---
title: "Cloudflare"
description: "A global cloud platform that provides web security, performance optimization, and internet infrastructure services."
---

# Cloudflare
> A global cloud platform that provides web security, performance optimization, and internet infrastructure services.

## Articles

### [Cloudflare’s 2026 Annual Founders’ Letter](https://yomu.fyi/post/cloudflare-s-2026-annual-founders-letter.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Michelle Zatlyn
- Published: Sep 27, 2026
- Type: Problem & solution

Cloudflare’s 2026 founders’ letter, marking the company’s 16th birthday, examines rapid changes in internet traffic driven by AI. Since mid-2025, new website creation has exploded, fueled by ‘vibe coding’ tools that allow non-programmers to build apps, with over 7 million developers now using Cloudflare’s platform. Automated traffic from AI agents and crawlers is projected to surpass human traffic by May 2026 and could reach 1,000 times human levels within five years. This surge risks a tragedy of the commons: agents consume resources from many sites but benefit only one, threatening small businesses that lack the information volume older competitors hold. Cloudflare proposes reducing crawler load by fetching only changed content and enabling creators to receive payment when agents use their content, alongside partnerships to shape a fairer internet.


### [Agents can now set up your website’s security with Turnstile Spin](https://yomu.fyi/post/agents-can-now-set-up-your-website-s-security-with-turnstile-spin.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Jules Lemee
- Published: Sep 25, 2026
- Type: Announcement

Cloudflare launched Turnstile Spin, an agent-mediated implementation of its Turnstile CAPTCHA alternative that AI coding agents use to set up security on any website. The two-step Turnstile flow requires a frontend widget and a backend Siteverify call, but many sites skip the backend validation, leaving them exposed to bots. Spin uses the user’s AI coding agent to find frontend and backend code, propose a plan, and after approval automatically embed the widget and wire up the Siteverify call without sending code to Cloudflare. It also fixes improperly installed widgets detected by monitoring Siteverify calls and handles migrations from other CAPTCHA providers. Since its July release over 65,000 widgets have been created via Spin and the generated prompt has been copied more than 30,000 times, and the service remains free.


### [How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers](https://yomu.fyi/post/how-cloudflare-addressed-a-cross-tenant-data-exposure-vulnerability-in.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Hrushikesh Deshpande
- Published: Sep 24, 2026
- Type: Incident / postmortem

Security researcher Oren Yomtov reported a vulnerability in Cloudflare Containers and Sandboxes through the bug bounty program, demonstrating that a Workers Paid account could recover residual disk blocks from previous containers on the same host. The issue arose from Linux device mapper thin provisioning with skip\_block\_zeroing enabled, which left unzeroed 64 KiB blocks when a 4 KiB write triggered allocation, allowing the remaining 60 KiB to retain prior data. Researchers recovered directory structures, database pages, and structurally complete SQLite databases from 18 of 24 placements across four continents, using ext4 checksums to distinguish foreign blocks. Cloudflare removed skip\_block\_zeroing, retired all running container disks, and cleared cached image snapshots created before the mitigation, completing cleanup by September 19. Retained disk-I/O telemetry showed no evidence of malicious exploitation, and the researchers confirmed secure deletion of recovered data.


### [We just shipped support for the ugliest part of HTTP: Vary](https://yomu.fyi/post/we-just-shipped-support-for-the-ugliest-part-of-http-vary.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Zaidoon Abd Al Hadi
- Published: Sep 22, 2026
- Type: Announcement

The Vary response header, often called the ugliest part of HTTP, is now supported in Cache Rules on every Cloudflare plan. Vary tells caches which request fields may affect a response, but not which differences actually matter, leading to cache fragmentation or incorrect responses. For example, a server might deliver different image formats to different browsers, and a cache ignoring Vary risks serving the wrong bytes. The origin still names the request headers that may affect a response, but Cloudflare lets users decide how to handle each one. This support addresses the challenge of balancing correct caching with cache efficiency.


### [Introducing Worker Previews: isolated preview environments for every change your agent makes](https://yomu.fyi/post/introducing-worker-previews-isolated-preview-environments-for-every-ch.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Nanda Syahrasyad
- Published: Sep 22, 2026
- Type: Announcement

Worker Previews gives every Git branch its own production-like environment with an isolated URL, configuration, state, and observability. Developers deploy a Preview using npx wrangler preview, which creates a separate Worker version with its own variables, secrets, and bindings, distinct from production, on a stable URL that updates with each push. Durable Objects and Containers automatically receive new namespaces per Preview, preventing state contamination across branches during migrations or schema changes. Each Preview supports full observability—logs, errors, metrics, and traces—scoped to that branch, enabling agents to autonomously test, catch failures, push fixes, and verify before production. The feature enables an Agent Development Lifecycle where every change is atomic, independently deployable, and revisable before merging to production.


### [Python Workers are now generally available](https://yomu.fyi/post/python-workers-are-now-generally-available.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Hood Chatham
- Published: Sep 21, 2026
- Type: Announcement

Cloudflare announced general availability of Python Workers, making Python a first-class language on its developer platform. The runtime now encapsulates type conversion so developers use Cloudflare bindings like D1 and Workers AI directly, without the previously required JavaScript glue code. Popular frameworks FastAPI, Django, and Flask run inside Workers via built-in ASGI and WSCI connectors that translate JavaScript requests into standard Python structures. A custom socket syscall implementation enables TCP connections for database drivers, unlocking Hyperdrive integration with PostgreSQL and MySQL, previously blocked by WebAssembly sandbox limits. Example projects include streaming from Bluesky Jetstream via Durable Objects, building an MCP server with the official Python MCP package, and creating a RAG system with Vectorize, with documentation now including Python examples alongside TypeScript.


### [Saving another 100TB of RAM with math (and Rust)](https://yomu.fyi/post/saving-another-100tb-of-ram-with-math-and-rust.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Ivan Babrou
- Published: Sep 18, 2026
- Type: Explainer

Cloudflare describes how excessive memory use in pingora-ketama, the consistent-hashing component of its Pingora Backend Router, was investigated as a resource-efficiency problem at global scale. Consistent hashing maps servers and cache keys onto a circular hash space, but a single hash per server creates uneven ranges, while multiple hashes improve balance; with 160 points per server, the coefficient of variation falls to about 8% in the 100-server example. The work produced a v2 ring with compacted storage, faster sorting, and a configurable base number of hashes per node, while retaining the existing v1 ring and supporting simultaneous use during migration. After the old ring was decommissioned, measured memory usage for PBR fell by 100TB globally, and the changes are available in pingora-ketama behind an unadvertised Cargo feature.


### [When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts](https://yomu.fyi/post/when-scanners-miss-the-attack-how-cloudflare-client-side-security-prot.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Juan Miguel Cejuela
- Published: Sep 16, 2026
- Type: Explainer

Modern storefronts can appear healthy while malicious JavaScript diverts affiliate credit, hijacks searches or clicks, tampers with analytics, or loads further code. Cloudflare describes four operations spanning eight payloads that Page Shield ML detected in live traffic; humans verified the findings afterward, while seven payloads were absent from VirusTotal and none received a malicious verdict from URLScan. The detection system represents JavaScript as a graph with a graph neural network (GNN), sends fewer than 0.3% of analyzed scripts to a lightweight LLM on Workers AI, and uses a teacher cohort of frontier models for difficult investigations. This combination handles minification, renaming, some obfuscation, and behavior gated by device, time, geography, referrer, browser state, or cooldowns. The post concludes that continuous browser visibility and runtime context are needed because static, one-time scans can miss selectively executed attacks.


### [Have it both ways: stay discoverable in search while disallowing AI training](https://yomu.fyi/post/have-it-both-ways-stay-discoverable-in-search-while-disallowing-ai-tra.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Bryan Becker
- Published: Sep 15, 2026
- Type: Announcement

Cloudflare announces a Disallow AI Training setting intended to let website owners refuse AI training while keeping content available to search crawlers. The problem is mixed-use crawlers such as Applebot, Bingbot, and Googlebot, which can serve both search indexing and model training, making a simple block affect discoverability. Cloudflare says its network can publish preferences, identify and classify crawlers, block those that ignore controls, and report operator behavior on Radar; the setting publishes a no-training preference through robots.txt while allowing Accountable mixed-use crawlers for search. Apple, Google, and Microsoft meet or have committed to meet the Accountable requirements, which include training and summary opt-outs, URL-level visibility, metrics, and assurance that training opt-outs will not affect traditional search.


### [Give every teammate and agent the right level of access to your Workers](https://yomu.fyi/post/give-every-teammate-and-agent-the-right-level-of-access-to-your-worker.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Dina Kozlov
- Published: Sep 15, 2026
- Type: Announcement

Cloudflare has introduced resource-level access controls for Workers, allowing a teammate or agent to access one specific Worker rather than other resources in an account. Four roles define progressively broader capabilities: Metadata Read-Only exposes settings and observability data, Content Read-Only permits code or product-content reads, Editor allows content and settings changes without resource deletion, and Admin provides full control. These roles can be assigned to dashboard users or attached to scoped API tokens, supporting debugging without source exposure, code review without deployment, and CI/CD deployments limited to one Worker. Worker-level access also governs Durable Objects, while routes and Custom Domains require both Worker Editor access and Workers Routes permission; existing legacy permissions continue to work, but the new roles are recommended for granular access and are planned for D1, R2, and KV.


### [Introducing automatic remediation policies with Cloudflare CASB](https://yomu.fyi/post/introducing-automatic-remediation-policies-with-cloudflare-casb.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Michael Leslie
- Published: Sep 11, 2026
- Type: Announcement

Cloudflare CASB now supports automatic remediation policies that respond to newly detected SaaS security findings without requiring an administrator to act on each instance. Teams can match policies by vendor, integration or tenant, and finding type, then revoke file-sharing access, send finding details to webhooks, or do both; first-party remediation currently covers Microsoft and Google Workspace file and folder findings. The backend enqueues findings to Cloudflare Queues, uses a Worker to match policy configurations, and runs matched jobs through Cloudflare Workflows, which provides durable execution, retries, and rate-limit backoff. Policies generate administrator-activity and runtime execution logs, while the stated target from detection to completed remediation is five minutes or less; support for Custom Findings is planned for the coming weeks.


### [1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it](https://yomu.fyi/post/1-1-1-1-now-supports-post-quantum-dnssec-all-2-420-bytes-of-it.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Sebastiaan Neuteboom
- Published: Sep 10, 2026
- Type: Announcement

1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, a NIST-standardized post-quantum algorithm, as an initial step toward post-quantum DNSSEC. The operational problem is that each signature is 2,420 bytes—almost 38 times an ECDSA P-256 signature and larger than common DNS-over-UDP limits—while zones must continue publishing conventional signatures for older resolvers. Cloudflare’s resolver handles this by testing larger responses at Internet scale, relying on truncation and transport retries rather than fragmented UDP, and using authenticated DS records to require a valid post-quantum path when a zone advertises one, preventing downgrade to conventional validation. The change provides operational experience for an ecosystem migration that requires coordination across DNS participants; Cloudflare says it plans full post-quantum security by 2029.


### [How we rebuilt Cloudflare Workers’ module registry for Node.js compatibility](https://yomu.fyi/post/how-we-rebuilt-cloudflare-workers-module-registry-for-node-js-compatib.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Logan Gatlin
- Published: Sep 9, 2026
- Type: Explainer

Cloudflare has rebuilt the module registry in workerd, the open-source core of the Workers runtime, to improve speed, standards compliance, and alignment with Node.js. The change addresses compatibility beyond runtime APIs by making module resolution, loading, and caching behave more like Node.js across ESM, CommonJS, and WebAssembly. The new registry uses URLs as specifiers, supports import.meta.url, import.meta.main, and import.meta.resolve(), distinguishes modules by query strings and fragments, validates import attributes, follows require(esm) rules, and compiles modules lazily while sharing caches across isolates. It also supports WebAssembly source phase imports and consistent loading errors; the existing registry remains in place, and the new implementation must be enabled with the new\_module\_registry compatibility flag.


### [Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)](https://yomu.fyi/post/automatic-key-exchange-faster-post-quantum-secure-origin-handshakes-fo.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Suleman Ahmad
- Published: Sep 8, 2026
- Type: Announcement

Cloudflare’s Automatic Key Exchange addresses extra TLS 1.3 handshake latency and the difficulty of enabling post-quantum origin connections without manual configuration. Cloudflare previously sent an X25519 keyshare as its first guess; origins preferring another group returned a HelloRetryRequest, while sending X25519MLKEM768 indiscriminately risked oversized, split ClientHello messages and legacy compatibility failures. The system reuses Automatic SSL/TLS scanning to run lightweight handshakes for each supported group, map every origin’s capabilities and preferences, and tailor the initial keyshare, preferring X25519MLKEM768 when supported. During rollout, HelloRetryRequests dropped from roughly 52% to 3.7%, cutting more than 150 ms from p90 handshake latency, while hundreds of thousands of domains gained post-quantum origin connections without configuration. Cloudflare says it plans to extend scanning to post-quantum authentication, including ML-DSA certificates and future Merkle Tree Certificates.


### [Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models](https://yomu.fyi/post/introducing-context-aware-vulnerability-discovery-and-remediation-with.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Ken Sanderson
- Published: Sep 3, 2026
- Type: Announcement

Cloudflare announces invitation-only early access to Vulnerability Discovery and Remediation, a Managed Defense service that investigates authorized codebases and helps prioritize and mitigate vulnerabilities. It combines source-code analysis with production route activity, traffic volume, security events, and active Web Application Firewall (WAF) protections to assess exposure. Reconnaissance maps request paths to code, hunter agents search relevant sections, and validation checks proposed patches and custom WAF rules before customer review. OpenAI Daybreak models, including GPT-5.6 Cyber, run reconnaissance, hunting, and validation through AI Gateway, while source code, logs, and request metadata are bounded by authorization, redaction, access policies, and external checks. Findings receive source-based risk ratings that network evidence can raise, with code patches and conservative WAF mitigations prepared for review; customers decide whether to test or deploy them.


### [How we could save petabytes of cache storage with Zstandard and Pingora](https://yomu.fyi/post/how-we-could-save-petabytes-of-cache-storage-with-zstandard-and-pingor.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Aashi Patel
- Published: Sep 1, 2026
- Type: Problem & solution

Cloudflare prototyped Cache Transcoding, a Pingora-based architecture that stores eligible cache responses as Zstandard (zstd) rather than their original representation. On a fill, the proxy compresses qualifying uncompressed text at zstd level 3, records the compressed representation and original content length, keeps it compressed on disk and between Tiered Cache layers, and decodes it on the client-facing path. Eligibility requires a 200 OK response, compressible text, no existing Content-Encoding, known Content-Length of at least 4 KiB, and excludes several request and binary-content cases. In initial tests, eligible assets shrank to roughly one-third of their original on-disk size, with a 2.834x ratio, while encoding cost 4.31 ns per byte and decoding 1.56 ns; the modeled CPU increase stayed within budget, though broader testing remains necessary.


### [Introducing Adaptive Intelligence: undermining the economics of every bot attack](https://yomu.fyi/post/introducing-adaptive-intelligence-undermining-the-economics-of-every-b.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Chris Pope
- Published: Aug 31, 2026
- Type: Announcement

Cloudflare introduces Adaptive Intelligence, a bot detection engine designed for attackers who distribute requests across proxies, vary fingerprints, and continually test defenses. It argues that deterministic, rule-based systems create stationary targets: attackers receive repeated yes-or-no feedback while defenders update on slower release cycles, making adaptation economically cheaper for attackers. The engine changes this dynamic through continuously retrained machine learning, statistical rather than fixed judgments, and planned disposable rules that appear and retire at random intervals; it also learns from corrections and misses across millions of sites. Its first component, continuous retraining of the machine-learning system behind bot score, is launching now, while disposable rule generation and broader traffic learning are described as forthcoming, with Enterprise customers enabling “Auto Update Machine Learning” to receive it.


### [BotBase for Operators: A clearer path to joining Cloudflare's directory of bots and agents](https://yomu.fyi/post/botbase-for-operators-a-clearer-path-to-joining-cloudflare-s-directory.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Julian Laxman
- Published: Aug 28, 2026
- Type: Announcement

Cloudflare launched BotBase for Operators to give bot operators a clearer way to submit, monitor, update, and cancel bot-directory submissions from the dashboard. The new area includes a bots directory, submission form, and history tab with Waiting for review, Accepted, and Rejected statuses, including rejection reasons and classification changes. Its intake model records what a bot does, how it uses content, and whether it is direct or intermediary, while allowing multiple behaviors and Content Signals declarations. Reviews now use automated checks for duplicates, user-agent specificity, and verification through IP lists, reverse DNS, or Web Bot Auth, routing exceptions to staff. The launch focuses on visibility, with ownership, observability, and conversation identified as future goals.


### [How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache](https://yomu.fyi/post/how-we-saved-100-terabytes-of-memory-by-optimizing-1-1-1-1-s-dns-cache.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Sebastiaan Neuteboom
- Published: Aug 27, 2026
- Type: Problem & solution

Cloudflare's Big Pineapple platform, which powers 1.1.1.1 and other DNS services, stores over 250 billion cache entries simultaneously. To decrease fleet-wide memory consumption, engineers implemented five changes to in-memory cache data structures. Key modifications included swapping growable types like Vec and String for Box slices to eliminate capacity overhead, combining distinct record sections into a single list indexed by offsets, omitting redundant owner domain names, and serializing record bytes into contiguous buffers. In benchmarks, these optimizations decreased per-entry memory footprints by 56% while improving cache lookup latency by 19% and insert throughput by 43%. Across production instances, the rollout reduced working-set memory by approximately 100 terabytes.


### [The Cloudflare Blog – Brought to you by EmDash](https://yomu.fyi/post/the-cloudflare-blog-brought-to-you-by-emdash.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Kody Jackson
- Published: Aug 24, 2026
- Type: Problem & solution

Cloudflare migrated its official blog to EmDash, an Astro-focused content management system, acting as internal Customer Zero to evaluate scaling and usability. To prepare for traffic spikes reaching thousands of requests per second, engineers used k6 to execute ramp, breakpoint, and burst load tests. The resulting production architecture runs EmDash on Cloudflare Workers, pairing it with Workers Cache, an object cache backed by Workers KV, and Hyperdrive connected to PlanetScale. This layered caching design serves 99.5 percent of static files and 70 percent of requests from cache, flattening p95 latency under real-world loads reaching 850 requests per second. The migration also introduced a frontend redesign using the Kumo design system and added Model Context Protocol servers for automated agent workflows.


[Newer posts](https://yomu.fyi/company/cloudflare/page/3.md) · [Older posts](https://yomu.fyi/company/cloudflare/page/5.md)