Security Architect: 2026-09-25

1. How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

   Cloudflare, 2026-09-24. Read, 9 min.

   Cloudflare says a researcher from Accomplish reported on September 4 that a customer with a Workers Paid account could recover residual disk blocks previously used by Containers on the same multi-tenant host, though the technique could not target a particular customer and residual data was not guaranteed to be present. Cloudflare applied a fix across the Containers fleet with no customer configuration changes required, and says it found no evidence of malicious exploitation within the historical telemetry available to it.

   Why it matters for this role: When you review a multi-tenant design, check that remediation covers storage already allocated, since Cloudflare found that fixing new allocations left existing disks and cached layers exposed.

2. Forging 1024-bit RSA signatures in nearly SNFS time

   IACR Cryptology ePrint Archive, 2026-09-22. Read, 2 min.

   In a preprint, researchers from UC San Diego and INRIA implemented a 2007 algorithm that forges RSA signatures without factoring the key, given temporary access to a raw RSA signing or decryption oracle, and ran it against 1024-bit RSA using a hardware security module as the oracle in 1380 CPU core-years over five calendar months. They conclude that RSA's concrete security with a signing oracle should be 15 to 30 bits lower than factoring-based estimates for the 1024-bit to 4096-bit parameters common in practice.

   Why it matters for this role: The authors present this as classical evidence for moving away from RSA during the post-quantum transition, which bears on any design that exposes a raw RSA signing or decryption operation.

3. Don't let TEEs break your MPC

   Trail of Bits, 2026-09-25. Read, 15 min.

   Trail of Bits describes pitfalls it sees in audits when threshold signature schemes run inside trusted execution environments, such as a malicious host that could roll back a signer's filesystem state so the signer reuses a nonce share and discloses its private key share. It recommends strong attestation processes bound to the identities of the MPC parties.

   Why it matters for this role: Threshold signers placed inside enclaves still need attestation that measures every critical component and is bound to each party's identity, which Trail of Bits names as best practice after seeing incomplete measurements in audits.

Security Architect