Email Security adds post-quantum key exchange for MX deployments
Cloudflare Email Security now supports post-quantum hybrid key exchange with X25519MLKEM768 on SMTP connections, protecting email traffic against harvest-now, decrypt-later attacks. The feature is backwards compatible and automatically enabled for all customers across all Email Security packages.
Cloudflare Email Security now supports post-quantum hybrid key exchange with X25519MLKEM768 on the SMTP connections we make to receive and deliver mail. Deploying Email Security in front of a provider that supports post-quantum hybrid key agreement (like Google Workspace) will create a TLS 1.3 connection using post-quantum key agreement.
Inbound MX connections and outbound delivery connections now negotiate the X25519MLKEM768 hybrid key agreement when the peer supports it, protecting SMTP traffic against harvest-now, decrypt-later ↗ attacks.
Support is backwards compatible and enabled automatically for all customers. Senders and receivers that do not yet advertise post-quantum key agreement continue to connect with classical key exchange.
This applies to all Email Security packages:
- Advantage
- Enterprise
- Enterprise + PhishGuard
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Rules - Remove surrounding bytes with trim functions
Cloudflare Rules now supports three new functions—trim(), trim_start(), and trim_end()—to remove surrounding bytes from values before comparison. These functions work across all HTTP products on all plans and can remove ASCII whitespace by default or custom byte sets specified as an optional parameter.
DNS - Configure Advanced Custom Nameservers with nameserver sets
Nameserver sets are now available in beta for Enterprise accounts, allowing you to group custom nameserver names with Cloudflare-assigned IP addresses and assign them to multiple zones. This new approach replaces legacy custom_ns sets with reusable, immutable objects that support up to 3 IPv4 and 3 IPv6 addresses per nameserver and can leverage Advanced anycast network groups for improved resiliency.
Emergency WAF managed rule for active RCE vulnerability
Cloudflare released an emergency WAF update with a new managed rule to block exploitation of a critical remote code execution vulnerability in popular web frameworks. The Generic Rules - Remote Code Execution detection prevents attackers from executing arbitrary system commands via malicious input with invalid path sequences.