A Storage Fix Must Also Clear Reused State

Summary

Cloudflare’s September 24 incident report shows why a storage fix can require more than changing future allocations. The company says its Containers vulnerability is fully remediated, including cleanup of existing disks and cached images. No customer-side configuration change is required.

Key Updates

• Reused storage crossed a tenant boundary. Researchers demonstrated recovery of residual data from other customers’ previous Containers on the same host. They could not choose a victim or read an actively attached disk.
• The first fix did not clear existing state. Cloudflare restored zeroing of newly allocated storage blocks. Previously mapped disks and cached image snapshots could still retain residual data, so it also retired running disks and cleared older caches. Cloudflare says fleet cleanup is complete; its timeline dates removal of pre-mitigation cached snapshots to September 19.
• The investigation has an evidence boundary. Cloudflare found no additional activity consistent with the reported technique in retained historical disk-I/O telemetry beyond authorized tests. That finding does not establish that no exposure occurred.

Why It Matters

A policy change governs what happens next; it may leave earlier state intact. For teams operating shared infrastructure, the useful question is which disks, snapshots or caches survive a fix and can reintroduce the original risk. A successful test on newly created resources may leave that question unanswered. Our earlier Vercel/libheif coverage drew a related distinction between a working mitigation and complete repair, though the failure mechanism here is reused storage.

Builder Takeaway

For a storage system you operate, choose one pre-fix disk or cached image in a remediation review and check the cleanup record for evidence that it was retired or rebuilt. A fresh-allocation test alone does not establish that older state was cleared.

Related past coverage

• A Platform Mitigation Does Not Patch Every Dependency — uniQubit Tech Radar, published September 20, 2026 (UTC). Its Vercel/libheif case is historical context for checking mitigation and complete repair separately; it is not evidence about Cloudflare’s Containers incident.