Project Glasswing: what Mythos showed us
2026-05-28T19:24:18Z•a102974a35071246b50a6af94dea290b3d678b2fa7ee32f6d4d508dc29a4b8cd
account-abuseacmeai-security-for-appscertificate-validationclient-side-securitycloudycopy-failddosipseclinux-kernelllm-securitymanaged-oauthmatrix-homeservermcpmythosoauthphishingpingorapost-quantumpost-quantum-roadmapprivilege-escalationradarrequest-smugglingshadow-mcpweb-api-vulnerability-scanner
What happened
Cloudflare published a batch of security- and product-focused posts (Mar–May 2026) covering: mitigation and fleet-wide response to a publicly disclosed Linux kernel privilege-escalation (“Copy Fail”) with zero confirmed exploitation; disclosure and fixes for request-smuggling vulnerabilities in Pingora OSS (fixed in Pingora 0.8.0); mitigation of an ACME certificate-validation logic vulnerability; and multiple product launches and GA announcements (AI Security for Apps, Client‑Side Security, Web & API Vulnerability Scanner, Account Abuse Protection, Managed OAuth for Access). They also released
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cloudflare_security_blog
- Record identifier
- a102974a35071246b50a6af94dea290b3d678b2fa7ee32f6d4d508dc29a4b8cd
- Enrichment time
- 2026-05-28T19:24:18Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.