What Cloudflare shipped in July 2026

An API for MoQ: provision your own isolated relays

Cloudflare introduced a provisioning API to create isolated MoQ relays with access controls, enabling production-grade applications like live auctions. The relays are globally available within seconds…

Cloudflare adds key rotation for Stream live input broadcast credentials

Cloudflare introduced the ability to rotate broadcast keys for Stream live inputs without altering the input ID or configuration. The feature revokes compromised credentials, disconnects stale broadca…

Cloudflare One Client for Windows beta adds protocol swapping, DNS fixes, and IPv6 multicast route corrections

Cloudflare released a beta update for its Windows Cloudflare One Client (v2026.7.1210.1) addressing connectivity reliability, DNS parsing, MASQUE stalls, and IPv6 multicast route issues. The update al…

Cloudflare adds static OAuth client credentials for MCP server portals

Cloudflare now allows MCP server portals to connect to upstream MCP servers requiring pre-registered OAuth clients, enabling integrations with SaaS providers like Slack and GitHub that lack Dynamic Cl…

Cloudflare adds Browser Run Playground to dashboard for live browser testing

Cloudflare introduced a Playground feature in its Browser Run product, allowing users to test live browser actions like screenshots, PDFs, and AI-based data extraction directly from the Cloudflare das…

Cloudflare adds Wrangler startup profiling for Workers

Cloudflare’s Wrangler CLI now includes `wrangler check startup`, which reports raw and compressed bundle sizes and local CPU activity during Worker startup. The tool highlights code and dependencies t…

Cloudflare One Client for macOS beta adds protocol swapping and fixes multiple issues

Cloudflare released a beta update for its macOS Cloudflare One Client (v2026.7.1210.1) on July 31, 2026, introducing protocol swapping for improved reliability, fixes for certificate errors, DNS parsi…

Dogfooding at scale: migrating cdnjs to Cloudflare’s Developer Platform

Cloudflare completed the migration of cdnjs, a 15-year-old open-source CDN serving 9 billion requests daily, to its Developer Platform. The new architecture leverages R2, Workflows, KV, Queues, and Co…

Cloudflare integrates AI Search with Agents SDK, Vercel AI SDK, and LangChain

Cloudflare added official guides and SDK integrations to use its AI Search product directly from the Cloudflare Agents SDK, Vercel AI SDK, and LangChain. Developers can now ground agent responses in i…

Cloudflare Realtime SFU launches HTTPS API for session and track management

Cloudflare Realtime introduced a new HTTPS API to manage SFU sessions and media tracks, enabling developers to create, update, and close sessions and tracks via endpoints like POST /sessions/new and P…

Cloudflare R2 launches Sippy for on-demand data migration

Cloudflare introduced Sippy, a feature for R2 object storage that migrates data from other cloud providers on-demand as objects are requested, reducing egress fees. Sippy copies objects to R2 only whe…

Cloudflare Workers Builds defaults to Node.js 24

Cloudflare’s Workers Builds now defaults to Node.js 24.18.0, replacing the prior default, while still allowing explicit version overrides via environment variables or config files. Node.js 22.23.2 rem…

Cloudflare integrates AI Search with Vercel AI SDK for TypeScript apps

Cloudflare added an official integration between its AI Search service and the Vercel AI SDK via the ai-search-provider package, enabling developers to build TypeScript applications that generate grou…

Cloudflare launches Agents SDK for AI Search-powered agents on Workers

Cloudflare introduced an Agents SDK enabling developers to build stateful AI agents on Workers that provision AI Search instances, index content, and search it via tools. The SDK integrates hybrid sea…

Post-quantum authentication to origins is now supported

Cloudflare now supports post-quantum authentication for Authenticated Origin Pulls and Custom Origin Trust Store via ML-DSA signatures, protecting Cloudflare-to-origin connections against quantum decr…

Cloudflare WAF adds protections for Nuxt RCE, Fastjson deserialization, and SSRF

Cloudflare released new WAF managed rulesets on July 29, 2026, adding protections against critical vulnerabilities including Nuxt Server Island RCE, Alibaba Fastjson deserialization RCE, cloud metadat…

The 2026-07-28 MCP Specification Release Candidate

The Model Context Protocol (MCP) released a stateless protocol revision (v2026-07-28) as a release candidate, removing session-based routing, sticky sessions, and the initialize/initialized handshake.…

Cloudflare restricts select AI models to Workers Paid plan

Cloudflare removed access to Kimi K2.6, Kimi K2.7 Code, and GLM-5.2 from its Workers Free plan, requiring the $5/month Paid plan to use them. The change aims to reduce capacity errors for free-tier us…

Cloudflare Workers adds startActiveSpan() and span.end() for custom tracing

Cloudflare introduced new tracing APIs, `tracing.startActiveSpan()` and `span.end()`, for Workers to instrument long-running operations like stream pipelines. Unlike the existing `tracing.enterSpan()`…

Cloudflare adds maximum DNS TTL control in Gateway for faster policy propagation

Cloudflare introduced a maximum DNS TTL feature in Gateway to cap upstream TTL values between 60 and 36,000 seconds, ensuring faster propagation of DNS policy changes like domain blocks. The setting c…

Cloudflare adds maximum DNS TTL control in Gateway

Cloudflare One now lets admins set a maximum TTL for DNS responses at the account level, with per-location overrides, to ensure faster propagation of DNS policy changes like domain blocks. The feature…

Cloudflare Browser Run adds Live View for real-time remote debugging

Cloudflare introduced Live View, a feature allowing real-time interaction and debugging of remote Browser Run sessions through hosted DevTools UI or native Chrome DevTools. Users can access sessions v…

Cloudflare updates DoH JSON API with human-readable record formats and numeric DNSSEC identifiers

Cloudflare is rolling out a breaking change to the 1.1.1.1 DoH JSON API, replacing RFC 3597 hex encoding with human-readable formats for CAA, NAPTR, RP, IPSECKEY, SVCB, HTTPS, TLSA, SSHFP, and OPENPGP…

Cloudflare MCP servers adopt MCP 2026-07-28 Specification with Streamable HTTP support

Cloudflare’s product-specific MCP servers now support the new MCP 2026-07-28 specification, replacing the deprecated HTTP+SSE transport with stateless Streamable HTTP requests. Clients using 2025 Stre…

Browser Run - Browser Run adds structured handoff for Human in the Loop

Cloudflare introduced structured handoff for Human-in-the-Loop workflows in Browser Run, enabling agents to pause and request human intervention via Live View. This replaces manual polling with a form…

2026 Cloudflare App Innovation Report

We’re open sourcing our privacy proxy CLI

Cloudflare released pvcli, an open-source CLI tool under Apache-2.0 for debugging privacy-preserving protocols like Oblivious HTTP (OHTTP). The tool simplifies complex protocol debugging by handling b…

Agents, Workers - Agents SDK adds MCP Specification 2026-07-28 support

Cloudflare released Agents SDK v0.20.0 with client and server support for the MCP 2026-07-28 release candidate, enabling stateless MCP requests in Workers without transport sessions or Durable Objects…

Cloudflare launches createTestHarness API for Workers integration testing

Cloudflare introduced the createTestHarness() API in Wrangler to enable integration testing for Cloudflare Workers from any Node.js test runner. The feature runs production build output, dispatches re…

Cloudflare deprecates unstable_startWorker() API in Workers

Cloudflare deprecated the unstable_startWorker() API for integration testing in Workers, recommending the createTestHarness() API instead. The deprecated API exposed Wrangler dev server internals and …

Cloudflare adds createTestHarness() for production-grade Worker integration tests

Cloudflare introduced `createTestHarness()`, a Wrangler API enabling integration tests against production Worker builds from any Node.js test runner. The tool supports request dispatching, storage res…

Cloudflare migrates to MCP SDK v2 with Agents SDK v0.20.0

Cloudflare’s Agents SDK v0.20.0 introduces MCP SDK v2, requiring developers to migrate servers and clients from SDK v1 to v2 packages. The update deprecates legacy APIs like `createMcpHandler` with SD…

Cloudflare Audit Logs v2 adds Resource History with side-by-side diffs

Cloudflare introduced Resource History in Audit Logs v2, enabling users to view the full change history for any resource and compare modifications side-by-side. The feature integrates with existing au…

BGP ORIGIN attribute manipulation and its impact on the Internet

Cloudflare’s investigation found ~70% of observed BGP paths have altered ORIGIN attributes, with ~10% of direct peers and 26% of top 50 ASes rewriting ORIGIN to IGP to influence route selection. This …

Cloudflare enables automatic TLS 1.3 key exchange to origins with post-quantum support

Cloudflare introduced automatic key exchange for TLS 1.3 connections to origins, reducing latency by eliminating one round trip via predictive key share selection. The feature scans origins daily to p…

Cloudflare R2 Sippy adds Azure Blob and S3-compatible storage support

Cloudflare’s Sippy tool now supports incremental migration from Azure Blob Storage and any S3-compatible provider to R2, enabling on-demand data copying without full dataset transfers or egress fees. …

Cloudflare launches Cache Response Rules to fix origin caching issues

Cloudflare introduced Cache Response Rules, a new rule type that modifies origin responses after they arrive but before caching. This addresses common caching problems like stray Set-Cookie headers or…

Cloudflare Agents SDK now supports AI SDK v6 and v7

Cloudflare’s Agents SDK packages (`agents`, `@cloudflare/ai-chat`, `@cloudflare/codemode`, `@cloudflare/think`) now support AI SDK v6 and v7 simultaneously, eliminating forced migration pressure. Appl…

Cloudflare Turnstile Spin: AI-powered end-to-end setup flow

Cloudflare introduced Turnstile Spin, a streamlined setup flow for its Turnstile CAPTCHA alternative that automates widget creation and server-side siteverify integration. Users can set it up via the …

Cloudflare expands Code Mode API with six new entry points and runtime methods

Cloudflare released a comprehensive API reference for Code Mode, introducing six new package entry points (@cloudflare/codemode, /ai, /mcp, /tanstack-ai, /browser, /vite) and detailed runtime methods …

Cloudflare Agents SDK reduces MCP schema conversion and adds Code Mode runtime APIs

Cloudflare’s Agents SDK now reuses MCP schema conversions to avoid redundant work and adds an opt-out for automatic MCP tool exposure in Think. The Code Mode runtime gains direct APIs (`execute()`, `s…

Cloudflare adds HTTP header modification in Gateway for tenant control and identity forwarding

Cloudflare’s Gateway HTTP policies now allow modifying request headers before they reach their destination, enabling dynamic header injection for identity, source IP, and other context. This supports …

Cloudflare launches durable Code Mode runtime for Agents SDK

Cloudflare introduced a durable Code Mode runtime for its Agents SDK, enabling persistent execution history, pending approvals, and reusable snippets via Durable Object hibernation. The runtime integr…

Cloudflare enables MCP tool integration in Code Mode durable runtime

Cloudflare added support for exposing tools from existing MCP connections within its durable Code Mode runtime via the `McpConnector` class. Developers can now integrate MCP server tools (e.g., GitHub…

Pricing change detected for Cloudflare

Pricing updated for Cloudflare: - Free: promotion ended (was: forever)

Cloudflare One Client for Linux reaches GA with version 2026.6.880.0

Cloudflare released the general availability version 2026.6.880.0 of its Cloudflare One Client for Linux, resolving a regression that increased DNS-over-TCP queries. The update prioritizes UDP for fal…

Cloudflare WAF update blocks new CVEs for ColdFusion, WordPress, and generic threats

Cloudflare released a WAF update on July 21, 2026, introducing new rules to block critical vulnerabilities in Adobe ColdFusion (CVE-2026-48276, CVE-2026-48282) and WordPress (CVE-2026-60137, CVE-2026-…

Cloudflare enables Devin agents to run on its platform via Devin Outposts

Cloudflare introduced Devin Outposts, allowing Devin AI agents to execute in isolated sandboxes on Cloudflare Containers. Each session runs independently, enabling secure code execution and tooling ac…

Cloudflare enables Devin Outposts on Workers and Containers

Cloudflare introduced Devin Outposts, allowing Devin AI agents to run each session in isolated Cloudflare Containers via Workers. Users can deploy via a one-click button or manually with Node.js, Dock…

Cloudflare One Client for Windows (v2026.6.880.0) reaches GA

Cloudflare released the general availability version 2026.6.880.0 of its Cloudflare One Client for Windows, resolving a regression that had increased DNS-over-TCP queries. The update prioritizes UDP f…

Cloudflare enables automatic post-quantum TLS 1.3 key exchange to origins

Cloudflare introduced automatic origin key exchange to streamline TLS 1.3 handshakes with origins by predicting and sending preferred key algorithms in the first ClientHello, reducing network round tr…

Cloudflare One Client for macOS reaches general availability

Cloudflare released the general availability version 2026.6.880.0 of its Cloudflare One Client for macOS, addressing a DNS-over-TCP regression that increased fallback queries. The update prioritizes U…

Cloudflare deprecates Account Role API in favor of Permission Groups API

Cloudflare deprecated its Account Role API on July 21, 2026, replacing it with the Permission Groups API. The new API introduces a different response schema, requiring integrations to remap legacy Rol…

Pricing updated for Cloudflare: - Free: new promotion — forever

Cloudflare Internal DNS is now generally available

Cloudflare announced the general availability of Internal DNS, a unified platform for managing both public and private DNS resources on a single control plane. Enterprise customers with Cloudflare Gat…

Next.js July 2026 security release patches 9 CVEs across App Router and Server Actions

Next.js released v16.2.11 and v15.5.21 to address nine CVEs, including high-severity Denial of Service flaws in App Router with Server Actions, middleware bypasses in Turbopack apps, and SSRF risks in…

Cloudflare Access unifies login flow for HTTP private apps with browser-based auth

Cloudflare Access now uses a browser-based login flow for plaintext HTTP private applications on port 80, replacing the previous Cloudflare One Client notification method. Users now see the Access log…

Cloudflare adds total SQLite storage metrics for Durable Objects namespaces

Cloudflare introduced a new Total storage chart in the dashboard to track SQLite storage usage over time for Durable Object namespaces. The feature helps users monitor storage growth, validate cleanup…

Cloudflare enables default $10 budget alerts for Pay-as-you-go accounts

Cloudflare is rolling out default $10 budget alerts for eligible Pay-as-you-go accounts, triggered at the start of each billing cycle. The alerts are informational only, do not cap usage, and exclude …

Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities

Cloudflare deployed new WAF rules at 17:03 UTC on July 17, 2026, to protect against an unauthenticated RCE and SQL injection vulnerability in WordPress. The protections cover all customers (free and p…

Pricing updated for Cloudflare: - Plan features or structure changed

Cloudflare enables remote restart, reboot, and shutdown for Cloudflare One Appliances

Cloudflare added dashboard and API controls to remotely restart, reboot, or shut down Cloudflare One Appliances with optional persistent state purging. Restart refreshes managed services, reboot power…

Cloudflare enables self-serve member management for Distributor, MSSP, and Agency partners

Cloudflare now allows Distributor, MSSP, and Agency partners to add and manage Organization Members directly via the dashboard without Cloudflare assistance. Previously, this required manual requests …

Cloudflare emergency WAF release blocks critical RCE and SQLi exploits

Cloudflare issued an emergency WAF update on July 17, 2026, adding new managed rules to block active exploitation of critical RCE and SQL injection vulnerabilities in popular web frameworks. The chang…

Cloudflare Gateway adds HTTP header control for Allow policies

Cloudflare Gateway now allows administrators to add, overwrite, or delete HTTP request headers in Allow policies using static values or dynamic variables like user email, device ID, or source IP. Oper…

Cloudflare adds email message preview in Activity log for Email Service

Cloudflare introduced a feature allowing users to preview sent emails directly in the Email Service Activity log, including HTML, text, headers, attachments, and raw source. Previously, only delivery …

Pricing updated for Cloudflare: - Free: now includes Teams under 50 users or enterprise proof-of-concept tests. - New tier: Pay-as-you-go ($7/mo per user) - Removed: Teams (Pay-as-you-go) tier - Remov

Cloudflare adds bot management fields and ASN support to Cache Rules

Cache Rules now supports bot management fields (scores, JA3/JA4 fingerprints, verified bot status) and ASN data in expression filters, enabling granular cache policies. This allows segmenting caching …

Cloudflare adds bulk PDF printing for browser-based RDP sessions

Cloudflare introduced bulk printing for PDFs in browser-based RDP sessions, allowing users to combine multiple PDFs into a single print job directly from the clipboard panel. The feature works in Chro…

Cloudflare adds Wrangler commands for Flagship feature flag management

Cloudflare introduced `wrangler flagship`, a new command suite in Wrangler for managing Flagship apps and feature flags directly from the terminal. Developers can create apps, bind them to Workers, an…

Pricing updated for Cloudflare: - New tier: Teams (Pay-as-you-go) ($7/mo per user) - New tier: Teams (Contract) (Custom pricing) - Removed: Free (SSE) tier - Removed: Pay-as-you-go (SSE) tier - Remove

Cloudflare announces multiple API deprecations with end-of-life dates through 2026

Cloudflare published a deprecation schedule for six API endpoints and features, including Workers KV legacy routes, Zero Trust network routes, AMP/SXG, legacy Registrar APIs, Zone Settings Batch API, …

@cloudflare/workers-auth@0.5.0

Minor Changes #14630 42df9bb Thanks @penalosa ! - Extract the Cloudflare CLI auth layer into a product-agnostic @cloudflare/workers-auth core The OAuth login/logout/refresh, credential storage, config…

@cloudflare/workers-utils@0.27.0

Minor Changes #14630 42df9bb Thanks @penalosa ! - Extract the Cloudflare CLI auth layer into a product-agnostic @cloudflare/workers-auth core The OAuth login/logout/refresh, credential storage, config…

@cloudflare/vite-plugin@1.45.0

Minor Changes #14652 317ce1f Thanks @jamesopstad ! - Append Workers runtime types to the generated types when using experimental.newConfig , with a new types.includeRuntime option When using the exper…

@cloudflare/vitest-pool-workers@0.18.5

Patch Changes Updated dependencies [ 7692a61 , ed33326 , 018574b , eb99ab1 , cdf3148 , 7692a61 , 7692a61 , 3015320 , 899c297 , 9da77ac , 317ce1f ]: miniflare@4.20260710.0 wrangler@4.111.0

@cloudflare/pages-shared@0.13.157

Patch Changes Updated dependencies [ 7692a61 , ed33326 , 018574b , 7692a61 ]: miniflare@4.20260710.0

@cloudflare/runtime-types@0.0.2

Patch Changes Updated dependencies [ 7692a61 , ed33326 , 018574b , 7692a61 ]: miniflare@4.20260710.0

create-cloudflare@2.70.11

Patch Changes #14660 a6abca6 Thanks @dependabot ! - Update dependencies of "create-cloudflare" The following dependency versions have been updated: Dependency From To create-analog 2.6.2 2.6.3 #14662 …

@cloudflare/workers-shared@0.19.8

Patch Changes #14677 205a260 Thanks @WillTaylorDev ! - Emit servedBy and requestKind analytics from the Workers Assets asset worker Real asset hits and SPA or 404 fallbacks previously logged the same …

Email Service, Queues - Subscribe to Email Sending events with Queues

Cloudflare introduced the ability to subscribe to Email Sending events via Queues, enabling users to receive outbound transactional email lifecycle events (e.g., delivered, bounced, failed) on a queue…

KV - Deprecate legacy Workers KV namespace API routes

Cloudflare deprecated legacy Workers KV namespace API routes on July 15, 2026, with full removal scheduled for October 15, 2026. Users must migrate from /workers/namespaces/ to /storage/kv/namespaces/…

Cloudflare adds Email Sending lifecycle event subscriptions via Queues

Cloudflare’s Email Sending service now supports event subscriptions for outbound transactional email lifecycle events, including delivery, deferral, bounce, failure, rejection, complaint, and spam eve…

Cloudflare launches Organizations for Enterprise with unified account management

Cloudflare introduced Organizations, a single-tier structure for Enterprise customers to manage multiple accounts from one dashboard. The feature enables implicit access for members across all account…

Cloudflare launches Internal DNS as generally available

Cloudflare announced the general availability of Internal DNS, consolidating public and private DNS onto a single global control plane. The feature integrates with Gateway for Enterprise customers, en…

A broken DNSSEC rollover took down .AL. Now 1.1.1.1 tells you when validation is bypassed

Cloudflare introduced Extended DNS Error (EDE) code 33 in its 1.1.1.1 resolver to explicitly signal when DNSSEC validation is bypassed due to a Negative Trust Anchor (NTA). This addresses a gap where …

Cloudflare WAF adds rules for Citrix NetScaler and Kemp LoadMaster CVEs

Cloudflare released new WAF managed rules to block exploits for two critical vulnerabilities: CVE-2026-8451 in Citrix NetScaler ADC/Gateway and CVE-2026-8037 in Progress Kemp LoadMaster. Both rules ch…

Cloudflare launches Temporary Accounts API for AI agents and platforms

Cloudflare introduced a Temporary Accounts API enabling platforms to create preview accounts via REST API, allowing AI agents and builders to deploy Workers before user sign-up. Users can later claim …

Cloudflare improves Web Analytics dashboard reliability for large accounts

Cloudflare Web Analytics rolled out optimizations to fix dashboard loading failures for accounts tracking over 100 sites. The update reduces timeouts and errors, enabling aggregate views for accounts …

Introducing Precursor: detecting agentic behavior with continuous client-side signals

Cloudflare introduced Precursor, a session-based client-side verification system that continuously collects behavioral signals (e.g., mouse movements, keyboard activity) to distinguish human traffic f…

Cloudflare launches Precursor, a one-click behavioral defense against modern bots

Cloudflare introduced Precursor, a next-generation behavioral validation engine for bot management that continuously monitors user sessions to detect evasive bots without disrupting legitimate users. …

Cloudflare launches Precursor for continuous behavioral bot detection

Cloudflare introduced Precursor, a continuous behavioral validation engine for bot management that analyzes session-level interactions to distinguish humans from advanced bots with higher precision. I…

Cloudflare rolls out Precursor session-based bot detection for Challenges

Cloudflare introduced Precursor, a client-side JavaScript tool enabling continuous session-based behavioral bot detection within Cloudflare Challenges. It evaluates signals across sessions, re-validat…

Cloudflare R2 Data Catalog adds read-only API tokens for query engines

Cloudflare’s R2 Data Catalog now supports read-only API tokens, allowing query engines like R2 SQL, DuckDB, and PyIceberg to authenticate with least-privilege access. Previously, all operations requir…

Cloudflare Agents SDK adds MCP elicitation support for form and URL requests

Cloudflare’s Agents SDK now lets MCP clients handle elicitation requests from connected servers, enabling structured form input and consent-based URL flows. Developers must register handlers in onStar…

Cloudflare Markdown for Agents now preserves origin headers and content signals

Cloudflare’s Markdown for Agents feature now preserves security headers (HSTS, CSP, CORS, etc.), caching headers (Cache-Control, Expires), and origin-set Content-Signal headers during HTML-to-Markdown…

R2 Data Catalog, R2 - R2 Data Catalog compaction now optimizes manifest files

Cloudflare’s R2 Data Catalog now automatically optimizes Iceberg manifest files during compaction by rewriting and clustering them by partition. This reduces metadata I/O overhead and speeds up query …

Pricing updated for Cloudflare: - New tier: Free (SSE) ($0/mo — promo: forever) - New tier: Pay-as-you-go (SSE) ($7/mo user) - New tier: Contract (SSE) (Custom pricing) - Removed: Pay-as-you-go tier

Pricing updated for Cloudflare: - Free: promotion ended (was: forever) - Free: now includes forever

Cloudflare introduces Durable Objects migrations for class management

Cloudflare added migration support for Durable Objects to manage class creation, renaming, deletion, and transfers via Wrangler configuration. Key changes include new `new_sqlite_classes` and `deleted…

Improving Smart Tiered Cache for Public Cloud Regions

Cloudflare launched Smart Tiered Cache for Public Cloud Regions, enabling customers to provide cloud region hints (e.g., aws:us-east-1) for anycast origins hosted on AWS, GCP, Azure, or Oracle Cloud. …

Cloudflare improves DLP source code detection with whole-file focus and configurable confidence

Cloudflare updated its Data Loss Prevention (DLP) source code detection to analyze whole source code file uploads and downloads instead of partial scans, reducing false positives. The system now requi…

Cloudflare adds plain text output option to Markdown Conversion service

Cloudflare’s Markdown Conversion service now supports a new `output.format` option set to `text`, removing Markdown syntax from converted content. The default remains `markdown`, ensuring backward com…

Cloudflare adds API endpoint to create tunnel routes for private networks

Cloudflare introduced a new API endpoint (`POST /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}`) to route private networks through Cloudflare Tunnels. The endpoint accepts a tunnel…

Cloudflare updates API to modify private network routes in Zero Trust

Cloudflare introduced a PATCH endpoint to update existing private network routes in its Zero Trust suite. The API allows modification of CIDR-based routes via `/accounts/{account_id}/teamnet/routes/ne…

Why we cannot wait for better post-quantum signature algorithms

Cloudflare explains why ML-DSA, a standardized post-quantum signature algorithm, will be the interim solution for quantum-resistant authentication despite its limitations. The company targets full pos…

Cloudflare Workers AI launches with 50+ open-source models and serverless GPUs

Cloudflare launched Workers AI, a serverless platform enabling developers to run AI models on GPUs across Cloudflare’s global network. The service offers 50+ open-source models, pay-per-use pricing, a…

Cloudflare launches Workflows for durable multi-step applications on Workers

Cloudflare introduced Workflows, a feature enabling durable, multi-step applications on its Cloudflare Workers platform. Workflows allow automatic retries, state persistence, and integration with exte…

Cloudflare retires CIDR-encoded route endpoints and connections field on October 5, 2026

Cloudflare will remove CIDR-encoded route endpoints and the connections field from Tunnel and Mesh APIs on October 5, 2026. Route management will shift to route_id-based endpoints, and connection deta…

Cloudflare Workflows adds dynamic delay functions for retries

Cloudflare Workflows now supports dynamic delay functions in step retries, allowing developers to adjust retry timing based on failure type and error context. Previously limited to fixed delays or bac…

Cloudflare Wrangler adds npm dependency metadata to Worker uploads

Wrangler now automatically collects npm package dependency details—name, version range, and installed version—during Worker deployments and uploads, embedding this metadata in API payloads for supply …

Cloudflare refreshes DNS Firewall UX with dashboard-first cluster settings

Cloudflare introduced a redesigned DNS Firewall page in its dashboard, moving previously API-only cluster settings like attack mitigation and rate limiting into the UI. The update includes a revamped …

Cloudflare blocks new key-value Durable Object namespaces, mandates SQLite

Cloudflare will no longer allow new key-value backed Durable Object namespaces for accounts without existing ones, requiring new namespaces to use the SQLite storage backend instead. The change enforc…

Cloudflare adds automatic provisioning for Flagship bindings in Wrangler

Cloudflare’s Wrangler CLI now automatically provisions Flagship apps during Worker deployments when a Flagship binding lacks an app_id. The tool either connects to an existing app or creates a new one…

Cloudflare Workers AI adds toMarkdown utility for document conversion

Cloudflare introduced the `toMarkdown` method in Workers AI, enabling developers to convert documents in multiple formats to Markdown via bindings or REST APIs. The feature supports structured input f…

Cloudflare launches moondream3.1-9B-A2B vision-language model on Workers AI

Cloudflare introduced moondream3.1-9B-A2B, a 9B mixture-of-experts vision-language model with 2B active parameters, optimized for visual reasoning tasks like object detection, pointing, OCR, and struc…

Cloudflare adds Images binding to Workers for in-line image optimization

Cloudflare introduced an Images binding for Workers that allows direct image optimization, resizing, and manipulation using raw image bytes from any source (Images, R2, fetch responses, or request bod…

Workers - Cloudflare Drop

Cloudflare introduced 'Drop,' a feature allowing users to deploy static sites (HTML, CSS, JS, images) without a Cloudflare account. Users upload a folder or zip file to receive a temporary live previe…

Cloudflare launches REST API for AI Search document management

Cloudflare introduced a new REST API enabling users to upload, list, retrieve, delete, and download documents within AI Search instances. The API requires an API token with specific permissions and op…

Cloudflare IPsec adds quantum downgrade protection in beta

Cloudflare IPsec now supports the IKE_SA_INIT_FULL_TRANSCRIPT_AUTH extension to prevent quantum downgrade attacks on IKEv2 tunnels. The feature is available in beta for Cloudflare WAN and Magic Transi…

Cloudflare and OpenAI launch research pilot to improve AI search with network signals

Cloudflare and OpenAI announced a research pilot combining Cloudflare’s global network insights with OpenAI’s search capabilities to enhance AI-driven content discovery and indexing. The initiative ai…

Cloudflare AI Search adds key-based item lookup

Cloudflare’s AI Search list items endpoint now supports a `key` query parameter to retrieve a single item by its exact object key, improving efficiency for developers. The feature complements existing…

Cloudflare adds GIF and BMP support to Workers AI toMarkdown and AI Search

Cloudflare expanded its Workers AI toMarkdown feature to support GIF and BMP image files, enabling automatic conversion to searchable text for AI Search indexing. The update processes images through t…

Cloudflare adds Moondream 3.1 vision language model to Workers AI

Cloudflare integrated Moondream 3.1, a 9B-parameter vision language model with 2B active parameters, into its Workers AI platform. The model delivers frontier-level visual reasoning with sub-second la…

Cloudflare adds in-dashboard R2 SQL query editor for Data Catalog

Cloudflare now lets users run R2 SQL queries against Apache Iceberg tables in the R2 Data Catalog directly from the Cloudflare dashboard, eliminating the need for local CLI tools. The built-in SQL edi…

Cloudflare launches Meerkat: a global consensus service for strongly consistent key-value stores

Cloudflare introduced Meerkat, an experimental global consensus service powered by the QuePaxa algorithm, designed to provide strong consistency and fault tolerance for control-plane state management.…

Cloudflare launches /accessibilityTree endpoint for Browser Run

Cloudflare introduced a new /accessibilityTree endpoint in its Browser Run service, enabling users to capture a webpage's accessibility tree after JavaScript execution. The endpoint returns structured…

Cloudflare proudly joins the UK government's Cyber Resilience Pledge

Cloudflare announced its participation in the UK government's voluntary Cyber Resilience Pledge, committing to board-level accountability, supply chain security, and foundational cybersecurity governa…

Cloudflare adds /accessibilityTree endpoint to Browser Run

Cloudflare introduced a new `/accessibilityTree` endpoint for Browser Run, enabling direct access to the semantic structure of rendered webpages via the browser's accessibility tree. This simplifies A…

Cloudflare adds WebSocket Analytics Logpush dataset for Enterprise customers

Cloudflare introduced a new WebSocket Analytics Logpush dataset for Enterprise customers, enabling per-connection telemetry including close reasons, sources, and session metadata. Logs are emitted on …

Cloudflare releases GA version of Windows Cloudflare One Client with SSO fix

Cloudflare launched the general availability (GA) version 2026.6.850.0 of its Windows Cloudflare One Client, addressing a Windows authentication issue in the embedded WebView2 browser. The fix enables…

Cloudflare adds Browser Isolation support for authorization proxy endpoints

Cloudflare expanded Browser Isolation to work with authorization proxy endpoints in Cloudflare One, enabling identity-based HTTP Isolate policies for PAC file-proxied traffic. Previously, only source …

Cloudflare Workflows adds per-step billing starting August 10, 2026

Cloudflare Workflows will introduce per-step billing alongside existing storage billing, effective no earlier than August 10, 2026. Paid plans include 500,000 steps per month and 1 GB-month of storage…

Cloudflare adds file transfer controls for browser-based RDP (beta)

Cloudflare introduced beta file transfer controls for its browser-based RDP service, allowing administrators to restrict uploads, downloads, or both between local machines and remote Windows servers. …

R2 - R2 Data Catalog warns before you delete data manually

Cloudflare’s R2 Data Catalog now warns users before manually deleting data in buckets where the catalog is enabled. The R2 dashboard and Wrangler CLI display alerts to prevent catalog corruption from …

Cloudflare launches Workers Cache for server-rendered apps

Cloudflare introduced Workers Cache, a regionally tiered cache that sits directly in front of Worker entrypoints, configured via standard HTTP headers. The feature eliminates redundant Worker invocati…

Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Self-serve registration of Cloudflare One Virtual Appliance in the dashboard

Cloudflare introduced self-serve registration for its Cloudflare One Virtual Appliance in the dashboard, allowing users to generate license keys without contacting their account team. This update comp…

Cloudflare Hyperdrive accelerates database access for Workers

Cloudflare introduced Hyperdrive to accelerate access to existing databases from Cloudflare Workers by reducing seven round-trips (TCP handshake, TLS negotiation, and authentication) and caching commo…

Cloudflare Hyperdrive accelerates database queries with edge pooling and caching

Cloudflare introduced Hyperdrive to reduce latency for database queries from Workers by performing edge connection setup, pooling connections near the database, and caching non-mutating read queries. …

Cloudflare shifts TypeScript support to Wrangler-generated types for Workers

Cloudflare now recommends generating TypeScript types for Workers via the `wrangler types` command instead of relying on the `@cloudflare/workers-types` package. The new approach dynamically generates…

Cloudflare Workers types v5 drops dated entrypoints, simplifies runtime types

Cloudflare released @cloudflare/workers-types v5, removing dated compatibility entrypoints and consolidating runtime types into two entrypoints: the latest stable and experimental APIs. Users must now…

Cloudflare AI Search expands data source options and supported file types

Cloudflare AI Search now supports three data source types: built-in storage, website domains, and Cloudflare R2 buckets. It also broadens file type support to include 20+ formats like PDFs, Office doc…

Cloudflare adds Wrangler auth profiles for multi-account management

Cloudflare’s Wrangler CLI now supports named auth profiles to switch between Cloudflare accounts per project without re-authenticating. Profiles are directory-scoped and can be activated via configura…

Cloudflare Cache Rules now support Vary response headers for multi-version caching

Cloudflare’s Cache Rules now honor the origin’s Vary response header, enabling the same URL to cache multiple versions differentiated by request headers like Accept-Language or Accept. Users can choos…

Cloudflare adds Wrangler CLI commands to manage AI Search sync jobs

Cloudflare introduced new Wrangler CLI commands to trigger, monitor, and manage sync jobs for AI Search instances connected to data sources. Users can now automate index refreshes via CI/CD pipelines …

Cloudflare Workers adds authentication profiles to Wrangler CLI

Cloudflare introduced authentication profiles in Wrangler, allowing developers to maintain separate OAuth logins and switch between Cloudflare accounts per directory without re-authenticating. Profile…

Cloudflare updates Logpush datasets with new fields for Gateway DNS, HTTP, and HTTP requests

Cloudflare updated multiple Logpush datasets by adding new fields: `AppliedMaxTTL` and `UpstreamRecordTTLs` for Gateway DNS, `Warnings` for Gateway HTTP, and `CacheLockWaitedMs` for HTTP requests. The…

Cloudflare adds hostname routing to Cloudflare Mesh

Cloudflare introduced hostname routing for its Cloudflare Mesh nodes, allowing traffic to be routed by hostname (e.g., wiki.internal.local) instead of IP addresses. This simplifies internal applicatio…

Cloudflare adds infrastructure application support for granular server access control

Cloudflare expanded its Zero Trust platform with infrastructure application support, enabling granular control over server, cluster, or database access via SSH. Users can now configure authentication,…

Cloudflare Containers now supports Docker Hub, Amazon ECR, and Google Artifact Registry images

Cloudflare’s Containers platform now allows developers to push custom images during deployment or use pre-built images from Cloudflare’s registry, Docker Hub, Amazon ECR, and Google Artifact Registry.…

Cloudflare One Client - Cloudflare One Client for Linux (version 2026.6.836.0)

Cloudflare launched GA version 2026.6.836.0 of its Linux Cloudflare One Client, addressing a dependency issue in RPM-based distributions where incorrect builds were served. The fix ensures correct pac…

Cloudflare expands Zero Trust Lists with CSV upload and Terraform support

Cloudflare introduced reusable lists in Zero Trust to centralize management of URLs, hostnames, IP addresses, and other entries for Gateway and Access policies. Users can now upload lists via CSV or c…

Cloudflare enhances Bot Management with AI bot blocking and ML auto-updates

Cloudflare updated its Bot Management Enterprise feature to include AI bot blocking, auto-updates for machine learning models, and granular bot scoring (1-99) with customizable rules. Customers can no…

Announcing the Monetization Gateway: charge for any resource behind Cloudflare via x402

Cloudflare introduced the Monetization Gateway, enabling customers to charge for any resource behind Cloudflare (web pages, APIs, datasets, MCP tools) using the open x402 protocol. Payments settle in …

Making AI search smarter

Cloudflare introduced a research program to make AI search smarter by using network signals to surface fresher, higher-quality content and reduce unnecessary crawling. It also unveiled a Pay Per Use m…

Your site, your rules: new AI traffic options for all customers

Cloudflare introduced a refined AI bot classification system (Search, Agent, Training) and new default blocking rules for ad pages starting September 15, 2026. All customers now have granular controls…

Content Independence Day, one year on: building the business model for the agentic Internet

Cloudflare declared 'Content Independence Day' a year ago, blocking AI training crawlers by default for new domains to restore transparency and control for publishers. Now, they report that over 50% o…

Unmasking the crawls with Attribution Business Insights

Cloudflare introduced Attribution Business Insights, a new dashboard for its Bot Management customers to analyze AI bot traffic and its impact on website economics. The tool provides crawl-to-referral…

Cloudflare introduces granular AI traffic controls for Search, Agent, and Training bots

Cloudflare now lets all customers, including Free plan users, manage AI crawlers by behavior—Search, Agent, and Training—rather than a single toggle. Starting September 15, 2026, new domains will defa…

Cloudflare adds hardware-backed MFA for SSH via YubiKey PIV keys

Cloudflare’s Access for Infrastructure now supports independent MFA for SSH using YubiKey PIV keys, adding hardware-backed second-factor authentication. Admins can enforce PIV key requirements per app…

Cloudflare fixes URL fragment encoding in Access for SPAs

Cloudflare resolved an issue where Access over-encoded URL fragment characters during post-login redirects, breaking SPA navigation. The fix preserves characters like /, ?, =, &, and ; in fragment-bas…

Vectorize - Reduced end-to-end latency for vector changes

Cloudflare reduced end-to-end latency for vector changes in Vectorize by improving WAL throughput, cutting median latency from 2 minutes to under 30 seconds and p99 latency from 5 minutes to under 2 m…

Cloudflare WAF release adds CVE-2026-39813 coverage and disables fake bot rule

Cloudflare’s July 1, 2026 WAF release introduces a new rule blocking path traversal attacks targeting Fortinet FortiSandbox (CVE-2026-39813) and disables the Anomaly:Header:User-Agent - Fake Bing or M…

Cloudflare launches tools to shape the agentic internet with content control and monetization

Cloudflare introduced new classifications, enhanced analytics, and commercial partnerships to help site owners and AI companies collaborate in the agentic internet. Default settings will block AI trai…

Cloudflare adds BotBase and Attribution Business Insights to Enterprise Bot Management

Cloudflare introduced BotBase, a searchable directory of all tracked bots with behavioral classifications, and Attribution Business Insights, a dashboard showing crawl-to-referral ratios for AI traffi…

Cloudflare Images binding switches to unique-transformation billing

Cloudflare’s Images binding now bills per unique transformation, counting repeat requests for the same image and parameters only once per month. Calls to .info() are now free, aligning with URL-based …

Cloudflare Containers now support Google Artifact Registry images

Cloudflare Containers now allow direct use of private Google Artifact Registry images without pushing to Cloudflare Registry first. Users configure credentials via service account email and JSON key, …