
Coder Cloudflare Compromise Delivers Backdoored Terraform Modules to Developers
Cloud development platform Coder confirmed an attacker breached its Cloudflare infrastructure to deploy rogue registry servers that served backdoored Terraform modules. The compromised modules contained info-stealing payloads designed to harvest cloud API keys, SSH keys, OIDC tokens, and CI/CD pipeline secrets before exfiltrating them to an external server. Coder released security updates across versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9, urging developers who downloaded modules during the 14-hour incident window on August 31 to rotate all credentials.


















