Cloudflare has launched Zero Wire, a public vulnerability intelligence feed designed to help security teams track critical CVEs, understand exploitation activity, and find security fixes. Announced on November 3, 2026, it sits within Cloudflare Radar’s security section and brings technical evidence, vendor guidance, and recommended actions into readable briefings.
The service is built around a familiar problem. When a serious vulnerability appears, defenders have to assemble scattered advisories while checking their own systems. Cloudflare says the feed shortens that work and gives security leaders and engineers a shared starting point without requiring them to be Cloudflare customers.
Zero Wire coverage and categories
Zero Wire does not aim to list every CVE. It focuses on significant vulnerabilities in internet-facing software, including web applications, underlying runtimes, libraries, and exposed services. Briefings explain likely impact, identify deployments that need investigation, summarize exploitation evidence, and point readers toward patches or mitigations. An entry can appear even when Cloudflare does not have a dedicated protection available.
The homepage separates entries into “Needs attention” and “Reference.” The first category covers issues that need active assessment, including known exploitation or guidance that is still developing. The second keeps briefings after guidance stabilizes. Moving an entry into Reference does not mean every affected organization has patched, and readers still need to assess their own exposure and check the last-reviewed date.
Search tools let users look up briefings by CVE or issue name and follow technology tags. A single briefing can combine related vulnerabilities when that makes the response clearer. Each entry also records important developments, so returning readers can see changes in advisories, exploitation evidence, or recommended actions without rebuilding the disclosure timeline.
What the briefings connect
Cloudflare researchers said network observations can show exploitation attempts, but the announcement does not identify a new malware family. Zero Wire connects vulnerability research with response guidance. Earlier reporting on Cloudflare’s PHP warnings showed the difference between suspicious requests that justify urgent review and proof that attackers successfully compromised a server.
The action guidance ties each briefing to concrete checks. It tells teams to identify affected deployments, confirm software versions, contact hosting providers where needed, and apply vendor updates. Cloudflare also provides a prepared AI-agent prompt for a read-only assessment of deployed software, exposure, fixes, and existing safeguards. Copying that prompt does not scan infrastructure or change systems.
Evidence stays central to the workflow. Vendor advisories establish affected versions and remediation instructions, while exploitation reports describe attacker activity. Zero Wire also links to outside material, including CISA’s Known Exploited Vulnerabilities Catalog. Related coverage of CISA’s PHP2Shell exploitation warning shows that confirmed exploitation can affect response priority alongside technical severity.
Operational limits and signals
The service can add charts that show HTTP requests matching managed web application firewall rules. Those figures indicate observed activity, not successful exploits or compromised systems. An absence of matching traffic on Cloudflare’s network also cannot prove exploitation is absent elsewhere. Cloudflare says those limits matter when teams explain risk to management or decide whether deeper investigation is needed.
Protection details include available WAF rules and configuration requirements. Dashboard links let customers review settings, but opening a link does not enable protection or verify coverage. Cloudflare also says filtering malicious requests is only a temporary safeguard, not a software fix, and it cannot undo actions already taken on an origin server. Teams still have to follow vendor remediation guidance.
Licensed under CC BY-ND 4.0 International