Cloudflare Containers Exposed Cross-Tenant Disk Blocks as PQ TLS CA Plans Advance

Cloudflare’s October 5 announcements show two sides of platform security: expanding cryptographic infrastructure while correcting a storage-isolation failure in Containers and Sandboxes. A Workers Paid customer could recover residual disk blocks from other customers’ containers because reused thin-provisioned blocks were not zeroed, while Cloudflare also announced plans for a free public Certificate Authority for quantum-safe TLS certificates. Together, the developments make storage sanitization and cryptographic migration concrete platform-operating concerns, not just boundary or protocol design issues.

• A cross-tenant flaw in Cloudflare Containers, which also underpins Sandboxes, allowed a Workers Paid customer to recover residual disk blocks from other customers’ containers on the same host.
• Researchers recovered directory structures, database pages and complete SQLite databases across four continents; Cloudflare remediated the issue and reported no evidence of malicious exploitation.
• The failure was in the storage allocator beneath the virtual-machine boundary: thin-provisioned storage pools reused blocks without zeroing them.
• Cloudflare announced plans for a free public Certificate Authority issuing quantum-safe TLS certificates, using Merkle Tree Certificates to reduce payloads while supporting certificate transparency and revocation.
• Cloudflare’s 16th-birthday roundup listed 46 announcements spanning open source, post-quantum security, AI agents and developer-platform upgrades.

Bottom line If you run Cloudflare Containers or Sandboxes, review tenant-isolation and residual-data handling now; otherwise, skim unless you are planning a post-quantum TLS migration.