Loading…
Cloudflare
A global cloud platform that provides web security, performance optimization, and internet infrastructure services.
- 92 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
Modern storefronts can appear healthy while malicious JavaScript diverts affiliate credit, hijacks searches or clicks, tampers with analytics, or loads further code. Cloudflare describes four operations spanning eight payloads that Page Shield ML detected in live traffic; humans verified the findings afterward, while seven payloads were absent from VirusTotal and none received a malicious verdict from URLScan. The detection system represents JavaScript as a graph with a graph neural network (GNN), sends fewer than 0.3% of analyzed scripts to a lightweight LLM on Workers AI, and uses a teacher cohort of frontier models for difficult investigations. This combination handles minification, renaming, some obfuscation, and behavior gated by device, time, geography, referrer, browser state, or cooldowns. The post concludes that continuous browser visibility and runtime context are needed because static, one-time scans can miss selectively executed attacks.
Have it both ways: stay discoverable in search while disallowing AI training
Cloudflare announces a Disallow AI Training setting intended to let website owners refuse AI training while keeping content available to search crawlers. The problem is mixed-use crawlers such as Applebot, Bingbot, and Googlebot, which can serve both search indexing and model training, making a simple block affect discoverability. Cloudflare says its network can publish preferences, identify and classify crawlers, block those that ignore controls, and report operator behavior on Radar; the setting publishes a no-training preference through robots.txt while allowing Accountable mixed-use crawlers for search. Apple, Google, and Microsoft meet or have committed to meet the Accountable requirements, which include training and summary opt-outs, URL-level visibility, metrics, and assurance that training opt-outs will not affect traditional search.
Give every teammate and agent the right level of access to your Workers
Cloudflare has introduced resource-level access controls for Workers, allowing a teammate or agent to access one specific Worker rather than other resources in an account. Four roles define progressively broader capabilities: Metadata Read-Only exposes settings and observability data, Content Read-Only permits code or product-content reads, Editor allows content and settings changes without resource deletion, and Admin provides full control. These roles can be assigned to dashboard users or attached to scoped API tokens, supporting debugging without source exposure, code review without deployment, and CI/CD deployments limited to one Worker. Worker-level access also governs Durable Objects, while routes and Custom Domains require both Worker Editor access and Workers Routes permission; existing legacy permissions continue to work, but the new roles are recommended for granular access and are planned for D1, R2, and KV.
Introducing automatic remediation policies with Cloudflare CASB
Cloudflare CASB now supports automatic remediation policies that respond to newly detected SaaS security findings without requiring an administrator to act on each instance. Teams can match policies by vendor, integration or tenant, and finding type, then revoke file-sharing access, send finding details to webhooks, or do both; first-party remediation currently covers Microsoft and Google Workspace file and folder findings. The backend enqueues findings to Cloudflare Queues, uses a Worker to match policy configurations, and runs matched jobs through Cloudflare Workflows, which provides durable execution, retries, and rate-limit backoff. Policies generate administrator-activity and runtime execution logs, while the stated target from detection to completed remediation is five minutes or less; support for Custom Findings is planned for the coming weeks.
1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, a NIST-standardized post-quantum algorithm, as an initial step toward post-quantum DNSSEC. The operational problem is that each signature is 2,420 bytes—almost 38 times an ECDSA P-256 signature and larger than common DNS-over-UDP limits—while zones must continue publishing conventional signatures for older resolvers. Cloudflare’s resolver handles this by testing larger responses at Internet scale, relying on truncation and transport retries rather than fragmented UDP, and using authenticated DS records to require a valid post-quantum path when a zone advertises one, preventing downgrade to conventional validation. The change provides operational experience for an ecosystem migration that requires coordination across DNS participants; Cloudflare says it plans full post-quantum security by 2029.
How we rebuilt Cloudflare Workers’ module registry for Node.js compatibility
Cloudflare has rebuilt the module registry in workerd, the open-source core of the Workers runtime, to improve speed, standards compliance, and alignment with Node.js. The change addresses compatibility beyond runtime APIs by making module resolution, loading, and caching behave more like Node.js across ESM, CommonJS, and WebAssembly. The new registry uses URLs as specifiers, supports import.meta.url, import.meta.main, and import.meta.resolve(), distinguishes modules by query strings and fragments, validates import attributes, follows require(esm) rules, and compiles modules lazily while sharing caches across isolates. It also supports WebAssembly source phase imports and consistent loading errors; the existing registry remains in place, and the new implementation must be enabled with the new_module_registry compatibility flag.
Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)
Cloudflare’s Automatic Key Exchange addresses extra TLS 1.3 handshake latency and the difficulty of enabling post-quantum origin connections without manual configuration. Cloudflare previously sent an X25519 keyshare as its first guess; origins preferring another group returned a HelloRetryRequest, while sending X25519MLKEM768 indiscriminately risked oversized, split ClientHello messages and legacy compatibility failures. The system reuses Automatic SSL/TLS scanning to run lightweight handshakes for each supported group, map every origin’s capabilities and preferences, and tailor the initial keyshare, preferring X25519MLKEM768 when supported. During rollout, HelloRetryRequests dropped from roughly 52% to 3.7%, cutting more than 150 ms from p90 handshake latency, while hundreds of thousands of domains gained post-quantum origin connections without configuration. Cloudflare says it plans to extend scanning to post-quantum authentication, including ML-DSA certificates and future Merkle Tree Certificates.
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models
Cloudflare announces invitation-only early access to Vulnerability Discovery and Remediation, a Managed Defense service that investigates authorized codebases and helps prioritize and mitigate vulnerabilities. It combines source-code analysis with production route activity, traffic volume, security events, and active Web Application Firewall (WAF) protections to assess exposure. Reconnaissance maps request paths to code, hunter agents search relevant sections, and validation checks proposed patches and custom WAF rules before customer review. OpenAI Daybreak models, including GPT-5.6 Cyber, run reconnaissance, hunting, and validation through AI Gateway, while source code, logs, and request metadata are bounded by authorization, redaction, access policies, and external checks. Findings receive source-based risk ratings that network evidence can raise, with code patches and conservative WAF mitigations prepared for review; customers decide whether to test or deploy them.
How we could save petabytes of cache storage with Zstandard and Pingora
Cloudflare prototyped Cache Transcoding, a Pingora-based architecture that stores eligible cache responses as Zstandard (zstd) rather than their original representation. On a fill, the proxy compresses qualifying uncompressed text at zstd level 3, records the compressed representation and original content length, keeps it compressed on disk and between Tiered Cache layers, and decodes it on the client-facing path. Eligibility requires a 200 OK response, compressible text, no existing Content-Encoding, known Content-Length of at least 4 KiB, and excludes several request and binary-content cases. In initial tests, eligible assets shrank to roughly one-third of their original on-disk size, with a 2.834x ratio, while encoding cost 4.31 ns per byte and decoding 1.56 ns; the modeled CPU increase stayed within budget, though broader testing remains necessary.
Introducing Adaptive Intelligence: undermining the economics of every bot attack
Cloudflare introduces Adaptive Intelligence, a bot detection engine designed for attackers who distribute requests across proxies, vary fingerprints, and continually test defenses. It argues that deterministic, rule-based systems create stationary targets: attackers receive repeated yes-or-no feedback while defenders update on slower release cycles, making adaptation economically cheaper for attackers. The engine changes this dynamic through continuously retrained machine learning, statistical rather than fixed judgments, and planned disposable rules that appear and retire at random intervals; it also learns from corrections and misses across millions of sites. Its first component, continuous retraining of the machine-learning system behind bot score, is launching now, while disposable rule generation and broader traffic learning are described as forthcoming, with Enterprise customers enabling “Auto Update Machine Learning” to receive it.
BotBase for Operators: A clearer path to joining Cloudflare's directory of bots and agents
Cloudflare launched BotBase for Operators to give bot operators a clearer way to submit, monitor, update, and cancel bot-directory submissions from the dashboard. The new area includes a bots directory, submission form, and history tab with Waiting for review, Accepted, and Rejected statuses, including rejection reasons and classification changes. Its intake model records what a bot does, how it uses content, and whether it is direct or intermediary, while allowing multiple behaviors and Content Signals declarations. Reviews now use automated checks for duplicates, user-agent specificity, and verification through IP lists, reverse DNS, or Web Bot Auth, routing exceptions to staff. The launch focuses on visibility, with ownership, observability, and conversation identified as future goals.
How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
Cloudflare's Big Pineapple platform, which powers 1.1.1.1 and other DNS services, stores over 250 billion cache entries simultaneously. To decrease fleet-wide memory consumption, engineers implemented five changes to in-memory cache data structures. Key modifications included swapping growable types like Vec and String for Box slices to eliminate capacity overhead, combining distinct record sections into a single list indexed by offsets, omitting redundant owner domain names, and serializing record bytes into contiguous buffers. In benchmarks, these optimizations decreased per-entry memory footprints by 56% while improving cache lookup latency by 19% and insert throughput by 43%. Across production instances, the rollout reduced working-set memory by approximately 100 terabytes.
The Cloudflare Blog – Brought to you by EmDash
Cloudflare migrated its official blog to EmDash, an Astro-focused content management system, acting as internal Customer Zero to evaluate scaling and usability. To prepare for traffic spikes reaching thousands of requests per second, engineers used k6 to execute ramp, breakpoint, and burst load tests. The resulting production architecture runs EmDash on Cloudflare Workers, pairing it with Workers Cache, an object cache backed by Workers KV, and Hyperdrive connected to PlanetScale. This layered caching design serves 99.5 percent of static files and 70 percent of requests from cache, flattening p95 latency under real-world loads reaching 850 requests per second. The migration also introduced a frontend redesign using the Kumo design system and added Model Context Protocol servers for automated agent workflows.
Say it once: introducing Bot Preference Sync
Cloudflare announced Bot Preference Sync, a feature across all customer tiers that automatically reflects dashboard AI bot configurations directly in a site's robots.txt file. Website operators previously faced challenges synchronizing static robots.txt directives with edge enforcement rules, which led some crawlers to ignore stated preferences or attempt bypasses. Under this system, Cloudflare generates and prepends directives for Search, Agent, and Training categories to existing robots.txt files using crawler lists tracked in BotBase. Mixed-use crawlers performing both search indexing and training must meet strict transparency criteria, including honoring opt-outs and providing page-level visibility, to avoid edge blocks when training is disallowed. Additionally, onboarding workflows allow ad-supported publishers to automatically set AI model training to Disallow by default while retaining search visibility.
From all-or-nothing to task-based OAuth consent
Cloudflare introduced OAuth scope customization to replace all-or-nothing consent flows for third-party applications. Previously, users had to approve every requested scope or deny access completely, compelling developers of tools like MCP servers to construct custom pre-consent selection interfaces. With the new feature, developers can designate specific permissions as optional alongside required scopes when configuring an OAuth client. During authorization, users can deselect these optional scopes, while unrequested client scopes remain hidden to maintain task-specific consent screens. Because resulting access tokens contain only the granted subset of permissions, client applications must inspect returned scopes after code exchange rather than assuming full authorization.
A revisit of remote Spectre attacks on Cloudflare Workers
Cloudflare reassessed remote Spectre attack feasibility within Cloudflare Workers production workloads to evaluate defenses against modern stabilization techniques. The experimental proof of concept bypassed Dynamic Process Isolation (DyPrIs) by keeping invocations alive using WebSocket traffic, which also diluted hardware performance counter ratios below detection thresholds. By combining branch mistraining, cache line eviction, and speculative type confusion, researchers transiently accessed out-of-bounds memory via raw 64-bit TypedArray backing store pointers. This attack demonstrated cross-tenant data leakage reaching up to 12 bit/s with over 99% accuracy in production. In response, Cloudflare mitigated the vulnerability by integrating the V8 memory sandbox, deploying Memory Protection Keys for hardware-assisted in-process isolation, and redesigning DyPrIs to monitor active long-lived executions.
BGP Role model: tracking the adoption of RFC 9234
Border Gateway Protocol route leaks occur when routing announcements propagate beyond their intended customer-provider or peer relationships, causing traffic misdirection and performance degradation. RFC 9234 embeds relationship awareness directly into BGP by establishing negotiated BGP Roles and attaching an Only to Customer (OTC) transitive path attribute to prevent unauthorized route propagation. To assess real-world adoption, Cloudflare monitored OTC attribute transmission across peer networks and discovered that 33.1 percent of IPv4 and 17 percent of IPv6 paths were missing the OTC attribute. Investigation revealed that Tier-1 transit providers AS1299 and AS3257 were stripping the attribute due to legacy defensive BGP error-handling configurations. Following direct engagement, AS1299 updated its configurations to preserve OTC propagation, whereas AS3257 continued stripping it, highlighting the necessity of broader vendor and carrier support across the Internet.
How Cloudflare detects MCP traffic and helps secure it
Traditional security boundaries assume human speed and judgment, but AI agents execute nondeterministic actions rapidly and can invoke unapproved Model Context Protocol servers through standard HTTPS traffic. To mitigate this shadow traffic, Cloudflare One introduces detection and inspection capabilities across clients, network boundaries, and MCP servers. Cloudflare Gateway leverages protocol-level headers and JSON-RPC inspection to identify direct MCP connections, verify managed paths, and enforce access through approved MCP Server Portals. Furthermore, Cloudflare Agents SDK v0.20.0 implements the stateless 2026-07-28 MCP specification while providing fallback handshakes for legacy servers. Organizations can combine Gateway traffic source rules with server middleware like WriteGuard to block unauthorized tool invocations before execution.
Secure all your internal vibe-coded applications — in one click
AI-assisted development enables employees to build applications rapidly, but unmanaged deployments can accidentally expose internal company data to the public Internet. Cloudflare introduced direct Cloudflare Access integration for Cloudflare Workers, allowing organizations to enforce authentication policies directly at the account or individual Worker level rather than per hostname. When enabled, incoming requests are authenticated before reaching application code across custom domains, routes, workers.dev subdomains, and preview environments. Developers can access authenticated identity data such as emails and groups directly via the Worker context object without manually validating JSON Web Tokens. This capability was implemented on Cloudflare's Rust-based FL2 proxy, which separated Worker routing from Worker execution so routing runs safely prior to Access policy enforcement.
Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal
On August 12, a total solar eclipse crossed the North Atlantic and Europe, passing directly over Iceland, northern Spain, and Portugal. Cloudflare Radar analyzed HTTP request volumes in five-minute intervals across affected countries, comparing the data against a baseline derived from the previous three Wednesdays. Traffic reductions aligned closely with peak solar obscuration, with totality regions recording drops between 15% and 30% and specific areas shifting by up to -46.7%. Once the sun reappeared, request volumes rebounded to normal levels within minutes as users resumed device activity. The observed traffic declines were driven by aggregate human behavior rather than network failures.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.