HYPE OR FACT? · CHECKED 3 NOVEMBER 2026
Cloudflare Zero Wire: a free public "news wire" for critical security flaws?
OUR VERDICT
FactOur original verdict: “Fact or hype: fact. Zero Wire is live, public and free to read without an account. It launched with six detailed briefings, each with evidence links, clear next steps and an RSS feed. "The clarity of a news wire service" and "triage faster" are Cloudflare's own framing, and the feed also points readers to Cloudflare's WAF. We have read the briefings but haven't used it day to day.”
THE CLAIM
“Introducing Zero Wire: a public vulnerability intelligence feed on @CloudflareRadar, bringing the clarity of a news wire service to critical security developments.”
What’s actually true
- It exists and is public. Zero Wire is a new page in the Security section of Cloudflare Radar. We opened it and its briefings without signing in, and it has an RSS feed. Cloudflare says it is useful whether or not you are a Cloudflare customer.
- What a briefing contains, from the live php2shell example: what happened in plain words, why it needs attention, who should investigate, numbered 'what to do now' steps, a dated update history, a 'last checked' date, and evidence links to the vendor advisory, CVE records and CISA's Known Exploited Vulnerabilities list.
- The AI part: each briefing includes a ready-made prompt to paste into an AI agent that already has access to your systems. The prompt asks the agent to do a read-only assessment and to report, asset by asset, what is affected, what is fixed and what is unknown. Copying the prompt doesn't scan anything, and the result depends on your agent and the access you give it. Radar charts also have an 'Explain with AI' button. Cloudflare doesn't say whether the briefings themselves are written with AI. The RSS feed credits Cloudforce One, Cloudflare's threat-intelligence team.
- It's selective, not a full CVE database. At launch it had six briefings: five under 'Needs attention' (Linux kernel TCP, php2shell for PHP, compromised eMudhra certificates, node2shell for Brotli in Node.js, Citrix NetScaler) and one under 'Reference' (WordPress SQL injection and RCE). Cloudflare says it covers selected critical flaws in Internet-facing software.
- Why small sites should care: the php2shell briefing says sites on PHP 5.4 or later, including WordPress and Magento, need the PHP runtime itself patched, because updating a plugin doesn't fix it. If you're on managed hosting, it tells you to ask your host to confirm.
- The honest caveat: it's also a shop window for Cloudflare. Each briefing has a 'Cloudflare coverage' section saying whether WAF rules exist. Cloudflare itself calls these a compensating control, not a fix. Nothing is switched on automatically, and you still have to patch. Traffic charts show requests matching Cloudflare's WAF rules, not confirmed hacks.
- 'The clarity of a news wire service' and faster triage are Cloudflare's own claims. How often briefings will be added or updated is not yet known: the latest 'last checked' date was 2 November 2026.
Sources
Cost
Free to read, with no account needed. Cloudflare WAF protection is a separate product, with some rules on free plans and more on paid plans.
USE IT IF
Small-business and website owners, freelancers and IT leads who want a short, plain-language list of the security flaws that matter right now and what to do about them, especially if they run WordPress, PHP or Node.js.
SKIP IT IF
Anyone looking for a complete vulnerability database or an automatic scanner. Zero Wire is a curated selection, and the agent prompt only works with an AI agent you already trust with access to your systems.
How we knowChecked on 3 November 2026. Verdicts: Fact = the claim holds up; Partly fact = real, but with caveats or overstated parts; Hype = the headline claim isn't supported. Products change quickly, so check the maker's site before you buy. Our methods & sources ↗