InfoSecBulletin Cybersecurity for mankind
Cloudflare disclosed that its internal Atlassian server was breached by a suspected ‘nation-state attacker’. The attacker gained access to Cloudflare’s Confluence wiki, Jira bug database, and Bitbucket source code management system.
First couple “Rosie” to conceive using AI tech “STAR” successfully
Scattered Spider Actively Attacking Aviation and Transportation: FBI
Russia’s restrictions on Cloudflare making websites inaccessible
61 million Verizon records allegedly posted online for sale
Cyber Expert ‘Rene Joshilda’ Arrested for Bomb Hoaxes
Critical RCE Flaws in Cisco ISE and ISE-PIC Allow to Gain Root Access
CISA Warns of FortiOS Hard-Coded Credentials Vulns
5 vendors’ printer totaling 748 models affected: Rapid7
Citrix Released Emergency Patches for Actively Exploited CVE-2025-6543
SonicWall warns of a trojanized NetExtender stealing VPN logins
The attacker first accessed Cloudflare’s self-hosted Atlassian server on November 14, and then accessed the company’s Confluence and Jira systems after gathering information.
“They then returned on November 22 and established persistent access to our Atlassian server using ScriptRunner for Jira, gained access to our source code management system (which uses Atlassian Bitbucket), and tried, unsuccessfully, to access a console server that had access to the data center that Cloudflare had not yet put into production in São Paulo, Brazil,” said Cloudflare CEO Matthew Prince, CTO John Graham-Cumming, and CISO Grant Bourzikas,
Using stolen access credentials from a previous breach linked to Okta’s compromise in October 2023, the attackers gained unauthorized entry by utilizing one access token and three service account credentials. Cloudflare failed to update these credentials, which were leaked alongside thousands of others during the Okta breach.
Cloudflare detected malicious activity on November 23. They blocked the hacker’s access on the morning of November 24. Their cybersecurity forensics team started investigating the incident on November 26, three days later.
Cloudflare’s staff took several security measures in response to the incident. They changed over 5,000 production credentials and separated the test and staging systems. They also investigated 4,893 systems, reimaged and rebooted all systems on the global network, including Atlassian servers and machines accessed by the attacker.
The hackers tried to break into Cloudflare’s data center in São Paulo, but they failed. All equipment in the center was sent back to the manufacturers to make sure it was completely secure.
Remediation efforts ended on January 5th. The company’s staff is still working on strengthening software, managing credentials, and vulnerabilities.
The company assures that this breach did not affect any customer data or systems of Cloudflare. Additionally, their services, global network systems, and configuration were not impacted either.
“Even though we understand the operational impact of the incident to be extremely limited, we took this incident very seriously because a threat actor had used stolen credentials to get access to our Atlassian server and accessed some documentation and a limited amount of source code,” said Prince, Graham-Cumming, and Bourzikas.
