pwn.watch: Cloudflare incident updates

[unknown] HTTP/3 QPACK “Header Accordions” memory-amplification DoS

Thu, 22 Oct 2026 09:19:00 GMT

FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.

Status: live · Patch: partial · Fixed in: quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0, Wireshark 4.6.2 / 4.4.12

Latest updates:

2026-10-20: FoxIO blog + PoC published; several stacks still unpatched.
2025-11 → 2026-07: Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.

CVEs: CVE-2025-64702, CVE-2026-12523, CVE-2025-13945

[high] Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)

Sun, 07 Sep 2025 00:00:00 GMT

Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.

Status: closed · Patch: no-fix-needed · Fixed in: Drift tokens revoked; rotate any secrets stored in Salesforce

Latest updates:

2025-09-02: Cloudflare details the impact on its Salesforce case data (source)
2025-08-26: Google Threat Intelligence publishes UNC6395 findings (source)
2025-08-20: Salesloft and Salesforce revoke Drift access and refresh tokens; Drift pulled from AppExchange (source)

[high] polyfill.io CDN turned malicious on 100k+ sites

Thu, 27 Jun 2024 00:00:00 GMT

The polyfill.io domain and GitHub account were bought in February 2024 by a Chinese company. The CDN, embedded via cdn.polyfill.io on more than 100,000 sites, then served malicious JavaScript that redirected some mobile visitors to a sports betting site. Sansec exposed it on 2024-06-25. Cloudflare began rewriting polyfill.io links to its own mirror, and Namecheap put the domain on hold.

Status: closed · Patch: patched · Fixed in: Remove polyfill.io references or switch to the Cloudflare/Fastly mirrors

Latest updates:

2024-06-27: Cloudflare rewrites cdn.polyfill.io to its mirror; Namecheap puts the domain on hold (source)
2024-06-25: Sansec reports the polyfill.io supply-chain attack hitting 100k+ sites (source)

[high] Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach

Thu, 01 Feb 2024 00:00:00 GMT

A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.

Status: closed · Patch: no-fix-needed

Latest updates:

2024-02-01: Cloudflare publishes its full write-up (source)
2023-11-23: Cloudflare detects the attacker on its self-hosted Atlassian server (source)
2023-11-14: Attacker begins reconnaissance with credentials from the Okta compromise (source)

[high] Okta support system breach: HAR files with session tokens stolen

Wed, 29 Nov 2023 00:00:00 GMT

An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-11-29: Okta: the attacker downloaded the names and email addresses of all customer support system users (source)
2023-11-03: Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked (source)
2023-10-19: Okta notifies customers of the security incident (source)

[high] HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)

Tue, 10 Oct 2023 00:00:00 GMT

Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.

Status: closed · Patch: patched · Fixed in: See vendor advisories (each HTTP/2 implementation shipped its own fix)

Latest updates:

2023-10-10: Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV (source)
2023-08-25: Cloudflare starts seeing unusually large HTTP/2 attacks (source)

CVEs: CVE-2023-44487