Cloudflare Launches Zero Wire, a Public Feed of Critical Web Flaws

Cloudflare has launched Zero Wire, a public feed on Cloudflare Radar that explains critical web flaws in plain language, with who should check them and what to do next.

You don’t need to be a customer to read it.

What Zero Wire is

Cloudflare’s Zero Wire announcement, published on November 3, pitches it as a news wire for critical security developments. It sits in Radar’s security section.

It doesn’t try to list every CVE. It picks critical flaws in Internet-facing software: web apps, the runtimes and libraries under them, and exposed services.

Each briefing covers:

• A plain-language overview: what happened and which teams should investigate.
• “What to do now”, a short list of next steps.
• Links to evidence, such as CVE records and CISA’s Known Exploited Vulnerabilities Catalog.
• An update chronology, plus a last-checked date.
• A Cloudflare section on any WAF rule that helps.

The homepage splits briefings into “Needs attention” and “Reference”. So what does “Reference” mean? The guidance has settled, though plenty of sites may still be unpatched.

You can search by CVE or issue name, and follow technology tags.

The php2shell example

Cloudflare walks through its briefing on php2shell, the PHP runtime flaws we covered in PHP2Shell: two critical PHP flaws.

Its point is simple. Updating WordPress or a plugin doesn’t fix the PHP runtime underneath it.

Then the briefing tells you to ask three things: which PHP runtime is really running, whether the vendor’s fix has been applied, and who owns the update on your side, you or your host.

There’s also a ready-made prompt for your AI agent. It asks for a read-only check of your software, fixes and exposure.

What a WAF rule can’t do

Cloudflare is careful here, and you should be too.

• A WAF rule is a compensating control, and you still need to fix the vulnerable software.
• Blocking requests can’t undo what already happened on your server.
• Attack attempts seen on Cloudflare’s network don’t prove anyone was compromised.
• No attempts seen doesn’t prove nobody is exploiting it elsewhere.

The dashboard links in a briefing don’t switch a rule on for you, either.

Why it matters

My guess is that most small site owners never read a vendor advisory at all, and only hear about a critical flaw when their host sends an email or their own site starts acting strange.

So a public, plain-English page that says who should check what is useful, and I’d bookmark the Zero Wire homepage.

That said, it’s Cloudflare writing about flaws its own WAF can help block. I’d read the vendor’s fix first and the Cloudflare section last.

Running WordPress or Magento on shared hosting? Then the php2shell lesson is the one to keep. Ask your host which PHP version you’re on, and don’t assume a plugin update covered it.

Still want a wider routine? Our WordPress security checklist covers the rest.

Common Questions

Do I need to be a Cloudflare customer to use Zero Wire?

No. Cloudflare says the Zero Wire briefings on Cloudflare Radar are useful whether or not you’re a customer, and only the Cloudflare section in each briefing is about its own WAF and dashboard settings.

Does a Cloudflare WAF rule fix a critical vulnerability?

No. Cloudflare calls a WAF rule a compensating control, so you still need to fix the vulnerable software, and blocking requests can’t undo what already happened on your server. Apply the vendor’s fix too.

Does updating WordPress fix the php2shell flaws?

No. The php2shell flaws are in the PHP runtime, so updating WordPress or a plugin doesn’t fix the PHP runtime underneath it. Ask your host which PHP version is running and whether the vendor’s fix is applied.