Loading…
Cloudflare
A global cloud platform that provides web security, performance optimization, and internet infrastructure services.
- 92 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
We tested our own WAF with frontier AI models. Here’s what we found
Cloudflare built a WAF tester that uses frontier AI models to iteratively mutate attack payloads based on real-time response feedback. The tester, implemented in Python, orchestrates an LLM proposal and review loop against an authorized customer staging environment protected by Cloudflare’s WAF. It ran 45 scenarios across six attack categories—XSS, SQLi, CMDi, SSRF, path traversal/LFI, and Log4j—starting from known blocked exploits and varying encoding, request placement, or destination representation. The vast majority of 1,107 recorded attempts were blocked; the few non-blocked requests were triaged by humans and used to create new detections that harden security for all Cloudflare customers. The post stresses that a WAF bypass still needs an exploitable application to succeed, so patching software remains essential, and suggests combining Managed Rules, Attack Signature Detection, and positive security controls for defense in depth.
Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account
Cloudflare introduced Threat Signals, a free agentic skill layer for open-source threat intelligence available to every account. The product targets the unstructured-reporting problem: converting research posts into indicators that security tools can consume while preserving the context that explains their relevance. A skill encodes detailed instructions that capture how an experienced analyst handles one part of the job, and it runs identically on every report. The agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags within a private, account-scoped dataset. This approach standardizes analyst expertise into repeatable, context-preserving processing for threat reports.
Is your domain using post-quantum encryption? Now you can see for yourself
Cloudflare introduced new post-quantum cryptography visibility tools in its Application Security and Logs products, including Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard, to help customers monitor encryption adoption. These tools surface the key exchange algorithm negotiated on every incoming request, enabling customers to audit their post-quantum posture, assess compliance, and identify cryptographic gaps across their domains. The primary post-quantum algorithm in TLS 1.3 is X25519MLKEM768, a hybrid of classical ECDHE over curve X25519 and the post-quantum ML-KEM, which provides belt-and-suspenders security against harvest-now-decrypt-later attacks. Cloudflare Radar data shows about 70% of browser-generated traffic uses post-quantum encryption on the visitor-to-Cloudflare connection, but only 15% of origin connections to Cloudflare use hybrid ML-KEM. For legacy origin servers that cannot support modern post-quantum cryptography, Cloudflare Tunnel can tunnel traffic over TLS 1.3 with X25519MLKEM768 without requiring any upgrade to the origin server itself.
Enforce positive security with Cloudflare Application Profiles
Cloudflare launches Application Profiles, a positive security feature that learns the expected structure of HTTP requests and identifies deviations. By analyzing path variables, query parameters, headers, cookies, and JSON body fields, the system builds a profile of valid data types, numeric ranges, string lengths, UUIDs, and enums. This approach reduces attack surface by blocking non-conforming requests without relying solely on known attack signatures, addressing the growing threat of AI-generated payloads. The feature extends Schema Learning and Schema Validation, previously available for APIs, to web applications. Profiles are automatically updated weekly as traffic changes. Customers can review violations in Security Analytics and create rules to enforce blocking, starting with observation mode; a closed beta is open to invited Enterprise customers without API Security.
Preventing quantum downgrade attacks against IPsec
Cloudflare has identified a design flaw in IPsec that allows a quantum attacker to downgrade post-quantum-protected connections to classical cryptography. The attack exploits the fact that IKEv2 endpoints sign only their outbound messages rather than the full handshake transcript. This vulnerability requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, prompting Cloudflare to move its transition deadline to 2029. To mitigate this, Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks. The extension is now available in beta for Cloudflare WAN and Magic Transit customers on an opt-in basis.
Next.js applications, powered by Vite: introducing Vinext 1.0
Vinext 1.0 graduates from an AI experiment to a production-ready framework that lets Next.js applications run on Vite, supporting both Pages and App Router. It achieves over 99% test compatibility for customer-requested features, excluding cache components, and includes support for pre-rendering, cache warming, and observability with OpenTelemetry and Sentry. Cache warming moves page prerendering from the build machine to Cloudflare’s network by deploying a new Worker version to zero traffic and requesting pages to populate the cache before promotion. The framework supports React Server Components, Server Actions, API routes, middleware, and shared caching functions across both routers, with first-class runtime support for Cloudflare Workers and bindings like image optimization and hyperdrive. Migration requires only two commands, and the project is open source with a nightly Next.js end-to-end test suite and community-driven issue tracking, also supporting output: ‘export’ for fully static sites and background revalidation.
Introducing cf: the agentic CLI for the entire Cloudflare API
Cloudflare introduced cf, a new CLI that provides access to the entire Cloudflare API surface of over 3,000 operations, far exceeding Wrangler’s roughly 280 commands. Cf is designed primarily for AI coding agents, which account for nearly half of Wrangler usage, and defaults to JSON output with condensed formatting to minimize token consumption. The CLI includes a natural language search command, cf cli search, that helps agents discover the right operation without bloating context, and uses TypeScript-based configuration via cloudflare.config.ts for type safety. Cf is generated by Forge, Cloudflare’s internal pipeline that produces CLI commands from OpenAPI schema annotations, enabling consistent and comprehensive API coverage. The open beta is available globally via npm, and cf adopts Vite as its default local development server, with a migration path from Wrangler and maintenance support for 18 months after beta ends.
How fast is the web? Explore billions of real-user measurements with BEACON
Cloudflare has released the BEACON dataset, an anonymized collection of billions of real-user performance measurements from 10,000 of the largest websites. The dataset reports Core Web Vitals (LCP, CLS, INP) with full histograms, enabling analysis of any percentile including the long tail. It reveals that WebKit browsers underperform Blink in 46 countries, and that resource-discovery and render-blocking contribute more to slow LCP than download time. Soft navigations in single-page applications load two to three times faster than hard navigations, but landing pages remain heavy. The dataset is publicly available on Google BigQuery and includes differential privacy via the RAPPOR algorithm to protect individual user data.
Introducing Forge: the open source pipeline for generating SDKs, CLIs, docs, and more
Cloudflare introduced Forge, an open source, pluggable generation pipeline for producing SDKs, CLIs, documentation, and other API surfaces from API definitions. Forge runs in CI on each team’s API repositories, linting every change and generating preview builds of the CLI, docs, and SDKs with only the changes highlighted, similar to Workers Previews. It supports OpenAPI as input and can chain transformers to produce outputs like Cap’n Web bindings, TanStack Query, or MCP servers, enabling generation of bindings from Workers to other APIs. Forge is designed to reduce coordination overhead across Cloudflare’s hundreds of services and repos, and to enable better API versioning without breaking existing clients or SDKs. It is available under the Apache 2.0 license and can be run for free, privately or publicly, and already generates the output required for the cf CLI.
The road to the agentic browser: A Kitesurf update
Kitesurf, Cloudflare’s browser for AI agents built entirely on Workers, has received a major update. It now supports WebMCP, enabling agents to call site functions like searchFlights() instead of simulating clicks, and site owners can enable WebMCP with one switch. The browser passes over 730,000 Web Platform Tests, up 500,000 since launch, and adds support for CSS Layout, CSSOM, custom elements, URL-based module resolution, and improved iframe behavior. Efficiency optimizations reduce DOM traversal overhead, font fetching, and timer work, keeping CPU usage in line with launch benchmarks despite expanded capabilities. Kitesurf also gains full Browser Run API coverage, including Quick Actions from Worker bindings, and a terminal rendering mode using the Kitty protocol or ANSI text, with open-sourcing planned soon.
Introducing The Cold Start: pitch your startup live at Cloudflare Connect
Cloudflare announces The Cold Start, a live startup competition at Cloudflare Connect in San Francisco on Monday, October 19, 2026. Five early-stage companies with less than $10 million raised will each get five minutes on stage to pitch their vision to judges including Cloudflare co-founders Matthew Prince and Michelle Zatlyn, and CTO Dane Knecht. The winning startup receives $500,000 in Cloudflare credits, a billboard in San Francisco, and an invitation to the VIP speakers dinner. Applications close Friday, October 2, 2026, and Cloudflare will pay travel for the five finalists. The competition is inspired by Cloudflare’s own launch at TechCrunch Disrupt in 2010 and is part of its Cloudflare for Startups program, which offers eligible companies up to $350,000 in credits.
EmDash 1.0: the stable CMS with a secure plugin registry
EmDash 1.0 is a stable, free, and open source content management system built on Astro, offering a production-tested admin for editors and agent-friendly workflows through an API, CLI, and built-in MCP server. Its decentralized plugin registry, built on AT Protocol, lets developers publish plugins without ceding ownership of their identity or releases to a central marketplace, while site owners can discover and install plugins directly. Cloudflare migrated its own blog to EmDash as part of its “Customer Zero” approach, handling millions of pageviews per week and spikes up to 5,000 RPS, which led to features like KV object caching and Hyperdrive database adapter. The project is MIT-licensed with over 175 contributors and translations into 25 languages, and it supports sandboxed plugins for security. EmDash separates the plugin from the catalog, allowing other services to index the same publications without requiring developers to start over.
Supporting native Rust in Workers with the new Emscripten target for wasm-bindgen
Cloudflare announced an experimental Emscripten target for wasm-bindgen, enabling native Rust code compiled with wasm-bindgen to run directly on Workers with full platform feature virtualization. This resolves the long-standing incompatibility between Emscripten and wasm-bindgen by having Emscripten drive the build while wasm-bindgen produces portable bindings included in Emscripten’s library system. The integration virtualizes timers, file system operations, and sockets atop Workers’ Node.js APIs, bringing significantly improved library compatibility for many previously unsupported Rust crates after minor patches to libraries like libc and socket2. Tokio async runtime support is achieved through WebAssembly JavaScript Promise Integration, which suspends blocking calls and returns control to the event loop without stalling. In testing, a Rust Minecraft server (Pumpkin) was deployed inside a Durable Object with TCP ingress using real Tokio sockets, persisting world state through Durable Object storage and supporting multiplayer connections.
Cloudflare’s 2026 Annual Founders’ Letter
Cloudflare’s 2026 founders’ letter, marking the company’s 16th birthday, examines rapid changes in internet traffic driven by AI. Since mid-2025, new website creation has exploded, fueled by ‘vibe coding’ tools that allow non-programmers to build apps, with over 7 million developers now using Cloudflare’s platform. Automated traffic from AI agents and crawlers is projected to surpass human traffic by May 2026 and could reach 1,000 times human levels within five years. This surge risks a tragedy of the commons: agents consume resources from many sites but benefit only one, threatening small businesses that lack the information volume older competitors hold. Cloudflare proposes reducing crawler load by fetching only changed content and enabling creators to receive payment when agents use their content, alongside partnerships to shape a fairer internet.
Agents can now set up your website’s security with Turnstile Spin
Cloudflare launched Turnstile Spin, an agent-mediated implementation of its Turnstile CAPTCHA alternative that AI coding agents use to set up security on any website. The two-step Turnstile flow requires a frontend widget and a backend Siteverify call, but many sites skip the backend validation, leaving them exposed to bots. Spin uses the user’s AI coding agent to find frontend and backend code, propose a plan, and after approval automatically embed the widget and wire up the Siteverify call without sending code to Cloudflare. It also fixes improperly installed widgets detected by monitoring Siteverify calls and handles migrations from other CAPTCHA providers. Since its July release over 65,000 widgets have been created via Spin and the generated prompt has been copied more than 30,000 times, and the service remains free.
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers
Security researcher Oren Yomtov reported a vulnerability in Cloudflare Containers and Sandboxes through the bug bounty program, demonstrating that a Workers Paid account could recover residual disk blocks from previous containers on the same host. The issue arose from Linux device mapper thin provisioning with skip_block_zeroing enabled, which left unzeroed 64 KiB blocks when a 4 KiB write triggered allocation, allowing the remaining 60 KiB to retain prior data. Researchers recovered directory structures, database pages, and structurally complete SQLite databases from 18 of 24 placements across four continents, using ext4 checksums to distinguish foreign blocks. Cloudflare removed skip_block_zeroing, retired all running container disks, and cleared cached image snapshots created before the mitigation, completing cleanup by September 19. Retained disk-I/O telemetry showed no evidence of malicious exploitation, and the researchers confirmed secure deletion of recovered data.
We just shipped support for the ugliest part of HTTP: Vary
The Vary response header, often called the ugliest part of HTTP, is now supported in Cache Rules on every Cloudflare plan. Vary tells caches which request fields may affect a response, but not which differences actually matter, leading to cache fragmentation or incorrect responses. For example, a server might deliver different image formats to different browsers, and a cache ignoring Vary risks serving the wrong bytes. The origin still names the request headers that may affect a response, but Cloudflare lets users decide how to handle each one. This support addresses the challenge of balancing correct caching with cache efficiency.
Introducing Worker Previews: isolated preview environments for every change your agent makes
Worker Previews gives every Git branch its own production-like environment with an isolated URL, configuration, state, and observability. Developers deploy a Preview using npx wrangler preview, which creates a separate Worker version with its own variables, secrets, and bindings, distinct from production, on a stable URL that updates with each push. Durable Objects and Containers automatically receive new namespaces per Preview, preventing state contamination across branches during migrations or schema changes. Each Preview supports full observability—logs, errors, metrics, and traces—scoped to that branch, enabling agents to autonomously test, catch failures, push fixes, and verify before production. The feature enables an Agent Development Lifecycle where every change is atomic, independently deployable, and revisable before merging to production.
Python Workers are now generally available
Cloudflare announced general availability of Python Workers, making Python a first-class language on its developer platform. The runtime now encapsulates type conversion so developers use Cloudflare bindings like D1 and Workers AI directly, without the previously required JavaScript glue code. Popular frameworks FastAPI, Django, and Flask run inside Workers via built-in ASGI and WSCI connectors that translate JavaScript requests into standard Python structures. A custom socket syscall implementation enables TCP connections for database drivers, unlocking Hyperdrive integration with PostgreSQL and MySQL, previously blocked by WebAssembly sandbox limits. Example projects include streaming from Bluesky Jetstream via Durable Objects, building an MCP server with the official Python MCP package, and creating a RAG system with Vectorize, with documentation now including Python examples alongside TypeScript.
Saving another 100TB of RAM with math (and Rust)
Cloudflare describes how excessive memory use in pingora-ketama, the consistent-hashing component of its Pingora Backend Router, was investigated as a resource-efficiency problem at global scale. Consistent hashing maps servers and cache keys onto a circular hash space, but a single hash per server creates uneven ranges, while multiple hashes improve balance; with 160 points per server, the coefficient of variation falls to about 8% in the 100-server example. The work produced a v2 ring with compacted storage, faster sorting, and a configurable base number of hashes per node, while retaining the existing v1 ring and supporting simultaneous use during migration. After the old ring was decommissioned, measured memory usage for PBR fell by 100TB globally, and the changes are available in pingora-ketama behind an unadvertised Cargo feature.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.