InfoSecBulletin Cybersecurity for mankind
Cloudflare disclosed that its internal Atlassian server was breached by a suspected ‘nation-state attacker’. The attacker gained access to Cloudflare’s Confluence wiki, Jira bug database, and Bitbucket source code management system.
Gmail Data exposes via ChatGPT Deep Research Agent dubbed “ShadowLeak Zero-Click” Flaw
Cyber attack disrupts several European airports: check-in and boarding systems affected
Hacker claim to breach Link3; 189,000 Users data up for sale
Check Point Hosts “Securing the Hyperconnected World in the AI Era” in Dhaka
Microsoft Confirms 900+ XSS Vulns Found in IT Services
Daily Security Update Dated : 15.09.2025
IBM QRadar SIEM Vuln Let Attackers Perform Unauthorized Actions
Major Australian Banks using Army of AI Bots to Scam Scammers
F5 to acquire CalypsoAI for $180M for Advanced AI Security Capabilities
AI Pentesting Tool ‘Villager’ Merges Kali Linux with DeepSeek AI for Automated Attacks
The attacker first accessed Cloudflare’s self-hosted Atlassian server on November 14, and then accessed the company’s Confluence and Jira systems after gathering information.
“They then returned on November 22 and established persistent access to our Atlassian server using ScriptRunner for Jira, gained access to our source code management system (which uses Atlassian Bitbucket), and tried, unsuccessfully, to access a console server that had access to the data center that Cloudflare had not yet put into production in São Paulo, Brazil,” said Cloudflare CEO Matthew Prince, CTO John Graham-Cumming, and CISO Grant Bourzikas,
Using stolen access credentials from a previous breach linked to Okta’s compromise in October 2023, the attackers gained unauthorized entry by utilizing one access token and three service account credentials. Cloudflare failed to update these credentials, which were leaked alongside thousands of others during the Okta breach.
Cloudflare detected malicious activity on November 23. They blocked the hacker’s access on the morning of November 24. Their cybersecurity forensics team started investigating the incident on November 26, three days later.
Cloudflare’s staff took several security measures in response to the incident. They changed over 5,000 production credentials and separated the test and staging systems. They also investigated 4,893 systems, reimaged and rebooted all systems on the global network, including Atlassian servers and machines accessed by the attacker.
The hackers tried to break into Cloudflare’s data center in São Paulo, but they failed. All equipment in the center was sent back to the manufacturers to make sure it was completely secure.
Remediation efforts ended on January 5th. The company’s staff is still working on strengthening software, managing credentials, and vulnerabilities.
The company assures that this breach did not affect any customer data or systems of Cloudflare. Additionally, their services, global network systems, and configuration were not impacted either.
“Even though we understand the operational impact of the incident to be extremely limited, we took this incident very seriously because a threat actor had used stolen credentials to get access to our Atlassian server and accessed some documentation and a limited amount of source code,” said Prince, Graham-Cumming, and Bourzikas.
