Loading story…
Cloudflare published a technical post-mortem describing a 25-minute IPv6 BGP route leak that originated in Miami and propagated broadly to external networks, causing congestion, packet loss, and an estimated ~12 Gbps of dropped throughput. The incident was triggered during a routing policy change intended to limit advertisement of Bogotá-related IPv6 prefixes in Miami; deletion of a prefix list made the export policy overly permissive, allowing internal iBGP IPv6 routes to be accepted and then advertised to external neighbors. Cloudflare characterized the event as a hybrid of RFC 7908 Type 3 and Type 4 route leaks, where routes learned from peers/providers were inappropriately redistributed to other peers/providers, violating “valley-free” routing expectations.
Reporting highlighted that while the primary impact was availability and performance degradation, route leaks can also carry a security risk when misrouted traffic is attracted to networks not intended to transit it, creating conditions that can resemble or enable interception in BGP hijacking scenarios. In this case, the misadvertisements were automatically propagated to BGP peers in the region, and in environments using strict source/provider-based filtering, some traffic would be discarded entirely rather than delivered, amplifying outage-like symptoms beyond Cloudflare’s direct customer base.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Cloudflare later disclosed technical details of the incident, attributing it to an accidental router policy misconfiguration and comparing it to a similar July 2020 event. The company said it would implement stricter export safeguards, CI/CD policy validation, improved early detection, and support for RFC 9234 and RPKI ASPA to reduce future route leaks.
Shortly after the leak began, Cloudflare detected the issue, manually reverted the router configuration, and paused automation to stop further propagation. The company ended the impact within about 25 minutes and later reverted the triggering code change before safely re-enabling automation.
On January 22, 2026, Cloudflare accidentally leaked internal IPv6 routes from Miami to external peers after a routing policy change meant to stop Miami from advertising Bogotá prefixes became overly permissive. The incident caused congestion, packet loss, and roughly 12 Gbps of dropped traffic, and was characterized as a mix of RFC 7908 Type 3 and Type 4 route leaks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenBSD disclosed **CVE-2026-56099**, a medium-severity flaw in the MPLS subsystem that can expose kernel stack memory to a remote attacker when MPLS is enabled on an interface. The bug is in `mpls_do_error()` in `sys/netmpls/mpls_input.c`, where a crafted MPLS packet with **16 labels** and no **Bottom-of-Stack** bit causes the kernel to copy **17 shim headers** from a **16-entry** local stack array, leaking **4 bytes** of adjacent kernel stack data in an ICMP/MPLS error response. The issue affects OpenBSD `-current` before the fix and traces back to code introduced in 2010 in the ICMP/MPLS error-handling path. Exploitation requires an attacker to send an MPLS frame with EtherType `0x8847`, an outer label TTL of `1`, and an IPv4 inner payload; researchers at **Argus Systems** reported the vulnerability, and OpenBSD corrected it by rejecting label stacks that reach the maximum depth without a BoS bit.
Jun 29, 2026
Infoblox researchers reported a widespread **DNS hijacking** campaign targeting **outdated consumer/home routers** across **more than three dozen countries**, where attackers compromise devices and change router-level DNS settings to silently redirect all connected users’ traffic. The manipulated DNS queries are sent to malicious resolvers hosted by **Aeza International**, a **Russian bulletproof hosting provider** that the US sanctioned in **July 2025**, allowing threat actors to control where victims are routed while keeping common destinations working to reduce suspicion. The infrastructure reportedly uses a **two-stage redirection chain**: DNS traffic is forwarded into an **HTTP-based Traffic Distribution System (TDS)** that first verifies the request originates from a compromised router and then fingerprints/filters victims before sending them onward—often into **advertising/affiliate networks** that can lead to **scams or malicious sites**. Analysts also described an evasion behavior where the rogue resolvers may only respond under specific query conditions (e.g., when **EDNS0** is disabled), complicating reproduction and detection; user-visible symptoms included selective site failures and persistent redirects that victims often misattributed to endpoints rather than the router.
Jun 29, 2026
Red Hat disclosed **CVE-2026-43037**, a critical Linux kernel flaw in the `ip6_tunnel` component that can be triggered by malicious ICMPv6 error messages against IPv4-over-IPv6 tunnel handling. The bug stems from reusing a cloned socket buffer control block with incompatible IPv6 and IPv4 metadata layouts, a form of **type confusion** tracked by MITRE as `CWE-843`. In the vulnerable path, `__ip_options_echo()` can interpret attacker-controlled packet data as IPv4 option data and copy an attacker-influenced length into a fixed 40-byte stack buffer, creating stack-based memory corruption that can cause denial of service and potentially arbitrary code execution with kernel privileges. Red Hat rated the issue **CVSS 8.8** and published fixes across multiple RHEL and related product streams, including **RHSA-2026:27719** for RHEL 6 Extended Lifecycle Support Extension. The upstream fix clears `skb2->cb[]` before calling `icmp_send()` and adds minimal IPv4 header validation requiring version 4 and an IHL of at least 5. Red Hat said updated kernel packages are available, including `kernel-2.6.32-754.61.1.el6` for affected RHEL 6 ELS architectures, advised customers to reboot after applying updates, and recommended preventing the `ip6_tunnel` module from loading as a temporary mitigation until patches are installed.
Aug 25, 2026