Field notes from the edge.
What our engineers learned this week. Hands-on technical deep-dives, postmortems, and strategy frameworks.
AISecure all your internal vibe-coded applications — in one click
Cloudflare has launched new security tools that allow organizations to automatically protect internal applications built on Workers with Cloudflare Access authentication. The solution addresses the security risk of employees rapidly building and deploying AI-enabled applications that could accidentally expose company data, by enabling CISOs to enforce authentication policies at the account level o
AI6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
Device code phishing, which exploits the OAuth 2.0 device authorization grant to steal access tokens, has rapidly escalated from a specialized red-team tactic to a widespread enterprise threat in less than six months. Originally designed for input-limited devices like smart TVs and printers, the device authorization flow has been adopted across numerous applications beyond its intended scope, crea
AIThe Onboarding Password Mistake That Creates Unnecessary Risk
IT teams often create temporary passwords for new employees during onboarding, but these credentials frequently remain unchanged and are shared insecurely via email or SMS. This common practice creates significant security vulnerabilities as temporary passwords may be reused across multiple accounts and never properly rotated, exposing organizations to unnecessary risk.
AIYour AI bill is out of control. Cloudflare can fix it now.
Cloudflare is addressing the growing challenge of uncontrolled AI spending with new spend management features in its AI Gateway service. The company is launching spend limits in open beta and identity-driven budgets in closed beta, enabling organizations to track, attribute, and control AI costs at the user, team, and model level. These tools aim to solve the common problem of shared API keys and
AIFBI-Flagged Phishing Kit Kali365 Expands Its Reach
The FBI-flagged Kali365 phishing-as-a-service platform has expanded beyond its original Microsoft 365 targets to now include AWS, Okta, and Russian platforms. The threat actor toolkit leverages device code phishing techniques to compromise enterprise authentication systems across multiple cloud service providers.
AIWith Complex Cloud Integrations, Small Errors Lead to Major Compromises
Security researchers uncovered a critical exploit chain in a widely-used automation service that leveraged over-permissioned roles, exposed secrets, and compromised non-human identities. The discovery highlights how seemingly minor misconfigurations in complex cloud integrations can cascade into major security vulnerabilities. This case underscores the growing risk surface created by interconnecte