Cloudflare Launches Zero Wire, a Public Vulnerability Feed for Critical Internet-Facing CVEs: Severity and Exploitation Evidence Kept Apart, and WAF Match Counts Are Not Compromise Counts

On November 3, 2026, Cloudflare introduced Zero Wire, a public vulnerability intelligence feed inside Cloudflare Radar, in the security section. Daniele Molteni and Celso Martinho write that AI is raising both the volume and the speed of critical vulnerability discovery, and that security teams are left to answer "are we affected, and what are we doing about it?" while the next disclosure arrives. Zero Wire is meant to give them a starting point, in the style of a news wire. The post says the information is useful whether or not you are a Cloudflare customer.

Each briefing has a plain-language overview of what happened and why it matters, who should investigate, a short "what to do now" list, and links to evidence and vendor guidance. Cloudflare also offers a pre-compiled prompt you can give to your own AI agent. The post says the prompt asks for a read-only assessment of deployed software, relevant vendor fixes, exposure and compensating controls, with per-asset evidence, unknowns and next actions, and that copying the prompt does not scan or change any system. So the output is only as good as the access and review your own agent and team bring.

The scope is narrow on purpose. Zero Wire is not a catalog of every CVE and does not replace vendor advisories or vulnerability databases. It covers critical CVEs in Internet-facing software, such as web applications, the runtimes and libraries they depend on, and exposed services where a proxy can help mitigate exploitation. Cloudflare says it selects the issues, and that a dedicated Cloudflare protection, such as a Web Application Firewall (WAF) rule, is not a prerequisite for inclusion. Some issues need vendor updates or changes beyond the traffic Cloudflare can inspect.

The homepage sorts briefings into "Needs attention," for issues needing active assessment or action, and "Reference," for ones whose guidance has stabilized. Moving to Reference does not mean every affected system is patched. Each card shows a status and a last-checked date, and the post warns that known exploitation, an ongoing investigation and an available vendor fix describe different things. It also says severity and evidence of active exploitation are distinct, and that readers need both.

The evidence section is where the post is most careful. Briefings link to CVE records, research and exploitation evidence such as CISA's Known Exploited Vulnerabilities Catalog, and may add charts of traffic matching Cloudflare WAF managed rules. The post states that such requests are not a count of compromised systems or successful exploits, that observing an attack attempt does not show a given organization was compromised, and that no attempts seen on Cloudflare's network does not show exploitation is absent elsewhere. Briefings try to separate what sources establish from what is unknown, and an update chronology records new advisories or changes.

The example is php2shell, two flaws in the PHP runtime. Cloudflare's earlier post on it says the flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21 and affect servers running PHP 5.4 or later, and that WAF protections reached free and paid customers by default from 3:02 am UTC that day, about nine hours before public disclosure. Zero Wire's point is that updating application code or a plugin does not fix a runtime flaw, so the briefing sends readers to the right owners and to the PHP guidance. That earlier post also carries an October 23 update on a related issue, CVE-2026-115560, which affects fully patched releases and which the WAF rule covers only if the site keeps the default upload progress field name.

Cloudflare is open about its own role. If a WAF rule applies, the briefing says so and gives configuration requirements, with links to the dashboard, but the link does not enable a rule or verify a deployment. The post says a WAF mitigation is a compensating control for the traffic it covers, not a replacement for fixing vulnerable software, and that blocking requests cannot undo what already ran at the origin. For teams, Zero Wire is a triage aid to read next to vendor advisories, and the post gives no measured data on how much time it saves.