Loading story…
Cloudflare is acquiring Deno, the startup founded by Node.js creator Ryan Dahl, and bringing its engineering team into Cloudflare Workers. The acquisition will wind down Deno’s standalone runtime and hosting service: the runtime will receive monthly maintenance and security updates for one more year before development ends, while Deno Deploy will shut down in six months. These deadlines create migration and support-lifecycle concerns for organizations relying on Deno applications or hosted workloads.
Cloudflare plans to merge Deno’s Celld project with its open-source Workers runtime, workerd, to improve support for distributed applications running on independently managed infrastructure. The JSR package registry will continue under Cloudflare, and paying Deno Deploy customers will receive migration assistance. Organizations using Deno should inventory affected workloads, plan hosting transitions before Deploy closes, and assess long-term runtime options before the announced maintenance and security-update period expires.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
Cloudflare misidentified TypeScript files as video content and blocked Deno's website and module registry, forcing Deno to move infrastructure elsewhere.
Node.js creator Ryan Dahl introduced Deno, a JavaScript and TypeScript runtime, to address shortcomings in Node.js, particularly security and dependency management.
Cloudflare announced that Deno's entire team would join its Workers organization, with Ryan Dahl and Bert Belder leading a planned combination of Deno's Celld project and Cloudflare's workerd runtime. The announcement outlined another year of monthly maintenance and security updates before standalone Deno development ends, a Deno Deploy shutdown in six months with migration assistance for paying customers, and continued operation of the JSR package registry under Cloudflare.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability, tracked as CVE-2025-61787, was identified in Deno, a runtime for JavaScript, TypeScript, and WebAssembly. The flaw specifically affects Windows systems and allows for command injection when batch files are executed. The vulnerability arises because, on Windows, the CreateProcess() function implicitly invokes cmd.exe when executing batch files, even if the application does not explicitly specify it. This behavior enables attackers to inject arbitrary commands if they can influence the batch file execution process. Deno versions prior to 2.5.3 and 2.2.15 are confirmed to be vulnerable to this issue. The vulnerability is remotely exploitable, increasing the risk for systems running affected Deno versions on Windows. Security advisories highlight that the issue is fixed in Deno versions 2.5.3 and 2.2.15, and users are urged to upgrade to these or later versions to mitigate the risk. The vulnerability was disclosed publicly in early October 2025, and its high CVSS score of 8.1 reflects the significant risk it poses. The flaw could potentially allow attackers to execute arbitrary commands with the privileges of the Deno process, leading to system compromise or further lateral movement. The vulnerability does not appear to affect non-Windows platforms, as the underlying issue is tied to Windows-specific process creation behavior. No reports of active exploitation have been confirmed at the time of disclosure, but the remote exploitability and ease of triggering the flaw make it a priority for patching. The Deno development team responded promptly by releasing patched versions and providing detailed advisories to the community. Organizations using Deno in production on Windows are strongly advised to audit their deployments and ensure all instances are updated. Security teams should also review application logic to ensure that untrusted input cannot influence batch file execution. The vulnerability underscores the importance of understanding platform-specific behaviors in cross-platform runtimes. Deno's maintainers have also recommended additional security best practices for users who cannot immediately upgrade. The disclosure has prompted broader discussions about secure process execution and command injection risks in modern runtimes.
Jun 29, 2026
Multiple upstream language/runtime and core library projects disclosed and/or patched significant vulnerabilities affecting widely deployed developer and production environments. **Deno** reported two issues: **CVE-2026-22863** (CVSS 9.2) in the `node:crypto` compatibility layer where `cipher.final()` fails to properly finalize/close cipher state, enabling “infinite encryptions” that could aid attacks aimed at learning server secrets; and **CVE-2026-22864**, a Windows-specific command execution weakness involving a bypass in `Deno.Command` protections when executing batch files, undermining intended shell-injection safeguards. **glibc** maintainers disclosed **CVE-2026-0861** (CVSS 8.4), an integer overflow in `memalign`, `posix_memalign`, and `aligned_alloc` affecting versions 2.30–2.42 that can lead to heap corruption when an attacker can control unusually large `size` values and alignment parameters, and **CVE-2026-0915**, a decades-old information leak in `getnetbyaddr`/`getnetbyaddr_r` affecting versions 2.0–2.42 that can expose uninitialized stack contents to DNS backends when querying a zero-valued network. Separately, the **Go** team released security updates (*Go* 1.25.6 and 1.24.12) addressing six vulnerabilities across the standard library (e.g., `archive/zip`, `net/http`, `crypto/tls`) and the toolchain, including a ZIP-processing CPU-exhaustion DoS (**CVE-2025-61728**) and toolchain issues that could enable command execution in certain developer/build scenarios; organizations running Go services or CI/build pipelines were advised to upgrade to the patched releases.
Jun 29, 2026