Thehackernews Cloudflare Containers Vulnerability Exposes Customer Data
Article Content
- •Cloudflare fixed a vulnerability allowing data access from deleted containers.
- •Residual data included sensitive files like SQLite databases and credentials.
- •Cloudflare implemented a two-stage fix to mitigate the issue.
On September 4, 2026, Oren Yomtov from Accomplish reported a vulnerability in Cloudflare Containers that allowed customers to access residual disk data from deleted containers of other accounts. The flaw stemmed from the use of Linux thin provisioning, which failed to wipe data before reassigning storage blocks. Researchers successfully retrieved sensitive data, including SQLite databases and credential files, from 18 out of 24 attempts across multiple servers. Cloudflare addressed the issue in two stages: reactivating block wiping on September 14 and retiring affected container disks by September 19. No evidence of malicious exploitation was found, and all recovered data was securely deleted. This incident highlights ongoing concerns about container security and the potential for data leaks in multi-tenant environments.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (8)
Following this threat?
Track Cloudflare and CVE-2026-31431 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like… 
Rapid Exploitation of Vulnerabilities Post-PoC Release Raises Alarm CrowdStrike's recent analysis reveals that hackers are exploiting vulnerabilities almost immediately after public proof-of-concept (PoC) code is released. Between January and July 2026, 91% of vulnerabilities with public PoCs were exploited within 48 hours, with the fastest at just 35 minutes. Notably, the critical…