Project Glasswing: what Mythos showed us
2026-06-01T19:24:08Z•f382481a7db6e2520a32fd9e1403f1f591779c32596fcf6a3623e37846287844
account-abuseacmeai-securityapi-securitycertificate-validationclient-side-securityddosipseclinux-kernelllmslog-explorermanaged-oauthmcpoauthpingorapost-quantumprivilege-escalationquantum-cryptographyrequest-smugglingvulnerability-scanner
What happened
Collection of Cloudflare security blog posts (Jan–May 2026) covering product launches, research, mitigations, and threat trends. Notable items include mitigation of a critical Linux kernel privilege-escalation (“Copy Fail”) with no customer impact, disclosure and patching of request-smuggling vulnerabilities in Pingora OSS (fixed in Pingora 0.8.0), and an ACME certificate-validation logic vulnerability that Cloudflare mitigated. Broad themes include post-quantum cryptography (IPsec PQ GA and a 2029 PQ roadmap), expanded AI/LLM security controls (AI Security for Apps GA, Cloudy explanations, AI
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cloudflare_security_blog
- Record identifier
- f382481a7db6e2520a32fd9e1403f1f591779c32596fcf6a3623e37846287844
- Enrichment time
- 2026-06-01T19:24:08Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.