Cloudflare incident: skipped block zeroing leaked tenant data across 18 of 24 containers
arpit_bhayani · x · 2026-09-28
Arpit Bhayani breaks down a Cloudflare incident around zeroing storage in a multi-tenant system.
- The shared pool reused deleted blocks without zeroing. Since thin volumes allocate on first write, a 4 KiB write grabs a recycled 64 KiB block — the remaining 60 KiB holds the previous tenant's data.
- Residual data was found on 18 of 24 container placements and 20 of 22 nodes: other customers' directory listings, database pages, complete SQLite databases, Chromium profiles, .env and credential files.
- Skipping zeroing is usually a performance trade-off (extra I/O per reclaimed block).
- Advice: if you build on shared block storage, thin provisioning, or pooled volumes, check what happens to a block between owners. The issue is now fixed.
Related event: Cloudflare Patches Cross-Tenant Leak from Unwiped Storage Blocks(2 posts)→
More from Infra
- Lightning AI and Google Cloud cut PyTorch Lightning checkpoint write times by up to 95% — LightningAI · 2026-09-28
- Crucible Capital founder financed her own GPU cluster with stablecoin debt and personal credit risk — MarvinTBaumann · 2026-09-28
- NVIDIA launches Open Agent Safety Platform for controlling what AI agents can do — nvidia · 2026-09-28
- MLX MoE Layer Gets 1.5x Faster via Better Tile Scheduling in Grouped Matmul — awnihannun · 2026-09-28
- On RTX 5090, Qwen 27B hits 200 TPS but Flash next only 50: what model sits between for coding? — MasterNomie · 2026-09-28
- Lumen Launches On-Demand Dedicated Internet Up to 100 Gbps at 10M US Sites — shashib · 2026-09-28