Loading story…
Cloudflare introduced CryptoLabe, an internal AI-assisted cryptographic discovery and inventory system supporting its goal of complete post-quantum readiness by 2029. The platform examines immutable, read-only snapshots of repositories and related configurations, manifests, scripts, tests, documentation, tickets, and dependencies to locate cryptographic implementations, assess runtime context, classify findings, and surface migration dependencies. It distinguishes conventional encryption, signatures, and JWT deployments from post-quantum-ready mechanisms, including TLS 1.3 X25519MLKEM768 hybrid key exchange and ML-DSA.
The company said CryptoLabe is intended to prioritize engineering work rather than provide definitive coverage: findings must be validated by system owners because Cloudflare has no ground-truth dataset to measure prompt performance. The inventory has highlighted difficult dependencies, including insufficient library and issuer support for post-quantum JWTs, absent post-quantum SAML support, and HTTP header certificate-size limits. JWTs, standardized in RFC 7519 as signed, MACed, and/or encrypted JSON claims containers, remain a significant migration concern because their security depends on context-appropriate cryptographic protection and interoperable issuer and verifier support.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
The IETF published RFC 7519 as a Standards Track specification defining JWTs, including signed, MACed, encrypted, nested, and unsecured token forms, registered claims, validation procedures, and implementation requirements.
Cloudflare developed CryptoLabe, an internal AI-assisted cryptographic inventory tool that scans repositories and related data to identify cryptography, assess post-quantum readiness, and surface migration blockers. The company uses it to support a target of complete post-quantum readiness by 2029, while requiring engineering teams to validate findings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare has added post-quantum authentication to **Authenticated Origin Pulls** and **Custom Origin Trust Store**, enabling customers to use **ML-DSA** signatures for Cloudflare-to-origin TLS and build fully post-quantum-secure mutual TLS on that link. The company said the protection is effective only if organizations also remove trust in classical authentication paths to avoid downgrade attacks, and positioned the release as a key step toward its stated goal of full post-quantum security by 2029. Cloudflare also noted that post-quantum authentication for browser-facing WebPKI traffic will follow a different approach based on **Merkle Tree Certificates**. The rollout comes amid broader industry acceleration toward quantum-safe security. Cloudflare Radar has been tracking worldwide post-quantum encryption adoption, while Microsoft said the timeline for quantum risk is shifting and urged faster migration planning. Cloudflare said the new capability required changes across its Go-based control plane and **Pingora Origin** data plane, and disclosed that a **BoringSSL** upgrade triggered a June 10, 2026 incident when stricter `KeyUsage` enforcement caused compatibility problems before the issue was patched and resolved.
Jul 29, 2026
The U.S. government is accelerating post-quantum cryptography adoption across federal systems and the defense industrial base, with new executive and Defense Department directives setting milestones for agencies and contractors to support PQC by 2030 and use it by 2031. Reporting on the Pentagon’s strategy says the Cybersecurity Maturity Model Certification program will be updated with quantum-resistant requirements, while broader federal policy frames a two-track quantum strategy that combines defensive migration with continued national quantum advancement. Officials and industry sources warn that many contractors remain unprepared, even as governments and security agencies increasingly cite **Harvest Now, Decrypt Later** as a current risk to long-lived sensitive data. At the same time, industry is arguing that organizations cannot delay deployment waiting for better algorithms, even as implementation flaws raise fresh concerns around today’s standards. Cloudflare said `ML-DSA`, standardized alongside `ML-KEM`, is imperfect but the most practical near-term signature option and remains central to its plan for full post-quantum security by 2029. Separate research coverage highlighted practical key-recovery attacks against buggy `ML-DSA` implementations, including failures involving nonce reuse and corrupted signing randomness, underscoring that migration urgency must be matched by rigorous engineering, testing, and protections against side-channel and randomness-leakage failures.
Jul 14, 2026
Security teams are accelerating **post-quantum cryptography (PQC)** planning as quantum computing threatens widely used public-key algorithms such as **RSA** and **ECC**, with particular concern for long-lived data and identity systems. Gopher Security argues that AI-agent identity and authorization flows—especially those relying on asymmetric signatures (e.g., **JWT** signing) and emerging AI integration patterns like the **Model Context Protocol (MCP)**—could be exposed to “harvest now, decrypt later” collection and future signature-forgery/impersonation risks if organizations delay migration; it also notes that simply increasing symmetric key sizes (e.g., moving to **AES-256**) does not address the asymmetric identity layer. Separately, Europol-coordinated research (as reported by Help Net Security) provides a practical prioritization framework for **financial institutions** to decide where PQC migration should start, combining a **Quantum Risk Score** (based on data “shelf life,” exposure, and business impact) with an estimate of **migration time/complexity** so leadership can sequence upgrades defensibly rather than attempting a “big bang” replacement. Additional Gopher Security material frames the same broader shift as a machine-identity problem—where service accounts, microservices, and automated connections dominate—and emphasizes modern transport protections (e.g., **TLS 1.3**) and stronger integrity/verification approaches for machine-to-machine data access, aligning with the need to modernize cryptographic controls as part of PQC readiness.
Jul 18, 2026