Every post, summarised

Sep 29, 2026

• Cloudflare

  Using AI to chart a course for our post-quantum migration

  Cloudflare is racing toward a 2029 deadline for full post-quantum readiness, having already upgraded many products to post-quantum encryption but still needing to address authentication and remaining classical cryptography. To manage this massive migration, they built CryptoLabe, an internal AI-powered tool that scans their centralized codebase to discover and classify cryptography usage. The tool operates in two stages: discovery finds raw observations of cryptography across source, configuration, manifests, lockfiles, scripts, tests, and documentation, then analysis re-checks each observation, investigates runtime use and dependencies, and assigns classifications such as classical encryption, signature, or token. CryptoLabe also surfaces prerequisites where PQ migration is blocked by missing standards or library support, enabling Cloudflare to work with standards bodies and ecosystem stakeholders to drive migration plans. The post shares learnings for other organizations, recommending starting with a single repository, validating results, and prioritizing high-impact systems.

• Cloudflare

  Building a certificate authority for the whole Internet

  Cloudflare, which terminates TLS for millions of domains and sits in front of over 20% of global Internet request traffic, announced its intent to become a public certificate authority (CA) during Birthday Week 2026. The company has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs and signed a definitive agreement to acquire an established root from GlobalSign. This acquisition ensures certificate compatibility with older clients that a fresh root would never reach, addressing the long tail of devices where avoidable breakage occurs. Cloudflare plans to be among the first CAs to issue production Merkle Tree Certificates (MTCs) in early 2027, targeting post-quantum readiness as part of Chrome’s Quantum-resistant Root Program. The CA will be ACME-first, require ACME Renewal Information (ARI) support for issuance, and operate transparently with reproducible builds of signing software and a public dashboard.

• Cloudflare

  Adaptive application security for the AI era: how Cloudflare connects code, traffic, and intelligence to stop attacks

  An incident in July 2026 showed AI agents autonomously compromising OpenAI and Hugging Face infrastructure, chaining vulnerabilities and credentials over months before executing a final compromise in under 13 hours. Cloudflare argues that application security must become a continuous, connected system rather than isolated controls, because individual alerts miss the complete campaign. It introduces a four-stage framework: discover and prioritize risks, govern access and agent behavior, protect applications at runtime, and investigate, respond, and learn. New capabilities include LLM-based WAF penetration testing, expanded threat intelligence for all customers, automated positive security deployment, and an Autonomous Security Operation framework with three agent stages. Cloudflare’s network visibility across over 20% of the web enables correlating isolated signals into coordinated attack timelines, turning every investigation into stronger protection.

• Cloudflare

  Building a post-quantum certificate authority with Merkle Tree Certificates

  The Web PKI faces a scaling problem because post-quantum (PQ) signatures are roughly 40 times larger than classical ones, making direct adoption at Internet scale expensive. Merkle Tree Certificates (MTCs) address this by batching certificates into an append-only Merkle tree, allowing a CA to sign the tree root and clients to verify with a compact inclusion proof. Cloudflare is building a certificate authority that will support MTC issuance, targeting early 2027 for inclusion in Chrome’s new Quantum-resistant Root Store, and will offer standard MTC issuance at no cost. The MTC architecture couples issuance with logging (“issue by logging”), making transparency a first-party property rather than an add-on, which reduces redundancy and scaling overhead. Cloudflare successfully completed an experimental deployment with Chrome and is now moving to full production, but notes that broader ecosystem participation from browsers, CAs, and monitors is needed for the transition.

• Cloudflare

  We tested our own WAF with frontier AI models. Here’s what we found

  Cloudflare built a WAF tester that uses frontier AI models to iteratively mutate attack payloads based on real-time response feedback. The tester, implemented in Python, orchestrates an LLM proposal and review loop against an authorized customer staging environment protected by Cloudflare’s WAF. It ran 45 scenarios across six attack categories—XSS, SQLi, CMDi, SSRF, path traversal/LFI, and Log4j—starting from known blocked exploits and varying encoding, request placement, or destination representation. The vast majority of 1,107 recorded attempts were blocked; the few non-blocked requests were triaged by humans and used to create new detections that harden security for all Cloudflare customers. The post stresses that a WAF bypass still needs an exploitable application to succeed, so patching software remains essential, and suggests combining Managed Rules, Attack Signature Detection, and positive security controls for defense in depth.

• Cloudflare

  Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account

  Cloudflare introduced Threat Signals, a free agentic skill layer for open-source threat intelligence available to every account. The product targets the unstructured-reporting problem: converting research posts into indicators that security tools can consume while preserving the context that explains their relevance. A skill encodes detailed instructions that capture how an experienced analyst handles one part of the job, and it runs identically on every report. The agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags within a private, account-scoped dataset. This approach standardizes analyst expertise into repeatable, context-preserving processing for threat reports.

• Cloudflare

  Is your domain using post-quantum encryption? Now you can see for yourself

  Cloudflare introduced new post-quantum cryptography visibility tools in its Application Security and Logs products, including Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard, to help customers monitor encryption adoption. These tools surface the key exchange algorithm negotiated on every incoming request, enabling customers to audit their post-quantum posture, assess compliance, and identify cryptographic gaps across their domains. The primary post-quantum algorithm in TLS 1.3 is X25519MLKEM768, a hybrid of classical ECDHE over curve X25519 and the post-quantum ML-KEM, which provides belt-and-suspenders security against harvest-now-decrypt-later attacks. Cloudflare Radar data shows about 70% of browser-generated traffic uses post-quantum encryption on the visitor-to-Cloudflare connection, but only 15% of origin connections to Cloudflare use hybrid ML-KEM. For legacy origin servers that cannot support modern post-quantum cryptography, Cloudflare Tunnel can tunnel traffic over TLS 1.3 with X25519MLKEM768 without requiring any upgrade to the origin server itself.

• Cloudflare

  Enforce positive security with Cloudflare Application Profiles

  Cloudflare launches Application Profiles, a positive security feature that learns the expected structure of HTTP requests and identifies deviations. By analyzing path variables, query parameters, headers, cookies, and JSON body fields, the system builds a profile of valid data types, numeric ranges, string lengths, UUIDs, and enums. This approach reduces attack surface by blocking non-conforming requests without relying solely on known attack signatures, addressing the growing threat of AI-generated payloads. The feature extends Schema Learning and Schema Validation, previously available for APIs, to web applications. Profiles are automatically updated weekly as traffic changes. Customers can review violations in Security Analytics and create rules to enforce blocking, starting with observation mode; a closed beta is open to invited Enterprise customers without API Security.

• Cloudflare

  Preventing quantum downgrade attacks against IPsec

  Cloudflare has identified a design flaw in IPsec that allows a quantum attacker to downgrade post-quantum-protected connections to classical cryptography. The attack exploits the fact that IKEv2 endpoints sign only their outbound messages rather than the full handshake transcript. This vulnerability requires a quantum computation in real time during the handshake, and resource estimates for such attacks have decreased, prompting Cloudflare to move its transition deadline to 2029. To mitigate this, Cloudflare worked with the IETF to develop a full transcript authentication extension for IKEv2 that prevents downgrade attacks. The extension is now available in beta for Cloudflare WAN and Magic Transit customers on an opt-in basis.

• Jetbrains

  The State of Kotlin in 2026 Report

  Kotlin turned fifteen in 2026, and the State of Kotlin in 2026 report examines how the language built a mature ecosystem and gained worldwide adoption. The report combines JetBrains research with independent industry data to assess Kotlin’s evolution and answer questions about its staying power and scalability. While Kotlin remains deeply established in Android development, more than half of Kotlin developers now work on backend projects. Among surveyed Kotlin developers, 93% use at least one AI coding tool, and 81% report that AI-generated Kotlin code is fully correct or requires only minor fixes. The report concludes that Kotlin’s evolution is defined by increasing diversity across backend, multiplatform, and AI-assisted development.

• Jetbrains

  Software Quality Assurance Tools and Tips for Developers

  Software quality assurance (SQA) has evolved from a final gate to a continuous process integrated throughout the SDLC. The 2025 Stack Overflow Developer Survey shows 84% of developers use AI tools, increasing the need for tighter quality reviews. Shift-left analysis moves checks earlier, catching defects when cheapest and easiest to fix, and poor software quality costs the US at least $2.41 trillion annually. Essential SQA tools include static code analyzers, unit testing frameworks, integration testing tools, performance testers, and security scanners, but no single tool covers every aspect, so a layered toolkit is vital. A balance of automated and manual code review remains important, and best practices include automating repetitive checks, integrating testing into CI/CD, monitoring technical debt, and treating security as integral.

• Clickhouse

  ClickHouse expands collaboration with Microsoft, bringing Fabric integration, deeper OneLake interoperability, and enterprise deployment flexibility

  ClickHouse announced a significant expansion of its strategic collaboration with Microsoft at The European Microsoft Fabric + SQL Community Conference, including the public preview of a native ClickHouse workload for Microsoft Fabric that brings sub-second analytical query latency to OneLake. The company also made generally available the ability to read Apache Iceberg tables from OneLake using OneLake Table APIs, and introduced a public preview of writing Iceberg tables back to OneLake. These capabilities eliminate data duplication and ingestion steps, allowing teams to keep OneLake as the governed single source of truth while leveraging ClickHouse’s speed. ClickHouse Bring Your Own Cloud (BYOC) is now available in the Microsoft Marketplace, enabling customers to run ClickHouse Cloud inside their own Azure tenant with full control over IAM, networking, and encryption. The integrations aim to serve real-time agentic workloads, interactive dashboards, and observability without separate cluster provisioning or ETL pipelines.

• Clickhouse

  ClickHouse Workload for Microsoft Fabric: sub-second analytics on OneLake, now in public preview

  The ClickHouse workload for Microsoft Fabric brings ClickHouse as a native acceleration layer for OneLake, now in public preview. It provisions dedicated ClickHouse Cloud services on Azure via the Fabric Extensibility Toolkit, using a ClickHouse item in the workspace. Users sync OneLake tables through ClickPipes as point-in-time snapshots with no ingestion charges. The embedded SQL console and external tools (Power BI, Copilot Studio, GitHub Copilot) can then query billions of rows with sub-second response times at high concurrency. Planned future features include write-back to OneLake, continuous sync, permission sync, and deeper Power BI integration.

• Clickhouse

  ClickHouse now writes Apache Iceberg tables to Microsoft OneLake

  ClickHouse previously wrote Iceberg tables to object storage without catalog registration, limiting their discoverability. Now it writes Iceberg tables directly to Microsoft OneLake, registering in the catalog via Iceberg REST Table APIs and securing with OneLake Security. Use cases include AI agents monitoring order data and publishing real-time anomaly detection results to OneLake, and applications writing directly via ClickHouse without a separate ingestion layer. The connection uses the DataLakeCatalog engine with catalog_type=‘onelake’, warehouse parameter combining workspace and lakehouse IDs, and Microsoft Entra ID service principal authentication; writing uses standard INSERT INTO syntax with backtick-quoted namespace.table names. OneLake automatically syncs Iceberg and Delta Lake formats, provides governance with lineage tracking and data protection, and its security APIs are opening to third-party engines; this is the first catalog to support writes from ClickHouse, with more catalogs planned.

• Sentry

  Big improvements to Seer Agent

  Seer Agent, Sentry’s AI debugging assistant, now performs write actions through the Sentry API, such as setting up custom dashboards, creating monitors and alerts, and assigning, resolving, and archiving issues. It defaults to the user’s permission level and explicitly requests permission for tasks outside its write scope, with permissions not persisting beyond a single chat. The agent can also incorporate infrastructure data from external monitoring platforms like Datadog and Google Cloud Platform via Seer Connectors, using API keys instead of OAuth. This allows Seer Agent to diagnose issues by connecting front-end and back-end data beyond Sentry’s native scope. These updates evolve Seer Agent from a conversational rubber duck into a proactive debugging assistant that can act on behalf of users.

• Twilio

  How to Augment Voice Calls with Twilio Intelligence

  This tutorial shows PHP developers how to augment a Twilio voice AI agent with Conversation Intelligence, Conversation Orchestrator, and Conversation Memory. The goal is to retrieve a short summary of each customer call, analyze the caller’s sentiment, and check whether the agent followed set guidelines. The information is persisted to a SQLite database for later use. The tutorial builds on a previous voice agent tutorial and requires a Twilio account, a voice-capable phone number, and ngrok to expose the local server. It walks through setting up Conversation Orchestrator, Conversation Intelligence, and the application database, then testing the flow with example questions. The post also mentions the Conversations API (V2) for retrieving call summaries and sentiment analysis.

• Twilio

  86% of brands think their AI works. Only 51% of customers agree.

  A Twilio research report identifies a 35-point satisfaction gap: 86% of brands believe their AI customer service satisfies customers, but only 51% of consumers agree. The discrepancy arises because companies measure metrics such as conversation completion surveys and containment rates, which systematically exclude abandoned or unresolved interactions. 71% of consumers abandon a conversation when the AI fails to recognize them, yet those exits rarely appear in satisfaction data. 49% of consumers say AI never resolved their issue. To close the gap, Twilio recommends tracking abandonment by conversation stage, resolution of the underlying issue across sessions, repeat contact within seven days, containment split by outcome, and escalation quality.

• Auth0

  Integrating Claude Code with Auth0 APIs

  This tutorial explains how to integrate Claude Code with Auth0’s Management API using the Auth0 MCP Server, enabling AI-driven authentication configuration management from the terminal. The setup uses the OAuth 2.0 Device Authorization Flow to obtain scoped access tokens stored in the OS keychain, avoiding static secrets that risk exposure in source control. Developers initialize the MCP server with explicit scopes like read:clients or update:actions, then register it with Claude Code via the claude mcp add command, with credentials never stored in plain text. A CLAUDE.md file provides project context and constraints, guiding the agent to respect environment-specific configurations and security policies such as never modifying production callback URLs without confirmation. The tutorial demonstrates refactoring JWT validation code in a single terminal session, with human-in-the-loop confirmation ensuring safe agentic changes and all auth-critical paths undergoing manual PR review.

• Yelp

  The making of the Yelp Assistant UI

  Yelp Assistant is the first large-scale consumer LLM product at Yelp, connecting users with local professionals via chat. To iterate quickly across iOS, Android, and web while avoiding long app-store update cycles, the team chose a hybrid architecture: the top bar and input bar are native, while the chat content area is server-driven using Yelp’s CHAOS framework. The view and data are separated — the client fetches a CHAOS view template once, then conversation data hydrates that template on each turn. The backend sends MessageEvent objects, quick replies, and client actions (such as DisableChat) to control the UI. This hybrid approach enabled rapid iteration, but required building new CHAOS components for text input and network requests, and posed cross-platform consistency challenges.

• Auth0

  Introducing IdentiFlows.dev: A Visual Reference for Identity Flows

  Developers often struggle to quickly find accurate sequence diagrams for OAuth 2.0 and OpenID Connect flows. IdentiFlows.dev is a new website that provides a visual reference for common identity protocols, organized into four categories. Each flow page includes an introduction explaining the flow’s purpose, a sequence diagram showing the full exchange, and a step-by-step breakdown of each stage, with an interactive mode to walk through the steps. The initial release covers eight flows, including OAuth 2.0 Authorization Code with PKCE, the recommended login flow for most modern apps, SAML 2.0 SP-Initiated SSO, DPoP-Bound Access Token requests, and OpenID Connect Discovery. The project is an early release with plans to add more flows like Client Credentials, Device Authorization, and WebAuthn, and the author invites feedback to guide development.