Cloudflare Zero Wire: What the AI Prompt and WAF Chart Show

On Nov. 3, Cloudflare launched Zero Wire, a public feed of critical-vulnerability briefings inside Cloudflare Radar. The announcement leans on AI. The product, as the company describes it, is closer to a well-edited index card plus a prompt you run on your own agent.

Cloudflare's post on X, Nov. 3, 2026, announcing Zero Wire on Cloudflare Radar (@Cloudflare)

View on X

The post from @Cloudflare reads: "Introducing Zero Wire: a public vulnerability intelligence feed on @CloudflareRadar, bringing the clarity of a news wire service to critical security developments." It links to a Cloudflare blog post by Daniele Molteni and Celso Martinho, which is where the details are. We read it end to end. The Radar pages themselves sat behind a browser check when we tried them, so everything below about how the feed looks comes from Cloudflare's own description.

An index card, not a CVE catalog

Each Zero Wire briefing, according to the post, bundles a plain-language explanation, who should investigate, recommended actions, and links to evidence and vendor guidance. Cloudflare calls it "an index card with what you need to know, without the drama."

The scope is narrow on purpose. The post says Zero Wire is not "a catalog of every CVE" and instead focuses on critical flaws in Internet-facing software: web applications, the runtimes and libraries under them, and exposed services. The homepage splits entries into "Needs attention" (known exploitation or developing guidance) and "Reference" (guidance has stabilized). Cloudflare adds a warning that matters: moving to Reference "does not mean every affected system has been patched."

What the post doesn't publish is the selection rule. It says only "we select significant issues." There's no stated severity threshold, no count of briefings, and no promise on how fast one appears after a disclosure.

The AI is a prompt you carry home

The AI claim comes first in the post: "AI is changing both the volume and speed of critical vulnerability discovery." That's Cloudflare's thesis, offered without a measurement. The product-side AI is smaller: "a pre-compiled prompt you can use with your agent to assess the impact on your infrastructure."

The prompt asks for a read-only assessment of your deployed software, relevant vendor fixes, exposure and compensating controls, with per-asset evidence, unknowns and next actions. Cloudflare is explicit that "copying the prompt does not itself scan or change systems."

Our reading: that's the right call, and it also means the model, the inventory and the permissions are all yours. A prompt can only reason about what your agent can see. Cloudflare hasn't published any accuracy or false-positive testing for it, so treat the first run as a draft to check by hand. If you try it, hand the agent a software inventory export, not credentials.

What the WAF chart counts

The telemetry sits in the php2shell briefing, which charts "the volume of HTTP requests matching Cloudflare WAF managed rules over time." Cloudflare then sets the limits itself: those requests "are not a count of compromised systems or successful exploits," and a lack of observed attempts on its network "does not establish that exploitation is absent elsewhere."

So the chart is a gauge of attacker attention, seen only from traffic that passes through Cloudflare. Useful for the question "are people actually trying this?" Not useful for "was I hit?" The post doesn't give the chart's numbers, so there's no figure to quote here.

The same company's earlier php2shell post shows why the signal is worth having. Cloudflare says the flaws leaked before the official release date, that it saw attack traffic against customers, and that attackers kept mutating payloads to try to get past its rules.

Where a WAF rule stops

php2shell is also the cleanest example of the line Cloudflare draws in the Zero Wire post: a WAF rule "is not a replacement for fixing vulnerable software."

According to Cloudflare's post, CVE-2026-109618 and CVE-2026-109619 were disclosed on Oct. 21 and affect PHP 5.4 or later; its WAF protections were live by default from 3:02 a.m. UTC that day. Cloudflare still tells customers to patch, and notes that updating a plugin or site code doesn't fix a runtime flaw. PHP's news page lists the fixed releases: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Then comes the part a briefing card can't fully carry. An update Cloudflare added on Oct. 23 covers a related bug, CVE-2026-115560, in PHP's session upload progress feature. Cloudflare says its rule protects sites that use the default field name, and that customers who changed session.upload_progress.name "are not covered." PHP's own advice, on its news page, is to set session.upload_progress.enabled=0 until the next regular release, while calling the setup needed to trigger it unusual.

That's the working lesson. A briefing points you at the vendor advisory; the advisory holds the setting.

Open questions

Do I need to be a Cloudflare customer? No. Cloudflare says the information "is useful whether or not you are a Cloudflare customer." Its WAF links, though, lead to dashboard settings for paid and free plans.

Does it include exploitation evidence? Yes, where it exists. Briefings link out to sources such as CISA's Known Exploited Vulnerabilities Catalog.

How often is it updated? Unconfirmed. The post mentions an update chronology and a last-checked date on each card, but gives no schedule.

Is there an API or RSS feed? Unconfirmed. The post doesn't mention one; it points readers to @CloudflareRadar on X and @radar.cloudflare.com on Bluesky for updates.

Before you trust the last-checked date

Open the first briefing that matches something you run and read three fields before you act: the status, the last-checked date and the update chronology. Cloudflare says known exploitation, an ongoing investigation and an available fix "describe different things," and a card in Reference can still describe a hole in your own stack. Then go to the vendor advisory it links, because that's where the version numbers and the config switches live.

Source: Cloudflare Blog

cloudflare zero wire cloudflare radar waf cve

AI

About the author

AI Briefing Daily Editorial. The editorial desk of AI Briefing Daily, an independent publication covering artificial intelligence. Every story is researched against primary sources, checked by hand and reviewed by a person before publication.