026 report, Emerging Tech: Tech Innovators in Domain-Specific Language Models for SecOps, Gartner examines how domain-specific language models (DSLMs) are reshaping security operations. The report explains that DSLMs are designed to address the limitations of general-purpose language models by focusing on a particular task or use case – in this case, cybersecurity.

It’s impossible to walk into a tradeshow these days without getting blasted by a wall of acronyms. Everywhere you look, vendors are cramming two to four perfectly serviceable words into a string of capital letters arranged to sound cooler than they actually are. This wouldn’t be so bad if it didn’t routinely derail meetings, product decisions, and sometimes whole strategies.

For a long time, data loss prevention (DLP) lived in the margins of security programs. It was something teams deployed to satisfy a requirement or reduce obvious risk. A handful of policies, some visibility into network traffic, maybe a scan of cloud storage. That was usually enough. That model reflected how work used to happen. Data moved more slowly, lived in fewer places, and followed more predictable paths. That is no longer true.

CrowdStrike Falcon for XIoT is extending its industry-leading protections to medical devices in healthcare environments. This will provide comprehensive security for patient care at a time when healthcare organizations are a key target for threat actors. As of January 2026, the HHS listed over 750 reported breaches within healthcare environments that were under investigation.

Imagine your lead Software Engineer walks into your office and says, “Good news! I just deployed that critical update to production. I wrote the code on my personal laptop, didn’t run it through CI/CD, skipped the security scan, and just copied the files directly to the server with a USB drive.” You would fire them. Or you would revoke their access immediately.

A critical vulnerability has been discovered in Angular Server-Side Rendering (SSR) that could allow attackers to manipulate request handling and trigger unauthorized server-side requests. Tracked as CVE-2026-27739, the vulnerability arises from how Angular SSR reconstructs request origins using HTTP headers such as Host and X-Forwarded-*. In affected versions, these headers were not strictly validated before being used to build request URLs.

Why do 3,000 CVEs not mean 3,000 real problems? Most vulnerability scanners flag every CVE in your container images without checking whether the vulnerable code is actually loaded and executed at runtime. Only 2–5% of alerts typically require action, which means your team is likely spending days triaging theoretical risks while genuinely exploitable vulnerabilities stay buried.