Loading…
Cloudflare
A global cloud platform that provides web security, performance optimization, and internet infrastructure services.
- 99 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
A fully programmable secure web gateway
Traditional secure web gateways enforce security through a binary allow, block, or log model, which limits customization for complex environments. Cloudflare is integrating its Cloudflare Gateway and Data Loss Prevention with Cloudflare Workers, allowing customers to run arbitrary code inline at the moment a security decision is made. The new Forward action, available in public beta, routes matched HTTP traffic to a Worker that acts as inline middleware, enabling request and response modification or asynchronous tasks like sending Slack messages. Custom Functions, arriving before the end of the year, call a Worker during policy evaluation and return values used as selectors, enabling data-conditional rules and DLP validation against external APIs. Because Gateway and Workers run on the same machines in Cloudflare’s global network, dispatching traffic to a Worker is a local function call with no hairpinning or added latency.
Deploy with Void
VoidZero has open-sourced Void, a toolkit for building and deploying full-stack Vite applications to Cloudflare. The release includes three products: Void Platform, Void SDK, and Void CLI, which integrate into a single Vite workflow. The SDK provides file-based routing, database integration via imports, and end-to-end type safety from the database to the user interface. The CLI handles building, migrating, provisioning resources, and deploying with a single command, automatically inferring bindings like databases or AI services. The Platform offers a shared deployment environment with access controls and resource limits, enabling teams to prototype and ship internal apps in minutes.
Cloudflare and OpenAI: making AI discovery better for everyone
Cloudflare and OpenAI launched a research pilot in July 2026 to help ChatGPT users discover content more efficiently using network signals about page existence changes and potential harm. The pilot ran on a cohort of about one percent of Cloudflare’s network and has enabled OpenAI to index hundreds of millions of new web pages that are useful but sparsely linked. Cloudflare provides these discovery signals to OpenAI’s crawler while OpenAI independently evaluates and ranks pages by relevance and helpfulness for ChatGPT Search. The collaboration also tests signals that flag harmful pages like fake login forms so crawlers avoid them without penalizing the legitimate domain. The next phase will refine page selection test faster change signals and measure business outcomes for site owners whose content is discovered.
Yandex outage: Data shows that instead of going dark, malicious bots went on the move
Reported drone strikes on Yandex data centers from October 7 to 11 caused network traffic to drop 99% below baseline for Yandex Search and 90% for Yandex.Cloud. Using Cloudflare Radar and Bot Management data, the analysis compared pre-event automation baselines with post-strike patterns on both ASNs. The Yandex Search ASN drop consisted almost entirely of verified search crawlers: 93.6% of its bot requests were verified, and 78.1% belonged to YandexBot. On Yandex.Cloud, vulnerability scanning fell 90% and plugin probing dropped 93%, but high-volume operations migrated to other Russian hosting providers, preserving identical JA4 fingerprints. Global bot traffic remained stable at 39.5%, demonstrating that malicious automation moves rather than disappears and that request behavior analysis is necessary to understand threats.
Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug
Hyperdrive is Cloudflare’s distributed database connection pooler for Workers; its MySQL support became GA after a beta that uncovered over 20 bugs, including a rare caching issue. The most challenging bug caused consistently empty query responses 0.001% of the time on cache-enabled instances, requiring deep protocol analysis. The root cause was that the Client and Endpoint nodes share a data center cache but use different MySQL capability flags, so a cache entry written by one node could be encoded with capabilities that the other node cannot correctly translate. When the reading node encountered such a mismatched entry, it either sent an early EOF or hung, resulting in empty rows for the Worker. The fix was to always write a canonical version of the query result bytes encoded with Hyperdrive’s own capabilities, regardless of which node stored it, which resolved the issue and raised reliability to the 99.99% target.
Under the hood, off the hot path: How D1 scales to millions of databases
D1, Cloudflare’s serverless SQLite database, has seen 15x growth in live databases over the past year and scales by keeping query execution on the edge in Durable Objects, separate from the control plane’s metadata operations. The control plane uses an Edge API Worker with Hyperdrive to access Postgres clusters for transactional metadata, while Workers KV caches database-to-Durable-Object mappings for fast edge lookups. Database creation completes in about 1.6 seconds by generating a Durable Object ID, persisting metadata to Postgres, and storing the mapping in Workers KV, with the Durable Object lazily initialized on first query. Storage usage enforcement uses atomic counters in Workers KV that are checked locally on each query and updated asynchronously after execution, avoiding any central database round trip during the query. Precomputed aggregations for billing are stored in ClickHouse, and guiding principles such as eventual consistency and idempotency further reduce reliance on centralized components.
Rewinding the exponential: How we keep hardware usage down
Cloudflare’s Data team manages a pipeline handling over two billion events per second from tens of thousands of servers, powering Logs, SQL API, and observability. To counter exponential traffic growth against linear hardware expansion, they implemented several optimizations over five years, deferring two and a half years of hardware expansion. In 2022, they replaced a monolithic schema with product-specific schemas, reducing backbone bandwidth by 35-40%. In 2024, they switched compression from LZ4 to zstd, achieving a 40% reduction in compressed traffic with negligible CPU impact. In 2026, they decoupled pipeline transit from database redundancy via a shared ingest pool and late replication, applied sampling downstream, and introduced aggregations, eliminating about 70 GB/s of compressed traffic and halving projected 2031 data volume.
Filter, reshape, and redact logs before export with Transformers
Cloudflare Logpush now supports Transformers, allowing teams to filter, redact, and reshape log streams using SQL before export to SIEMs, analytics platforms, or object storage. This eliminates the need for a separate processing service that teams would otherwise have to deploy, scale, and maintain. Transformers are SQL queries applied per batch within Logpush’s high-throughput pipeline, using Apache DataFusion and Arrow for columnar execution. The implementation embeds DataFusion in Bufstream, the Go-based delivery service, using cgo and Arrow IPC to pass typed batches across the language boundary without introducing network hops. Customers can create, preview, and version Transformers via the dashboard or API, and attach them to NDJSON Logpush jobs to reduce downstream data volume and cost.
Introducing Clef-omni with full multimodality, plus a faster Clef and a cheaper Clef-flash
Cloudflare introduced Clef-omni, a decision model that natively handles audio, video, image, and text inputs in a single pipeline, built on a Qwen3-Omni mixture-of-experts backbone with text-to-speech components removed. Unlike cascading pipelines, it directly embeds media into a unified sequence and uses two-stage attention routing with lexical grammar to compute confidence scores, trained by freezing the backbone and applying LoRA adapters with label-smoothed cross-entropy and Brier score calibration. The company also cut Clef-flash’s price to $0.038 per million input tokens while reducing its context window from 64k to 24k for the hosted version, based on usage data showing only 0.24% of requests exceed that limit. Clef’s hosted version received speed optimizations at the infrastructure layer without new model weights, and Clef-omni is available open-weight on HuggingFace. Benchmarks show Clef-omni scoring 98.2 on BFCL case exact and 92.7 on API-Bank accuracy, with median text-only decision latency around 130 milliseconds.
Introducing on-demand CPU and memory profiling with flamegraphs for Workers and Durable Objects
Cloudflare introduced on-demand CPU and memory profiling for Workers and Durable Objects, accessible via the CLI or the Dashboard’s Observability page. Users can generate interactive flamegraphs and download pprof files, with each rectangle’s width representing CPU time or memory usage over a chosen duration. Profiling the R2 binding Worker revealed that genericR2JsonReplacer, called by JSON.stringify, processed nested values multiple times; fixing it made the function 2.7x faster. A different Worker with P999 memory at 133 MB (above the 128 MB limit) was found to have a partially enabled Prometheus code path accounting for 66.7% of allocations; disabling it reduced P999 memory to 118 MB and eliminated out-of-memory errors. The profiling system locates the correct data center and isolate for the Worker or Durable Object, and continuous profiling is being developed to automatically capture samples without manual initiation.
Deno is joining Cloudflare
The Deno team is joining Cloudflare to merge workerd and celld, aiming to make self-hosting Workers and Durable Objects radically simpler for developers. Ryan Dahl, creator of Node.js and Deno, explains that Durable Objects provide a powerful abstraction: a distributed singleton with a SQLite database that scales by sharding state and WebSocket connections across machines. He started celld to run this model outside Cloudflare with a single Rust binary and object storage as its only external dependency. Kenton Varda counters the theory that Workers’ unique design creates lock-in, noting that workerd is open source and that celld provides an escape hatch for migration. The merged effort, led by Ryan and Bert Belder, will make self-hosting a first-class supported way to build and run apps using the Workers programming model.
Bridging technical depth and usability: The story behind Radar’s redesign
Cloudflare Radar was redesigned to make its real-time Internet data accessible to journalists, human rights advocates, and everyday users while preserving depth for network operators and researchers. The previous landing page used a bento box layout that gave everything similar visual weight, felt intimidating to newcomers, and lacked brand consistency. The new design introduces an interactive map as the primary navigational element, leading with traffic and outages to provide concrete, timely reference points. Below the map, a tabbed exploration flow replaces the old chart widgets, offering summary statistics and clearer calls to action. The design language blends marketing approachability, content structure, and product maintainability by migrating to Cloudflare’s Kumo component system, aiming for a human-centered experience that does not sacrifice technical rigor.
Building an evidence-grounded agentic security operations harness on Cloudflare
Cloudflare’s Managed Defense harness uses a team of specialized AI agents to analyze security alerts, separating deterministic evidence collection from model inference to improve accuracy. Before any AI analysis, fixed reconnaissance workflows collect customer identity, detection history, traffic baseline, and enforcement outcomes, making evaluation reproducible. A lightweight triage model called Clef filters high-confidence false positives, while a coordinator agent runs four specialist agents in parallel for deeper investigation. The specialist agents cover traffic analysis, customer context, global telemetry, and threat intelligence, with a synthesis agent combining their typed findings into an advisory. The system preserves customer privacy by using only aggregate global telemetry, and Managed Defense Analysts remain responsible for final decisions and mitigations. The approach addresses three problems from a single-agent prototype: context becoming authority, scope drift, and failure to distinguish missing data from negative results.
The keys to the Internet change on October 11. Are you ready?
On October 11, 2026, the DNS root will replace its DNSSEC key-signing key (KSK) for only the second time, moving from KSK-2017 to KSK-2024. The rollover changes the trust anchor that validating resolvers use to verify the root’s DNSKEY records. Cloudflare has published KSK-2024 in the root’s DNSKEY set since January 11, 2025, and added it to its own resolver’s built-in trust anchors in July 2024. To help operators check readiness, Cloudflare uses RFC 8509 root key trust anchor sentinels, which let a resolver report whether it trusts a given key. Most website operators need no action, but DNSSEC-validating resolvers should confirm they trust KSK-2024 before the switch.
Everything we launched during Birthday Week 2026
Cloudflare marked its 16th Birthday Week with 46 announcements spanning open source, application security, AI agent economics, and developer platform upgrades. The week began with a new agentic CLI called cf, an open-source generation pipeline called Forge, and EmDash, a serverless CMS with sandboxed plugins. Tuesday focused on Cloudflare’s intention to become a public certificate authority and post-quantum security tools. Wednesday introduced Pay Per Use and the Monetization Gateway, creating an economic model for AI agents to pay creators when using their content. The week closed with features for faster connectivity and broader accessibility.
One year later: the power of 1.1.1.1 interns
Cloudflare’s internship program, announced a year ago with a goal of 1,111 interns, has hosted 750 interns across 48 teams in nine offices worldwide, including Austin, San Francisco, and London. Interns shipped Cache Transcoding, compressing assets to a third of their on-disk size with Zstandard; CryptoLabe, an internal AI tool for cryptography mapping; and post-quantum visibility in Logpush. AI tools helped interns learn codebases faster and prototype ideas, but managers and mentors remained essential; Iliana measured BGP ORIGIN rewriting on 70% of paths and publicly advocated for removing ORIGIN from route selection. Several Birthday Week launches included intern-authored work, such as Protected Quick Tunnels and native Rust in Workers. The program continues hiring, with many interns returning full-time, aiming to build a new generation of builders.
Streamline: custom video pipelines with Cloudflare Stream and Workers
Cloudflare released Streamline, a developer playground that demonstrates how to build custom video pipelines using its Developer Platform. Streamline combines Workers, Containers, and Durable Objects to create long-running media processing sessions that can render dynamic annotations or burn in subtitles on livestreams and hosted videos. The architecture consists of a Media Engine running in a Container, controlled by a Worker application that handles orchestration and preview via Durable Objects. The Media Engine uses FFmpeg for processing and supports inputs from RTMPS, HLS, or webcam, with output to Cloudflare Stream or WebSocket preview. Streamline is open source, with repositories for the media engine and an example application, and a public playground is available for testing.
Introducing Web Search API via AI Gateway
Cloudflare launched a Web Search API via AI Gateway, partnering with Ceramic.ai, Exa, and Linkup, to provide grounded intelligence by letting AI agents search the web instead of guessing URLs that return 404 errors. The API injects live, structured snippets into inference pipelines, giving models access to information beyond their training cutoff, such as new Birthday Week releases, and grounding agent responses with real-time data. Developers can integrate via AI Gateway credits, a direct REST endpoint with curl, or Workers bindings with one line of code. Partners commit to Cloudflare’s verified bot standards, including identifying crawlers, respecting robots.txt, and providing source links for transparency. Web search calls are logged in AI Gateway observability, billed at list pricing without markup, support Bring-Your-Own-Key and Zero Data Retention, with native server tools coming soon.
8 major updates to Cloudflare Observability
Cloudflare announced eight major updates unifying logs, traces, analytics, alerts, dashboards, and data export into one observability platform with simplified pricing. The new Logs home combines Workers Observability and Log Explorer, letting users query datasets like HTTP events, firewall events, Workers, and R2 using SQL or filters. Cloudflare Traces, now in open beta, provides request-level visibility across security rules, transformations, caching, routing, Workers, and origin, with OpenTelemetry export and W3C trace context propagation. A unified SQL API lets humans and agents query telemetry across Cloudflare products, and custom alerts can be set on any dataset using threshold, anomaly, or SLO conditions. Pricing shifts to a volume-based model for ingested and stored logs and traces, effective December 1, 2026, with free tier at 0.5 GB ingestion per day and paid plans starting at 50 GB ingestion per billing cycle.
Introducing Cloudflare Traces: follow requests through our entire platform
Cloudflare Traces, in open beta, extends tracing beyond Workers to the full request path, capturing spans for security, transformations, cache, routing, Workers, and origin handling in one timeline. Users set a baseline sampling rate and use Trace Rules to override it for specific traffic, enabling targeted debugging without increasing volume across the domain. The feature accepts and forwards W3C traceparent headers for distributed tracing and exports spans via OTLP to any compatible backend, with no instrumentation required. It reveals why a request was blocked, which rule acted, whether the URL was rewritten, and where time was spent between cache, origin, and the application. Pricing, effective December 1, 2026, is based on ingestion and retention: free tier 0.5 GB daily with 7-day retention, paid plans 50 GB ingestion and up to 365-day retention.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.