Loading story…
Check Point Research disclosed five vulnerabilities in workerd, the open-source runtime behind Cloudflare Workers and Cloudflare Code Mode, describing two primary attack paths: cross-tenant memory exposure in the managed Workers environment and a sandbox escape in Code Mode that can lead to native code execution on the host in self-hosted deployments. The researchers said the issues stem from native C++ glue code and the tcmalloc heap operating outside core V8 isolation protections, creating exploitable conditions even where V8 sandboxing and memory protection keys are enabled.
Cloudflare rated two of the flaws Critical and said fixes have already been deployed in the managed Workers production environment. Organizations running self-hosted deployments were advised to upgrade to workerd v1.20260619.1, while Check Point said it has released proof-of-concept code alongside its Black Hat USA 2026 presentation, increasing the urgency for defenders to validate patch status and review exposure in any self-managed workerd instances.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Check Point Research submitted four of the five discovered workerd vulnerabilities to Cloudflare through HackerOne under coordinated disclosure. The reports covered issues later tied to Cloudflare Workers and Code Mode impact.
Check Point Research publicly released proof-of-concept code for the vulnerabilities as part of its Black Hat USA 2026 presentation. The release accompanied public disclosure of the attack paths affecting Cloudflare Workers and Code Mode.
Cloudflare released workerd version 1.20260619.1 to remediate the reported vulnerabilities in self-hosted deployments. The company rated two of the five vulnerabilities as Critical.
Cloudflare confirmed to the researchers that the vulnerabilities reproduced on production, except for the original URLPattern implementation, and that the tcmalloc heap sat outside V8 sandbox and memory protection key protections. Cloudflare also fixed the managed Workers environment in production.
Based on the discovered bugs, Check Point Research built two end-to-end exploit chains: one demonstrating cross-tenant secret leakage in Workers and another achieving host native code execution from a prompt-injection starting point in self-hosted Code Mode testing. The researchers said they did not run the cross-tenant exploit on Cloudflare production because a crash could affect other tenants.
Check Point Research analyzed Cloudflare Code Mode and the underlying open-source workerd runtime, identifying five vulnerabilities in native C++ components. The issues included URLPattern out-of-bounds reads, zlib and HTMLRewriter use-after-free bugs, and a Durable Objects KV SQL bypass.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceresearch.checkpoint.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a remote **Spectre** attack against **Cloudflare Workers** that extracted a JSON Web Token from a co-located Worker running in Cloudflare’s production environment at up to **12 bits per second**. The attack targeted separate **V8 isolates** sharing the same process, using WebSocket communications as a remote timing source and long-lived **Durable Objects** to bypass assumptions in Cloudflare’s Dynamic Process Isolation (`DyPrIs`) design. Testing reportedly succeeded on Linux servers with AMD EPYC Zen 2 and Zen 3 processors, with lower system load improving leakage rates while slower exfiltration remained possible under heavier load. Cloudflare said the research did **not** access customer data and that it found no signs of active exploitation during the past three years, but acknowledged limitations in its production isolation model and detailed hardening steps. The company said it mitigated the issue by improving `DyPrIs`, integrating the **V8 Sandbox**, and deploying **MPK-based in-process isolation** to better contain speculative-execution attacks in multi-tenant Worker environments. The disclosure highlights that speculative side-channel risks can persist even in sandboxed serverless platforms when attacker and victim workloads are co-located within the same process.
Aug 19, 2026
Researchers disclosed a broad set of critical flaws in the `vm2` Node.js sandbox library that allow untrusted JavaScript to break isolation and execute arbitrary code on the host system. Reports describe 11 to 12 vulnerabilities affecting versions across the `3.9.6` to `3.11.1` range, with most rated `CVSS 9.8` to `10.0`, and impacting core protections such as built-in allowlists, object handling, prototype traversal, Promise species behavior, `util.inspect`, `Module._load()`, WebAssembly exception handling, and unsafe `nesting: true` configurations. One tracked issue, **CVE-2026-24118**, is a sandbox breakout through `__lookupGetter__` in versions prior to `3.11.0`, enabling host-level command execution with no privileges or user interaction. The disclosures reinforce long-running concerns that `vm2`'s JavaScript-only isolation model is not dependable for high-risk use cases such as multi-tenant code execution, plugin evaluation, automated grading, and serverless workloads. While some reports recommend upgrading to **vm2 `3.11.2`** for the latest protections, others note that **CVE-2026-44008** and **CVE-2026-44009** remain unpatched and argue that organizations handling untrusted code should consider stronger isolation boundaries such as containers or microVMs. Successful exploitation could expose environment variables, credentials, and files, and enable full compromise of the underlying Node.js host and potential lateral movement.
Jun 29, 2026
Check Point researchers disclosed critical security flaws in **Claude Code**, reporting that the issues could expose developers and organizations to **remote code execution**, sensitive data leakage, and broader compromise of development environments. The findings indicate that weaknesses in how the coding assistant handled untrusted content and tool interactions could let attackers manipulate outputs, trigger unsafe actions, or access information that should remain protected. The disclosure places AI-assisted development tools under the same scrutiny long applied to major software supply-chain and application-security incidents such as **Apache Log4j `CVE-2021-44228`**, which became a benchmark for rapidly exploitable software flaws with wide downstream impact. The report underscores that coding assistants embedded in developer workflows can become high-value targets, and that organizations using them should review trust boundaries, sandboxing, secret handling, and monitoring around automated code-generation and execution features.
Jul 12, 2026