Project Glasswing: what Mythos showed us
2026-06-03T19:24:08Z•83018b6deafd3c44805242537f30f150399965536063aedf23fce6ee8d1bdadd
account-abuseacmeai-securitycertificate-validationclient-side-securitycloudflare-productscopy-failddosipseclinux-kernellog-explorermanaged-oauthmcpoauthphishing-detectionpingorapost-quantum-cryptographyprivilege-escalationrequest-smugglingvulnerability-scanningweb-api-security
What happened
This collection of Cloudflare blog posts (early 2026) covers multiple high-impact security topics and product updates: an operational response to a critical Linux kernel 'Copy Fail' privilege-escalation disclosure (Cloudflare reports zero customer impact); disclosure and fixes for request-smuggling vulnerabilities in Pingora OSS (fixed in Pingora 0.8.0); mitigation of an ACME certificate-validation logic vulnerability; and a record-setting DDoS threat report. Cloudflare also rolled out security capabilities and roadmaps: post-quantum IPsec (hybrid ML-KEM) and a 2029 PQ target, PQ telemetry in
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cloudflare_security_blog
- Record identifier
- 83018b6deafd3c44805242537f30f150399965536063aedf23fce6ee8d1bdadd
- Enrichment time
- 2026-06-03T19:24:08Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.