Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Defending QUIC from acknowledgement-based DDoS attacks

On April 10th, 2025 12:10 UTC, a security researcher notified Cloudflare of two vulnerabilities (CVE-2025-4820 and CVE-2025-4821) related to QUIC packet acknowledgement (ACK) handling, through our Public Bug Bounty program. These were DDoS vulnerabilities in the quiche library, and Cloudflare services that use it. quiche is Cloudflare's open-source implementation of QUIC protocol, which is the transport protocol behind HTTP/3.

Best HIPAA Compliance Software by Category: Website Monitoring, GRC & Privacy

We see the same pattern across healthcare clients. The servers are locked down, databases encrypted, and GRC documentation is in order. Then we check the browser layer and find a Google Analytics pixel quietly sending appointment URLs and other PHI to third-party servers without a BAA.

How to Detect and Mitigate Common Active Directory Attacks

Active Directory is the heart of enterprise identity and access management, and its crucial role makes it a target for hackers looking for control, persistence, and privileged access. The fact that AD is central to organizational functions makes proactive, multi-layered, and intelligence-driven security strategies a must in order to ensure it is always able to withstand even the most sophisticated, continuously evolving threat actors.

The Evolving Landscape of Cybersecurity: Why Risk Management Is More Important Than Ever

In today's interconnected business world, every organization relies on a network of partners - from software providers and payment processors to data storage and cloud services. While this interconnectedness drives innovation and efficiency, it also introduces serious cybersecurity risks. A single vulnerability in your vendor ecosystem can open the door to data breaches, ransomware attacks, and compliance failures.

Step-by-Step: Producing a Staff Training Book for Phishing Awareness Workshops

Nowadays, with the development of technology, more teams are operating remotely. Companies have realized that it's important that these teams also get some kind of cybersecurity training. Data breaches happen often and no company wants its private data leaking and being out in the world. Seeing your team recognize and report a phishing email with confidence is what every IT security department aims for. When your training materials are finally ready and employees are actively using them, you realize that you've created something that strengthens your organization's awareness and preparedness.

Online Games and Internet Speed: How to Match Your Connection to Your Playstyle

When it comes to online gaming, your internet speed is only part of the story. Many players obsess over their download rate, but for most games, low ping and a stable internet connection matter even more. Whether you're snipping opponents in a competitive shooter, exploring open-world RPGs with friends, or teaming up in a massive MMO, your network's performance can mean the difference between your victory and your defeat.

CSAM Week 4: Software Updates Can't Wait

Software powers nearly every part of our digital lives, operating systems, browsers, apps, and countless tools we rely on every day. With that convenience, however, comes responsibility. One of the most effective and often overlooked defenses against cyber threats is simple: keeping your software updated.

8 Best Cloud PAM Solutions in an AI World

AI is rewriting the rules of privileged access, but the rise of AI agents is creating a governance crisis. Threats like credential stuffing and privilege escalation are now accelerated by autonomous systems moving faster than humans can react. 82% of companies deploy autonomous AI agents, but 23% of IT teams admit those bots have already been tricked into revealing credentials—and fewer than half have guardrails in place. In modern infrastructure, machine identities now outnumber humans 80:1.