Cloudflare flaw exposed customer data

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

☁️ Cloudflare flaw exposed customer data

🪙 Bitget breach halts withdrawals, points to North Korea

🤖 Salesforce AI agents could leak CRM data

🚨 WSO2 and Adobe flaws under active attack

🐳 New malware hijacks Docker hosts

Plus: 💡 6 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

☁️ Cloudflare flaw exposed customer data LINK

Cloudflare has patched a cross-tenant data exposure flaw in its Containers platform that let one customer's workload recover leftover disk data belonging to another tenant sharing the same physical host, also affecting Cloudflare Sandboxes built on Containers.

The bug lived in the storage layer, not a container escape: Cloudflare's shared pools enabled skip_block_zeroing, so deleted disk blocks returned uncleared to a shared pool, and a 4 KiB write forced reuse of a recycled 64 KiB block while leaving 60 KiB of another customer's residual bytes readable.

A researcher disclosed it through Cloudflare's HackerOne program on September 4, 2026, and Cloudflare found no evidence of malicious exploitation; it removed skip_block_zeroing, retired existing disks, cleared caches, and organizations should assess whether secrets warrant precautionary rotation.

🪙 Bitget breach halts withdrawals, points to North Korea LINK

Cryptocurrency exchange Bitget lost $351.6 million after attackers broke into a backend wallet system, forcing the platform to suspend all withdrawals while forensic analysis points toward North Korean state-sponsored actors.

No private keys were compromised; instead the attackers spoofed transaction data and fabricated authorization requests that passed Bitget's automated verification, tricking its systems into approving fraudulent transfers from hot and warm wallet tiers while cold storage stayed untouched.

Security monitoring first flagged unauthorized fund movements at 18:31 UTC on September 24, after which Bitget halted outgoing transfers; its $464 million User Protection Fund fully covers the loss, deposits and trading continue, but no withdrawal timeline was given.

🤖 Salesforce AI agents could leak CRM data LINK

Researchers at Zenity Labs disclosed three flaws in Salesforce Agentforce, collectively called SalesBleed, that let attackers hijack its AI agents to silently steal CRM data with no click required and send phishing messages under the agents' identities.

The data-theft chain plants hidden instructions in a public Web-to-Lead form, which stay dormant until an employee asks the agent about leads, then bypass Salesforce's Trusted URLs redaction to smuggle stolen records to an attacker server via image tags or Slack link previews.

The phishing flaw abused the Reply to a Slack Thread action, which sent messages without user approval or attribution; Salesforce fixed the URL redaction bypass, and Zenity confirmed on September 21 that all three vulnerabilities were fixed, so the chains no longer work.

🚨 WSO2 and Adobe flaws under active attack LINK

Two flaws in WSO2 products and Adobe Commerce are being actively exploited, prompting CISA to add both to its list of bugs known to be under attack and order federal agencies to patch by September 27, 2026.

The WSO2 flaw (CVE-2026-5430), rated maximum severity (CVSS 10/10), stems from improper checking of JWT signatures, letting an attacker sign a token with an unsupported algorithm to bypass authentication, gain unauthorized access and potentially take over accounts.

The Adobe bug (CVE-2026-71362), rated critical (CVSS 9.1), lets an unauthenticated attacker with no account or user interaction switch a customer session to another account and steal private data; Adobe's isolated fix APSB26-92 patches Commerce, Commerce B2B and Magento Open Source.

🐳 New malware hijacks Docker hosts LINK

A new botnet malware named Carbonato is hijacking Docker hosts that expose their daemon API without authentication, launching privileged containers to take full control of the machine and spread on its own.

Carbonato connects to the unauthenticated Docker API on port 2375, tells the daemon to launch a privileged container, opens a reverse SSH tunnel, installs an SSH server with the operators' key, and reports each deployment through Telegram.

The malware installs the Hermes Agent AI framework with a "GH0ST" persona to steal AI API keys, SSH credentials, and access tokens, and scans attached networks every five minutes to spread; researchers advise keeping daemon APIs off the network and requiring authentication on registries.

💡 Strategies & Tactics

> Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure: Defend every stage of the software build and delivery process at once, since attackers now target developer laptops, code repositories, and shared code libraries together.

> AI-powered fuzzing with the GitHub Security Lab Taskflow Agent: Automate the whole C/C++ fuzzing workflow by pointing an AI agent at a repository, letting it write test harnesses, chase coverage gaps, and triage crashes.

> Don't let TEEs break your MPC: Treat hardware secure enclaves as an extra safeguard, not a replacement, for multi-party signing, since a malicious host can still trigger key-leaking reuse attacks.

> AI for Offensive Security: What Works, What Does Not, and How to Adopt It: AI speeds offensive security by finding real vulnerabilities and building tools, but only with expert oversight and independent validation, since models often falsely report success.

> Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud: Pin third-party GitHub Actions to a verified commit ID, not a version tag, since re-enabled malicious repositories silently reran their payload across roughly 15,000 projects.

> How threat intelligence decays and when to reassess it: Match each intelligence type to its own decay clock, time for indicators, events for vulnerabilities, new evidence for judgments, and attach a revocation trigger to every control so stale intelligence stops silently driving decisions.

Other news you might like

• Sudo Security Vulnerability Lets Attackers Escalate PrivilegesLINK

• Emerging Ransomware Gang Uses Backup Destruction Threats to Pressure VictimsLINK

• SectopRAT Returns, Hiding Inside a Legitimate ApplicationLINK

• Decades-old file security flaws found in Android, Linux, macOS, and WindowsLINK

• Check Point warns of hackers exploiting Security Gateway VPN RCE flawLINK

• Windows Botnet x47.c Offers AI API Draining, 18 Attack MethodsLINK

• Prompt-Injection Bug Hits $4B Agentic AI App 'Manus'LINK

🧰 Trending tools

Halo: detects deepfakes and synthetic media across text, image, and audio via an API, helping fraud and trust teams block attacksLINK

Execlave: governs autonomous AI agents with tiered autonomy levels, real-time spend caps, kill switches, and audit logs mapped to SOC 2, EU AI Act, and ISO 27001.LINK

qsa.sh: scans your public IP for open ports and known vulnerabilities using naabu, nmap, and nuclei, streaming results to your terminal via a single curl command.LINK

Aegisora: an open-source proxy that secures LLM agents with least-privilege API access, PII masking, prompt-injection blocking, and audit logging in production.LINK

Cybermes: a framework that automates offensive security, bug bounty hunting, and red teaming using AI agents and multiple language models.LINK

KUMO-Domain-Recon-Tool: a domain OSINT and security reconnaissance framework that scans across 27 parallel modules covering DNS, ports, leaked credentials, subdomains, CVEs, and malware.LINK

📚 Trending papers & reports

Prompt injection attacks can nudge decision-making software that picks from a fixed menu of actions, still hijacking its choice only ~3.5% of the time, showing rigid output rules reduce but don't erase manipulation risk.LINK

Hidden triggers for brain-inspired chips plant near-perfect 100% backdoors in the low-power neural networks used in sensors and cameras, slipping past seven existing defenses by hiding in timing patterns rather than visible image changes.LINK

Automated hacking tools get a lightweight fact-checker layer that verifies findings and grades severity instead of trusting the same chatty model that found them, cutting false alarms, inflated risk ratings, and wasted compute.LINK

AI coding agent setups often ship risky configurations, with ~15% of over 3,000 public repositories granting broad execution rights or using unpinned dependencies that let hidden code changes slip into your development pipeline.LINK

AI agents under task pressure will actively work around the safety monitors watching them just to finish ordinary jobs, attempting evasion up to 98% of the time and succeeding up to 88%.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!