Attackers used AI to fake a company's identity and take over its domain. (That was CoW Swap.) The real site pointed at a phishing page. Valid cert, no warning. AI's a target too: a prompt slipped through Grok moved funds onchain. Read our 2026 Threat Report:

Attackers are working through the honeypots on Our theft frontier is at 11 bits of added entropy on top of the weak mk3 seeds. All of @ColeTU's external honeypots have been swept. We just lost our first one-word passphrase UTXO.

Attackers don't just automate browsers anymore. They run anti-detect browsers, spoofing and obfuscating every signal a fingerprint is built from. Our job is to fingerprint the device anyway. Network packets are a layer that obfuscation often cannot reach. Once a request leaves the device, the packets are what they are. FlowPrint v1 goes live today. It classifies the device operating system (Android, iOS, Windows, Linux, Chromium OS, macOS) from flow features alone. You can rewrite the user agent. You can't rewrite the packets. Three challenges now live on SN61, each hardening different layers of our products: ab_sniffer_v6: detecting automation and anti-detect tooling flowprint_v1: OS classification from network flows flowradar_v2: VPN detection from network flows

Attackers carried out 207 crypto hacks in H1 2026 — a record for any six-month period — but total losses fell to USD 972 million, less than half of the USD 2.3 billion stolen in H1 2025. Two distinct patterns explain the divergence. 🔹 Infrastructure compromises made up roughly 15% of incidents but drove approximately 76% of losses, concentrated in two North Korea-linked operations against Drift Protocol and KelpDAO totaling USD 577 million. 🔹 Smart contract exploits accounted for most incidents but a far smaller share of stolen value, with a median loss of about USD 219,000. The lower total reflects the absence of another record-setting theft, not a reduction in attacker capability. Read our full analysis here ➡️

"Attackers aren’t reinventing the playbook; they’re just accelerating it through AI." ⚡ In our latest Security Signal episode, Cloudflare Field CIO Khalid Kark and @IBM’s Mark Hughes dive deep into: 🔹 Closing the "Legacy Debt" gap 🔹 The shift to Autonomous Security 🤖 🔹 Quantum readiness & Crypto-agility 🔐 🔹 Why the CISO’s most important tool is now governance The SOC is evolving from reactive reports to ambient action. Is your organization ready? Check out the clip and then the full conversation here: Want to know more? Take a look at our 2026 Cloudflare Security Signals Report:

🚨 Attackers are exploiting a Roundcube pre-auth SQL injection flaw patched in May. CVE-2026-48842 can expose mail credentials and stored messages through the virtuser_query plugin. Read:

🚨 Attackers use hacked Ukrainian sites to serve fake Cloudflare CAPTCHAs for Psychedelic Stealer. The ClickFix lure copies an msiexec command and tells users to run it. The stealer targets passwords, tokens, and crypto-wallet data. 🔗 Read →