More than 90% of successful cyberattacks start with email, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). That’s not because security teams lack tools, but because attackers target human decision-making. For years, organizations treated email security as a filtering problem: block enough malicious messages, and risk goes down. That assumption no longer holds.

Security is traditionally a game of defense. You build walls, set up gates, and write rules to block traffic that looks suspicious. For years, Cloudflare has been a leader in this space: our Application Security platform is designed to catch attacks in flight, dropping malicious requests at the edge before they ever reach your origin. But for API security, defensive posturing isn’t enough. That’s why today, we are launching the beta of Cloudflare’s Web and API Vulnerability Scanner.

As I wrote in my recent book, How AI and Quantum Impacts Cyber Threats and Defenses, as we humans use AI more and more, AI will begin to communicate with itself using new AI-only communication methods that humans cannot easily see or read. If there is no human-readable audit trail or code, this is a very, very bad thing. It must be stopped at all costs. Humans are absolutely beginning to use AI more and more to do things they used to do manually. Soon, we will all be using multiple AI agents.

In December 2025, Cloudflare received reports of HTTP/1.x request smuggling vulnerabilities in the Pingora open source framework when Pingora is used to build an ingress proxy. Today we are discussing how these vulnerabilities work and how we patched them in Pingora 0.8.0. The vulnerabilities are CVE-2026-2833, CVE-2026-2835, and CVE-2026-2836. These issues were responsibly reported to us by Rajat Raghav (xclow3n) through our Bug Bounty Program.

As more services, communication, and daily activities move online, the amount of personal data being collected continues to grow. So what can we do to make sure that protecting our privacy doesn’t become unmanageable?

Production deployments. That’s where multi-agent AI systems live now, not research labs. Salesforce, Microsoft, and Cognition Labs are all running agent pipelines that replaced what used to take entire ops teams. Most businesses still don’t fully understand what they’ve switched on. A multi-agent AI setup isn’t just one model doing more things.

Proactive instead of reactive. Are you tired of hearing that already? This phrase seems to appear in almost every elevator pitch. But when it comes to cybersecurity, anticipating threats is essential. Attackers are more professional, automated, and faster than ever. The damage they cause keeps growing, and the window you have after the first alarm to protect your organization is shrinking.