What Cloudflare shipped in August 2026

Introducing Adaptive Intelligence: undermining the economics of every bot attack

Cloudflare introduced Adaptive Intelligence, a new bot detection engine that flips the economic model of bot attacks by making bypass attempts increasingly costly and unpredictable. Unlike traditional…

Cloudflare Load Balancing adds pool sets for location-specific traffic steering

Cloudflare introduced pool sets in Load Balancing, enabling location-specific traffic routing with geographic matching, custom steering policies, and fallback behavior. Each pool set can target data c…

Cloudflare launches Adaptive Intelligence to counter automated cyberattacks

Cloudflare introduced Adaptive Intelligence, a real-time detection engine for its Bot Management product that autonomously rewrites defenses to block automated attacks. The system analyzes trillions o…

Cloudflare launches /crawl endpoint for Browser Run API

Cloudflare introduced a new /crawl endpoint in its Browser Run API that scrapes and follows links across websites up to a configurable depth, returning results in HTML, Markdown, or JSON. The endpoint…

Cloudflare /crawl endpoint adds contentUse parameter for Content Signals

Cloudflare’s /crawl endpoint now enforces the `use` directive from Content Signals via a new `contentUse` parameter, allowing site owners to restrict content usage to `reference` or `full` levels. Req…

Cloudflare AI Search adds GLM-5.3 Flash model with 1M-token context

Cloudflare’s AI Search now supports the GLM-5.3 Flash model for text generation, featuring a 1,048,576-token context window and deployment on Workers AI. Users can configure the model for AI Search in…

Cloudflare launches GLM-5.3 AI model with 1M-token context window

Cloudflare introduced GLM-5.3, Z.ai’s agentic coding model, on its Workers AI platform with a 1M-token context window, function calling, and structured outputs. The model is available via Workers Paid…

BotBase for Operators: A clearer path to joining Cloudflare's directory of bots and agents

Cloudflare introduced BotBase for Operators, a new dashboard feature giving bot operators visibility into submission statuses, rejection reasons, and the ability to update or cancel submissions. The u…

Cloudflare launches GA Linux client for Cloudflare One

Cloudflare announced the general availability of Cloudflare One Client for Linux (version 2026.7.1377.0), resolving DNS query failures affecting a small percentage of users across platforms. The updat…

Cloudflare improves Log Explorer dataset configuration with grouped fields and ingestion filters

Cloudflare updated Log Explorer with a refreshed dataset configuration experience in the dashboard, introducing grouped field selection, field details, bulk controls, and ingestion filters. These chan…

Cloudflare API Shield adds JWT validation at the edge

Cloudflare API Shield now supports cryptographic JWT validation at the edge, verifying token integrity before requests reach origin servers. The feature detects expired, tampered, or invalid tokens an…

Cloudflare releases GA macOS Cloudflare One Client v2026.7.1376.0

Cloudflare launched the general availability version 2026.7.1376.0 of its macOS Cloudflare One Client on August 28, 2026. The release fixes a DNS query failure issue affecting a small but noticeable p…

Cloudflare adds Z.ai GLM-5.3 to Workers AI with 1M token context window

Cloudflare launched Z.ai's GLM-5.3 on Workers AI, a flagship agentic coding model with a 1M token context window, reasoning, and function calling. The model delivers up to 6x performance gains on benc…

Cloudflare increases Durable Objects Dynamic Workers concurrency limit to ten

Cloudflare raised the concurrency limit for Dynamic Workers within Durable Objects from four to ten per Durable Object, while other Workers remain capped at four. The change applies across all concurr…

Cloudflare releases GA Windows Cloudflare One Client v2026.7.1376.0

Cloudflare launched the general availability version 2026.7.1376.0 of its Windows Cloudflare One Client, fixing critical connectivity and DNS query failures. The update is available on the stable rele…

[email protected]

Patch Changes #15367 412c79e Thanks @dependabot ! - Update dependencies of "miniflare", "wrangler" The following dependency versions have been updated: Dependency From To @cloudflare/workers-types ^5.…

@cloudflare/[email protected]

Patch Changes #15375 92874f6 Thanks @WillTaylorDev ! - Upload wrangler preview modules as multipart form data wrangler preview used to base64 the bundle, its modules, and any sourcemaps into a single …

@cloudflare/[email protected]

Patch Changes Updated dependencies [ 412c79e , 92874f6 , fe265f8 ]: [email protected] [email protected]

@cloudflare/[email protected]

Patch Changes Updated dependencies [ 412c79e , 92874f6 ]: [email protected] @cloudflare/[email protected]

@cloudflare/[email protected]

Patch Changes Updated dependencies [ 412c79e ]: [email protected]

@cloudflare/[email protected]

Patch Changes Updated dependencies [ 412c79e ]: [email protected]

@cloudflare/[email protected]

Patch Changes Updated dependencies [ 412c79e , 92874f6 , fe265f8 ]: [email protected] [email protected]

@cloudflare/[email protected]

Minor Changes #15371 e9df120 Thanks @jamesopstad ! - Support multiple named Workers in the experimental Build Output utilities Build Output paths and config writing can now target any named Worker dir…

Cloudflare raises Durable Object concurrency limit to 10

Cloudflare increased the concurrent Dynamic Workers limit for Durable Objects from 4 to 10, while keeping the base Worker request limit at 4. The change allows Durable Objects to handle more simultane…

Cloudflare updates service tokens with new secret format and single-header auth

Cloudflare revised its service tokens feature in Cloudflare One Access controls, introducing a new Client Secret format (cfast_ prefix with checksum) for easier credential scanning and enabling single…

Cloudflare launches glm-5.3-flash, a natively multimodal AI model on Workers AI

Cloudflare introduced glm-5.3-flash, the first natively multimodal model in its GLM-5 series, with 320B total parameters and 18B active parameters. It outperforms GLM-5.2 while costing one-tenth the p…

Cloudflare Access service token secrets adopt scannable format with prefix and checksum

Cloudflare Access now issues service token secrets with a scannable format starting August 26, 2026, using the prefix 'cfast_' followed by 40 alphanumeric characters and an 8-character checksum. This …

Cloudflare enables permanent Log Explorer dataset deletion

Cloudflare Log Explorer now allows customers to permanently delete account and zone datasets via dashboard or API, with deletion protection enabled by default to prevent accidental loss. Deletion is i…

Cloudflare launches GLM-5.3 Flash on Workers AI with multimodal support

Cloudflare introduced GLM-5.3 Flash on Workers AI, a 320B MoE model with vision, reasoning, and function calling. It is the first multimodal model in the GLM-5 series, outperforming GLM-5.2 at lower c…

Cloudflare AI Search adds support for 20+ new models across text, embedding, and reranking

Cloudflare’s AI Search now supports over 20 new production models, including Anthropic’s Claude 3.7 Sonnet, Google’s Gemini 2.5 Flash/Pro, OpenAI’s GPT-5 series, and Groq’s Llama 3.3. The update also …

Cloudflare adds app-scoped API tokens for Flagship apps

Cloudflare introduced app-scoped API tokens for Flagship, allowing users to restrict token access to specific apps rather than the entire account. Tokens can be configured with Evaluate, Read, or Writ…

Cloudflare adds six new Workers AI text generation models to AI Search

Cloudflare introduced six new Workers AI text generation models in AI Search, including DeepSeek, OpenAI, Qwen, and MoonshotAI variants, with context windows ranging from 128K to 1M tokens. These mode…

Cloudflare issues emergency WAF update for Next.js RCE vulnerabilities

Cloudflare deployed an emergency WAF ruleset update on August 26, 2026, to block two critical remote code execution vulnerabilities in Next.js applications: CVE-2026-75604 and GHSA-2xp9-vwfh-vxw4. The…

Cloudflare Radar Researcher gains richer sources and AI-powered URL Scanner explanations

Cloudflare’s Radar Researcher beta now links responses to Radar pages, reports, and Cloudflare Blog posts, and can explain URL Scanner findings via AI. Shared sessions also open in fullscreen while re…

Cloudflare to deprecate Azure Functions-based Microsoft Sentinel connector by September 14, 2026

Cloudflare will discontinue its Azure Functions-based Microsoft Sentinel connector on September 14, 2026, due to Microsoft's deprecation of the Azure Monitor HTTP Data Collector API. Enterprise custom…

Get ASPA objects snapshot

Cloudflare introduced a new API method to retrieve current or historical ASPA (Autonomous System Provider Authorization) objects, which define authorized upstream providers for a customer ASN. The end…

Cloudflare WAF release moves four detections to Block mode and adds RCE rule

Cloudflare’s August 25, 2026 WAF release moves four new detections from Log to Block mode, merges a beta XSS rule into its original, and adds a Generic Rules Remote Code Execution detection in Block m…

Cloudflare AI Search now supports larger custom metadata values

Cloudflare’s AI Search now allows larger custom metadata values within a shared 10 KiB envelope per vector, replacing a previous smaller limit. The first 64 UTF-8 bytes of each indexed string remain f…

Cloudflare adds temporary disable for Access service tokens

Cloudflare Access now lets administrators temporarily disable service tokens without deleting them, preventing authentication while preserving configuration for later re-enablement. This feature helps…

Cloudflare adds symmetric key support for JWT validation in API Shield

Cloudflare’s API Shield now supports symmetric key validation for JWTs using HS256, HS384, and HS512 algorithms. Users can configure HMAC verification keys via the dashboard or API without exposing cr…

Cloudflare MCP server portals add support for MCP 2026-07-28 specification

Cloudflare’s MCP server portals now support the stateless MCP 2026-07-28 specification while maintaining backward compatibility with 2025 clients and servers. The update enables independent protocol u…

Cloudflare adds grace periods for service token rotation

Cloudflare Access now allows administrators to set grace periods (1 hour to 30 days) when rotating service token secrets, keeping both old and new secrets valid during the transition. The feature supp…

The Cloudflare Blog – Brought to you by EmDash

Cloudflare moved its blog to EmDash, a CMS designed for Astro and Cloudflare, improving performance, scalability, and frontend consistency. The migration included dark mode, caching layers, and MCP se…

Cloudflare Radar adds RPKI ASPA path validation tool

Cloudflare Radar launched a new tool that validates any BGP AS path against RPKI ASPA records, returning a verdict of Valid, Invalid, or Unknown. The tool follows draft IETF verification algorithms, p…

Cloudflare WAN expands with BGP peering and Zero Trust integration

Cloudflare updated its Cloudflare WAN (formerly Magic WAN) documentation to highlight enterprise networking capabilities, including BGP peering (beta) for dynamic route management and tighter integrat…

Microsoft Sentinel updates Codeless Connector Framework with improved authentication and DCR support

Microsoft Sentinel introduced an updated version of its Codeless Connector Framework (CCF) with key improvements over the 2022 release, including better authentication and pagination support, standard…

Cloudflare enables self-serve download of Cloudflare One Virtual Appliance by hypervisor

Cloudflare added a self-serve option to download its Cloudflare One Virtual Appliance directly from the dashboard by selecting a hypervisor (VMware ESXi, Proxmox, or libvirt/KVM). Users can now retrie…

Cloudflare adds Test scan feature to DLP for Zero Trust Enterprise

Cloudflare introduced a Test scan feature for its Data Loss Prevention (DLP) tool, allowing users to evaluate sample content against DLP profiles without routing traffic through Gateway. Available as …

Cloudflare adds optional OAuth scope selection for Wrangler and API MCP server

Cloudflare’s Wrangler CLI and Cloudflare API MCP server now let users selectively grant optional OAuth scopes during authorization instead of approving all requested scopes. Required scopes remain man…

Say it once: introducing Bot Preference SynC

Cloudflare introduced Bot Preference Sync, a feature that automatically updates robots.txt to reflect AI bot preferences (Search, Agent, Training) set in the Cloudflare dashboard. This eliminates disc…

Cloudflare Web Analytics improves soft navigation measurement for SPAs

Cloudflare Web Analytics now uses the native Soft Navigation API to more accurately measure pageviews and Core Web Vitals for Single Page Applications, potentially increasing reported pageview counts.…

Cloudflare launches automated CASB remediation policies for Microsoft 365 and Google Workspace

Cloudflare introduced automated remediation policies in its Cloudflare One CASB offering, enabling customers to automatically fix security findings or send webhooks without manual intervention. Polici…

Cloudflare enables mounting R2 buckets as filesystems via FUSE in Containers

Cloudflare added support to mount R2 object storage buckets as filesystems using FUSE within its Containers environment. Applications can now interact with R2 via standard filesystem operations instea…

Cloudflare API 403 responses now include documentation URLs

Cloudflare API 403 errors now return a documentation_url field linking directly to the denied endpoint’s docs, including required roles. This change affects nearly all Cloudflare product APIs and aims…

Cloudflare adds DLP test scan for profile validation without Gateway traffic

Cloudflare introduced a test scan feature for Data Loss Prevention (DLP) profiles, allowing users to evaluate sample text, files, or HAR data against DLP rules before applying them to live traffic. Th…

Cloudflare adds API-based CASB remediation policies for SaaS misconfigurations

Cloudflare launched CASB remediation policies in Cloudflare One that automatically fix Microsoft 365 and Google Workspace file-sharing misconfigurations via API without manual intervention. Policies c…

Cloudflare adds saved login profiles for faster Dashboard access

Cloudflare Dashboard users can now save up to five login profiles per device, storing email, login method, and last-used profile locally. Returning users see prefilled login options, accelerating sign…

Cloudflare adds HTTP PUT group replacement for SCIM 2.0 synchronization

Cloudflare’s dashboard SCIM now supports replacing groups via HTTP PUT for full-state synchronization, aligning with RFC 7644 section 3.5.1. This enables identity providers to update group display nam…

Cloudflare adds optional OAuth scopes for granular consent

Cloudflare introduced optional OAuth scopes, allowing users to deselect non-essential permissions during authorization. Developers can now mark scopes as required or optional, enabling more granular c…

Picsart scales global AI creative platform with Cloudflare’s security and edge services

Picsart, an AI-powered creative platform, adopted Cloudflare’s connectivity cloud to mitigate DDoS, injection attacks, and bot traffic while improving performance. Cloudflare blocks 3B malicious reque…

Cloudflare migrates Workers testing from Vitest Pool Workers to Vitest Plugin

Cloudflare is replacing its @cloudflare/vitest-pool-workers package with @cloudflare/vitest-plugin, effective immediately. The new plugin maintains the same API and Vitest configuration, but requires …

Cloudflare adds Vitest integration for mocking outbound requests in Workers

Cloudflare updated its Workers testing documentation to introduce support for mocking outbound HTTP and WebSocket requests using the @msw/cloudflare Vitest plugin. The feature enables unit and integra…

Cloudflare expands leaked credentials detection to Authorization headers

Cloudflare’s leaked credentials detection now scans the Authorization header for Basic Authentication credentials, previously excluded from default checks. The change automatically applies to zones wi…

Cloudflare launches optional OAuth scopes for granular access control

Cloudflare introduced General Availability of optional OAuth scopes, letting developers mark scopes as required or optional in the dashboard. Users must approve required scopes but can decline optiona…

Cloudflare increases Browser Run limits for Workers Paid plans

Cloudflare raised default limits for its Browser Run headless browser automation service on Workers Paid plans, allowing 200 concurrent browsers (up from 120), 3 new instances per second (up from 1), …

Cloudflare launches Vitest integration for Workers testing

Cloudflare introduced a Vitest integration for testing Cloudflare Workers and Pages Functions projects, enabling unit and integration tests to run directly within the Workers runtime. The `@cloudflare…

Cloudflare adds SPA support to Web Analytics with three tracking methods

Cloudflare Web Analytics now supports automatic tracking for Single Page Applications (SPAs) using three methods: Soft Navigations API, Navigation API, or History API patching. Users can disable SPA m…

Cloudflare adds Deployments tab for Durable Objects in dashboard

Cloudflare introduced a Deployments tab for Durable Object namespaces in its dashboard, displaying active Worker versions, traffic splits (actual vs. configured), and per-version metrics like requests…

Cloudflare enables FUSE in local Containers development

Cloudflare’s Miniflare now automatically grants local Containers the Docker privileges required for Filesystem in Userspace (FUSE) during local development. This applies to `wrangler dev`, the Cloudfl…

Cloudflare integrates OpenAI's GPT-5.6 Sol model for AI workloads

Cloudflare added OpenAI's frontier GPT-5.6 Sol model to its AI platform, enabling developers to run the model via Cloudflare's Responses API with a 1M-token context window. The integration is availabl…

Pricing change detected for Cloudflare

Pricing updated for Cloudflare: - Free: allowance changed from 1 website to forever

Cloudflare One Client for Linux reaches GA with stability and connectivity improvements

Cloudflare announced the general availability of its Linux Cloudflare One Client (version 2026.7.1343.0), bringing beta features to stable release. Key changes include clearer reauthentication flows, …

Cloudflare One Client stable release 2026.7.1343.0 brings authentication, DNS, and MDM improvements

Cloudflare released stable version 2026.7.1343.0 of its Cloudflare One Client for Windows, introducing clearer reauthentication notifications, adaptive HTTP/3 fallback, and multiple bug fixes. The upd…

Cloudflare offers 50% off GPT-5.6 Sol via AI Gateway until September 18, 2026

Cloudflare is offering a 50% discount on OpenAI’s GPT-5.6 Sol model when routed through its AI Gateway with Unified Billing, valid until September 18, 2026. Input tokens drop from $5 to $2.50 per 1M, …

Cloudflare renames Workers Vitest integration to @cloudflare/vitest-plugin

Cloudflare released version 1 of its Workers Vitest integration under a new package name, @cloudflare/vitest-plugin, replacing the former @cloudflare/vitest-pool-workers. The API remains unchanged, bu…

Cloudflare One Client for macOS reaches GA with HTTP/3 fallback and reauthentication improvements

Cloudflare released the general availability version 2026.7.1343.0 of its macOS Cloudflare One Client, transitioning features from beta to stable. Key additions include smarter reauthentication via br…

Cloudflare One Client for Windows reaches GA with HTTP/3 fallback and reauthentication improvements

Cloudflare released the general availability version 2026.7.1343.0 of its Windows Cloudflare One Client, transitioning beta features to stable. Key changes include clearer reauthentication notificatio…

Cloudflare Access now supports resource-scoped role-based resource listing

Cloudflare Access now allows members with resource-scoped roles to list only the applications, policies, service tokens, and identity providers they can manage in both the dashboard and API. Previousl…

Pricing updated for Cloudflare: - Free: now includes 1 website - Pro: now includes 1 website

Pricing updated for Cloudflare: - New tier: Contract (Custom pricing) - New tier: Pay-as-you-go ($7/mo per user) - Removed: En

Cloudflare launches Qwen 3.8 27B model on Workers AI

Cloudflare added Qwen 3.8 27B, a 27-billion-parameter instruction-tuned language model from Alibaba's Qwen family, to its Workers AI platform. The model supports vision, general-purpose text generatio…

Cloudflare adds origin settings configuration to Tunnel dashboard

Cloudflare now lets users configure origin parameters like TLS verification, HTTP Host headers, and connection timeouts directly in the dashboard for Cloudflare Tunnel applications. Previously, these …

Pricing updated for Cloudflare: - Free: allowance changed from forever to 100k requests/day - Pro: now includes 100k requests/

Cloudflare R2 adds US data residency with `us` jurisdiction

Cloudflare introduced a new `us` jurisdiction for R2, ensuring all bucket data storage and processing occurs within the United States. The feature uses a dedicated endpoint and Workers binding configu…

Workers AI - Qwen 3.8 27B now available on Workers AI

Cloudflare introduced Qwen 3.8 27B, a 27-billion-parameter vision-language model from Alibaba's Qwen family, on its Workers AI platform. The model supports multimodal input (images + text) and include…

Cloudflare updates WAF rulesets for WordPress CVE-2026-65640

Cloudflare released an update to its Managed Ruleset and Free Ruleset to address CVE-2026-65640, a remote code execution vulnerability in WordPress. The changes refine rule metadata for detecting the …

Cloudflare load balancing analytics now filters by pool name

Cloudflare updated its load balancing analytics to filter traffic data by pool name instead of pool ID, aligning the query behavior with the UI dropdown. This change resolves confusion caused by misma…

Cloudflare adds post-quantum key exchange to Email Security MX deployments

Cloudflare Email Security now supports post-quantum hybrid key exchange (X25519MLKEM768) on inbound and outbound SMTP connections, protecting against harvest-now, decrypt-later attacks. The feature is…

Cloudflare Gateway adds package registry security, MCP detection, and hostname routing GA

Cloudflare Gateway introduced package registry security to detect and control software package downloads across ecosystems like npm, PyPI, and Maven, enabling HTTP policies with pkg.* selectors. It al…

Cloudflare Email Security adds post-quantum key exchange, content blocking, and DANE support

Cloudflare Email Security introduced multiple upgrades: post-quantum hybrid key exchange (X25519MLKEM768) for SMTP connections, content-based blocking rules for targeted phishing campaigns, and DANE s…

Cloudflare adds DeepSeek v4 Pro 0813 to Workers AI

Cloudflare introduced the DeepSeek v4 Pro 0813 model to its Workers AI platform, offering a 1M-token context window, function calling, reasoning, and vision capabilities. The model is available via Cl…

Cloudflare launches DeepSeek-V4-Flash-0731 with enhanced agentic capabilities on Workers AI

Cloudflare officially released DeepSeek-V4-Flash-0731 on its Workers AI platform, replacing the preview version with significantly improved agentic capabilities. The model supports function calling, r…

Cloudflare adds MCP traffic detection and control to Cloudflare One

Cloudflare announced new capabilities in Cloudflare One to identify, monitor, and control Model Context Protocol (MCP) traffic, addressing risks posed by AI agents making rapid, nondeterministic decis…

Secure all your internal vibe-coded applications — in one click

Cloudflare launched new tools to apply Access authentication directly to Workers, ensuring all applications are private by default. Policies can now be attached to individual Workers or account-wide, …

Pricing updated for Cloudflare: - Free: now includes forever

Cloudflare Gateway adds package registry security for seven ecosystems

Cloudflare Gateway now detects and controls software package downloads across seven major ecosystems (npm, PyPI, RubyGems, Cargo, Go, Maven, NuGet) via HTTP policies. Admins can block or allow package…

Cloudflare enables dashboard SSO for custom email domains across all plans

Cloudflare introduced SSO for the Cloudflare dashboard, allowing organizations to enforce authenticated access via their identity provider for any custom email domain. The feature is available at no a…

Cloudflare fixes WebSocket data transfer reporting in analytics

Cloudflare restored accurate WebSocket data transfer reporting in HTTP Traffic Analytics and HTTP request logs, now counting full connection data instead of just the initial handshake. The fix correct…

Cloudflare enables granular access control for Workers via Cloudflare Access

Cloudflare introduced Cloudflare Access for Workers, allowing account-level or per-Worker sign-in requirements for preview and production deployments. Users can protect all Workers, a single Worker, o…

Cloudflare enables Access policies for Workers at account and per-Worker levels

Cloudflare introduced two new ways to apply Cloudflare Access policies to Workers: one policy per Worker (covering all domains) and a default policy for all Workers in an account. This simplifies secu…

Cloudflare launches DeepSeek V4 Flash and Pro on Workers AI with 1M token context

Cloudflare added DeepSeek V4 Flash and Pro to Workers AI, the first models on the platform with a 1,048,576 token context window. Both support reasoning, function calling, and agentic workflows, with …

Pricing updated for Cloudflare: - Plan features or structure changed

Cloudflare Certificate Transparency Monitoring GA: filters Cloudflare-issued certificates

Cloudflare’s Certificate Transparency Monitoring is now generally available with a key change: it no longer emails users about certificates Cloudflare issued for their domains. This eliminates noise f…

Cloudflare Artifacts adds data localization with EU and US jurisdiction support

Cloudflare’s Artifacts now lets users select either the EU or US as the sole jurisdiction for storing and processing repository data, enforced at the namespace level. Jurisdictions are set at creation…

Cloudflare Certificate Transparency Monitoring reaches GA with noise reduction

Cloudflare announced the general availability of Certificate Transparency Monitoring, now filtering out alerts for Cloudflare-issued certificates to reduce noise. Alerts are clearer with structured de…

Cloudflare Gateway now detects and controls software package downloads across seven ecosystems (npm, PyPI, RubyGems, Cargo, Go, Maven, NuGet) using pkg.* selectors in HTTP policies. Detection works vi

Cloudflare Artifacts adds EU and US data localization controls

Cloudflare’s Artifacts now supports restricting repo data storage and processing to either the EU or US jurisdictions. Admins can set a jurisdiction when creating a namespace, with EU and US as the su…

Cloudflare Realtime SFU adds configurable DataChannel reliability and subscriber controls

Cloudflare expanded its Realtime SFU DataChannels feature with new reliability controls and subscriber-specific options. Publishers can now configure unordered delivery, partial reliability, and ackno…

Cloudflare Realtime SFU adds unordered and partially reliable DataChannel delivery

Cloudflare’s Realtime SFU now supports unordered and partially reliable delivery for DataChannels, allowing developers to configure latency-sensitive WebRTC message forwarding. Existing channels remai…

Cloudflare adds Certificate Transparency Monitoring for SSL/TLS certificates

Cloudflare introduced Certificate Transparency (CT) Monitoring, an opt-in feature that alerts users when new SSL/TLS certificates are issued for their domains via public CT logs. The service filters o…

Cloudflare adds Oracle Cloud Infrastructure Object Storage to Cloud Connector

Cloudflare’s Cloud Connector now supports public Oracle Cloud Infrastructure (OCI) Object Storage buckets, enabling direct routing via S3-compatible endpoints without separate origin configurations. B…

Cloudflare adds FIDO2 hardware key support for SSH infrastructure apps

Cloudflare now enforces FIDO2 hardware key authentication for SSH connections to infrastructure applications via its independent MFA system. Users can enroll `ssh_fido2_key` or `piv_key` at the applic…

Cloudflare adds Traffic Source selector to Gateway policies

Cloudflare introduced a Traffic Source selector in Gateway HTTP and Network policies, enabling administrators to write rules based on how traffic reaches Cloudflare, such as via WARP, MCP portals, or …

Cloudflare adds blocked content rules for email filtering

Cloudflare Email Security now allows administrators to create custom content-based blocking rules using plaintext strings or regular expressions to scan email subjects, bodies, or both. Matching messa…

Cloudflare adds MCP protocol detection and AI Security dashboard to Gateway

Cloudflare Gateway now detects Model Context Protocol (MCP) traffic via a new 'Is MCP' selector in HTTP policies, enabling rules to allow, block, or isolate MCP requests. A new AI Security dashboard p…

Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave

Cloudflare’s H1 2026 DDoS Threat Report reveals a 6x surge in hyper-volumetric attacks (805 over 1 Tbps in Q2) and a 580% quarterly spike in CLDAP amplification attacks. DNS floods accounted for 34.3%…

Cloudflare Q3 2026: $2.175B 0% convertible notes offering due 2031

Cloudflare priced a $2.175 billion private offering of 0% convertible senior notes due 2031, with net proceeds of ~$2.14 billion after expenses. The notes are convertible into Class A common stock at …

Cloudflare launches GA hostname routing with new public IP range for initial resolved IPs

Cloudflare announced general availability of hostname routing for Cloudflare Tunnel and Mesh, replacing static IP management with hostname-based traffic routing. To comply with Chromium’s Local Networ…

Cloudflare Pages skips superseded queued builds

Cloudflare Pages now automatically skips queued builds when a newer build for the same project, branch, and deployment target is also queued. This change reduces redundant deployments and optimizes bu…

Cloudflare adds Host selectors to Gateway egress policies

Cloudflare introduced Host selectors for Gateway egress policies, enabling hostname-based traffic routing at Layer 4 by resolving hostnames to temporary IPs before applying egress rules. The feature r…

Cloudflare Status page gets new design, independent notifications, and Markdown for AI agents

Cloudflare launched a redesigned Status page with a standalone notification system that works even when Cloudflare infrastructure is down, plus Markdown output for AI agents and separate RSS/Atom feed…

Cloudflare WAF release adds vBulletin CVE-2026-61511 protection and strengthens detections

Cloudflare’s August 11, 2026 WAF release introduces a new detection to block remote code execution in vBulletin (CVE-2026-61511) and improves two existing rules by changing their default actions from …

Cloudflare secures FedRAMP High and GovRAMP Moderate certifications for government use

Cloudflare achieved FedRAMP High and GovRAMP Moderate certifications, enabling U.S. government agencies to process High Impact data securely. The company also announced intent to pursue DoD Impact Lev…

Cloudflare One adds private hostname routing for Zero Trust networks

Cloudflare updated its Cloudflare One documentation to introduce private hostname routing, enabling users to connect to private HTTP and non-HTTP applications using hostnames instead of static IPs. Th…

Cloudflare enables source IP anchoring via Cloudflare Tunnel for egress policies

Cloudflare introduced a new capability to route outbound traffic through Cloudflare Tunnel to preserve existing egress IPs (e.g., AWS IPs) for services requiring specific IP allowlists. This feature, …

Serving the most critical missions: Cloudflare for Government achieves FedRAMP Class D (High) Certified status

Cloudflare announced FedRAMP Class D (High) certification for its government services, a rigorous security standard for handling sensitive U.S. government data. This certification validates Cloudflare…

Cloudflare One Client for Windows reaches GA with version 2026.6.905.0

Cloudflare released the general availability version 2026.6.905.0 of its Cloudflare One Client for Windows, addressing a rare but critical reconnection issue after sleep mode. The update is available …

Cloudflare proposes $2.175B convertible note offering due 2031

Cloudflare announced a proposed private offering of $2.175 billion in convertible senior notes due 2031, with an optional $325 million upsize. The notes are senior, unsecured, and convertible into cas…

Turnstile - Turnstile Spin is now generally available

Cloudflare announced the general availability of Turnstile Spin, offering three distinct setup methods—dashboard, Wrangler, or AI coding agent—to create Turnstile widgets and integrate server-side sit…

Cloudflare adds live log streaming to Tunnel dashboard

Cloudflare introduced real-time log streaming in the Tunnel detail view of its dashboard, enabling aggregated multi-connector log aggregation and filtering by level, event type, and HTTP method. Previ…

Cloudflare launches Agentic Internet platform with @cloudflare/computer, Wallets, and MCPv2

Cloudflare unveiled a suite of agent-focused tools during Agents Week, including @cloudflare/computer (a new runtime for agents), Cloudflare Wallets (programmable wallets for agent transactions), and …

Cloudflare launches Radar Researcher: AI tool for exploring Internet data in plain language

Cloudflare introduced Radar Researcher, an AI-powered tool that allows users to query global Internet traffic and trend data using plain language, generating interactive charts and explanations. Built…

Cloudflare refreshes community programs with Ambassadors, Engineers, and $1M in open-source funding

Cloudflare launched updated community programs featuring Cloudflare Ambassadors and Community Engineers, backed by an additional $1M in open-source funding. Ambassadors will organize local events and …

Cloudflare shifts bot mitigation to continuous Trust evaluation with BotBase and Precursor updates

Cloudflare is moving from point-in-time risk assessments to continuous trust evaluation for bot and agent traffic, introducing behavioral analysis via BotBase and Precursor. The update includes a taxo…

Cloudflare launches container image for Mesh nodes

Cloudflare introduced a Docker container image for its Cloudflare Mesh nodes, enabling deployment via Docker Compose, Kubernetes, and CI/CD pipelines without host-level installations. The image suppor…

Cloudflare unifies Workers AI and AI Gateway with shared billing and observability

Cloudflare integrated Workers AI and AI Gateway to provide a single API, observability, and prepaid billing for both Cloudflare-hosted and third-party AI models. Unified billing via AI Gateway credits…

Cloudflare Workers AI updates rate limits with GA status

Cloudflare updated Workers AI rate limits to reflect its General Availability status, introducing per-task and per-model limits. Text generation has the strictest cap at 300 requests per minute, while…

Cloudflare Radar adds AS-level connectivity and upstream provider tracking

Cloudflare Radar introduced two new widgets for AS pages: an AS-level connectivity graph showing how networks reach Tier-1 providers and a timeseries chart tracking the share of routes carried by each…

Cloudflare Sandbox SDK 1.0 preview API reference released

Cloudflare published API reference documentation for the preview of Sandbox SDK 1.0, introducing new endpoints for processes, terminals, errors, and an interpreter. The preview surface (`@cloudflare/s…

Cloudflare previews Sandbox SDK 1.0 with simplified API and RPC transport

Cloudflare released a 1.0 preview of its Sandbox SDK under the `@next` npm tag, replacing the previous 0.12.x stable line. The new SDK introduces a single `sandbox.exec()` interface, removes session e…

Cloudflare expands Workers AI binding with unified billing and third-party model support

Cloudflare updated its Workers AI binding (`env.AI`) to enable direct calls to Workers AI and third-party models via `env.AI.run()`, with unified billing for prepaid credits. The update introduces gat…

Cloudflare launches Docker/Kubernetes container image for Mesh nodes

Cloudflare introduced a Docker container image (cloudflare/mesh) for running Mesh nodes in Docker Compose, Kubernetes, and CI/CD pipelines. The image packages the warp-svc daemon in a minimal Wolfi-ba…

Cloudflare WAF update refines WordPress XSS rules and disables obfuscation rule

Cloudflare’s August 7, 2026 WAF release updates WordPress XSS rule metadata to address CVE-2026-64638, a pre-authentication reflected XSS flaw in WordPress login screens, while disabling the Command I…

Cloudflare Hyperdrive adds MySQL support in GA

Cloudflare announced general availability of MySQL support in Hyperdrive, enabling Workers to connect to MySQL databases with reduced latency, global connection pooling, and optional query caching. Ex…

Cloudflare Radar launches AI-powered Researcher beta and WebMCP support

Cloudflare Radar introduced Radar Researcher, a beta AI assistant for exploring internet traffic data in plain language, and WebMCP support for browser-based AI agents. Users can query data via voice/…

Load Balancing - Load Balancing health notifications now resolve automatically

Load Balancing health notifications are now stateful. When a pool or endpoint becomes unhealthy, the notification opens an incident in your alerting tool as before. When that same pool or endpoint rec…

From ranking to recommended: get your site ready to thrive in the age of AI agents

Cloudflare introduced Agent Readiness and Answer Engine Optimization (AEO) tools to help websites prepare for AI agent-driven traffic. The tools diagnose technical readiness for agent access and measu…

Give any website a WebMCP interface

Cloudflare introduced a developer preview of WebMCP, a browser standard enabling AI agents to interact with websites via exposed tools without requiring code changes at the origin. The feature is togg…

Introducing Kitesurf: The agent-first browser that runs in V8 isolates on Cloudflare Workers

Cloudflare introduced Kitesurf, a browser designed specifically for AI agents, running entirely on Cloudflare Workers. It leverages mature WebAssembly and Workers features to deliver a lightweight, ef…

Building an open Agentic Internet: readable, discoverable, callable, and payable

Cloudflare introduced a suite of open standards and tools to transform the web into an 'Agentic Internet' where AI agents can read, discover, call APIs, and pay for services. Key innovations include W…

Cloudflare AI Search: give your agents a search engine for your data

Cloudflare AI Search now automates the integration of Workers AI, AI Gateway, Vectorize, R2, and Browser Run, simplifying search deployment for developers. It introduces hybrid search (semantic + keyw…

The next generation of MCP

Cloudflare announced MCP 2026-07-28, a major update to the Model Context Protocol that removes stateful connections in favor of a stateless architecture. The new specification, along with TypeScript, …

Cloudflare named sole Visionary in 2026 Gartner SASE and SSE Magic Quadrants

Cloudflare is the only vendor recognized as a Visionary in both the 2026 Gartner Magic Quadrant for SASE Platforms and Security Service Edge (SSE) reports. The company attributes this to its unified, …

Cloudflare AI Search adds public, unauthenticated endpoints for MCP, chat, and search

Cloudflare AI Search now supports exposing instances via public endpoints without authentication, including MCP, OpenAI-compatible chat, and search endpoints. These can be enabled per instance or name…

Cloudflare AI Search adds custom domains, access control, and sitemap-free crawling

Cloudflare’s AI Search now lets users serve search endpoints from custom domains, restrict access via Cloudflare Access, and query multiple instances from a single URL. It also introduces a new 'disco…

Cloudflare adds Cloudflare Access authentication to AI Search public endpoints

Cloudflare now allows protecting AI Search public endpoints with Cloudflare Access, requiring users to authenticate via an identity provider before querying indexed content. This turns a public knowle…

Cloudflare launches Kitesurf, a stateless browser for AI agents

Cloudflare introduced Kitesurf, a stateless, agent-first browser running entirely on Workers, optimized for AI workloads. It reduces CPU and memory usage by 3–7x compared to Chromium for tasks like sc…

Cloudflare AI Search adds sitemap and discover parse types for website indexing

Cloudflare AI Search now supports two parse types for website data sources: 'sitemap' (default) and 'discover'. The 'sitemap' type prioritizes pages by `<priority>` and re-crawls based on `<lastmod>` …

Cloudflare AI Search adds namespace public endpoints for consolidated search

Cloudflare AI Search now supports exposing multiple instances under a single namespace public endpoint, merging results from documentation, blogs, and support portals into one searchable URL. Admins e…

Browser Run - Introducing Kitesurf, an agent-first browser on Browser Run

Cloudflare introduced Kitesurf, a stateless, highly scalable browser running on Workers, optimized for AI agents. It offers 3–7× lower CPU and memory usage than Chromium for tasks like screenshots and…

Cloudflare AI Search now supports custom domains for public endpoints

Cloudflare AI Search allows users to serve public endpoints from custom hostnames like search.example.com instead of the default Cloudflare hostname. The feature requires an active public endpoint, a …

AI Gateway - Track AI spend and catch anomalous usage with User Insights

Cloudflare introduced User Insights for AI Gateway, offering real-time visibility into AI spend and security anomalies. The dashboard tracks organization-wide costs, requests, and token usage while fl…

Cloudflare launches open-source Cloudflare OS for AI-driven work automation

Cloudflare introduced Cloudflare OS, an open-source platform enabling organizations to build AI agents, apps, and automate workflows using company-specific context and systems. Initially deployed inte…

Cloudflare launches Cloudflare OS to rethink work with AI internally

Cloudflare built Cloudflare OS to safely enable AI-driven workflows across teams, integrating Compute primitives and Zero Trust tools. The platform addresses internal demand for AI tools while enforci…

Cloudflare adds identity-aware controls to AI Gateway via Access integration

Cloudflare integrated its Access identity service with AI Gateway, enabling identity-based spend limits, model access controls, and user-specific log filtering. AI Gateway now injects verified Access …

Cloudflare adds publisher verification shields to OAuth consent screens

Cloudflare updated OAuth consent screens to display shield icons indicating application ownership and domain verification status. Green shields show Cloudflare-owned apps, blue outlines indicate third…

Cloudflare AI Gateway adds identity-aware controls with Cloudflare Access

Cloudflare AI Gateway now supports Cloudflare Access for identity-aware controls, requiring users to authenticate via their identity provider before accessing the gateway. This enables per-user govern…

Cloudflare launches CI SDK to run pipelines on Workflows and Artifacts

Cloudflare introduced a CI SDK built on Workflows and Artifacts, enabling developers to run full CI/CD pipelines directly on Cloudflare. The SDK supports automated builds, linting, testing, dependency…

Cloudflare adds local tracing for Workers to debug with AI agents

Cloudflare now automatically captures OpenTelemetry traces for local Worker invocations during `wrangler dev` or `vite dev` sessions. AI coding agents can query these traces via the Local Explorer API…

Cloudflare automates Astro issue triage with AI subagents, reducing open issues by 85%

Cloudflare built an AI-driven issue triage pipeline for the Astro open-source project, using isolated subagents in GitHub Actions to reproduce bugs, diagnose root causes, and ship preview releases. Th…

Cloudflare After Dark at Black Hat

Cloudflare is hosting a networking event called #CloudflareAfterDark at Minus5 Ice Bar & 1923 Speakeasy during Black Hat 2026 in Las Vegas. The event runs from 7:00 PM to 10:00 PM PT on August 4, 2026…

Workers - Log in to Wrangler without a local callback server

wrangler login now supports the OAuth 2.0 Device Authorization Grant ↗ . Pass --device to authenticate without starting a temporary callback server on localhost:8976 : npx wrangler login --device Wran…

Workers - Node.js compatibility is now enabled by default

Workers now enable the nodejs_compat and nodejs_compat_v2 compatibility flags by default for compatibility dates of 2026-08-04 or later. These flags are not used for these compatibility dates because …

Cloudflare adds automated CI/CD for Artifacts repos via Workflows

Cloudflare now lets developers automatically run CI checks and deploy Artifacts repos on every push using Workflows and the CI SDK. The system caches dependencies, stops deployments on failures, and d…

Cloudflare launches Cloudflare Wallets and cloudflare.pay for AI agents

Cloudflare introduced Cloudflare Wallets and cloudflare.pay to give AI agents a verifiable identity and the ability to make secure payments on behalf of their owners. Businesses can now identify the h…

Cloudflare adds agent tracing to Workers for AI agent observability

Cloudflare introduced agent tracing for its AI agents platform, enabling detailed tracking of model calls, tool runs, and approvals within Workers traces. The feature provides session replays and wate…

Cloudflare Artifacts adds automated CI/CD for Workers with dependency caching

Cloudflare Artifacts now supports automated CI/CD workflows triggered by git pushes to Artifacts repos, deploying changes directly to Workers or Workers for Platforms User Workers. The system caches d…

Cloudflare WAF update blocks SharePoint RCE and tightens SSRF cloud protections

Cloudflare’s August 4, 2026 WAF release introduces new rules blocking CVE-2026-50522 (Microsoft SharePoint RCE) and CVE-2026-66066 (Ruby on Rails Active Storage RCE), while upgrading SSRF cloud protec…

Workers - AI agents can debug Workers with local tracing

Cloudflare introduced local tracing for Workers, automatically capturing OpenTelemetry traces and console logs during local invocations. AI agents can debug failures by querying traces via the Local E…

Cloudflare Vectorize indexes double capacity to 20 million vectors

Cloudflare increased the maximum vector capacity in its Vectorize indexes from 10 million to 20 million, enabling larger-scale AI applications like semantic search and RAG without splitting data. The …

Cloudflare enables Free account creation directly from dashboard

Cloudflare introduced a new 'Create Account' button in its dashboard allowing all users to generate standalone Free accounts immediately. Eligible users (7+ days tenure) can create up to 5 Free accoun…

Cloudflare launches agent traces for AI SDK and Agents SDK

Cloudflare introduced agent tracing for applications built with its Agents SDK, Think, Flue, and AI SDK. The feature exposes model calls, tool runs, approvals, token usage, and Workers runtime operati…

Your agent needs a computer, not a container — introducing @cloudflare/computer

Cloudflare introduced @cloudflare/computer, an open-source runtime for agentic systems that abstracts compute primitives into a unified workspace. The package provides a durable filesystem, execution …

Cloudflare Workers and Containers now support inbound TCP connections and gRPC

Cloudflare Workers and Containers now support inbound TCP connections and gRPC, enabling bidirectional streaming for real-time applications like voice AI. Developers can deploy gRPC servers in any lan…

Smaller, faster, safer: running Kimi and GLM at scale

Cloudflare introduced three techniques to improve inference efficiency for large open models (Kimi K-series and GLM) on Workers AI: quantizing the KV cache to FP8, compressing model weights to INT4, a…

Workers RPC now works across Python and JavaScript

Cloudflare expanded its Workers RPC system to support seamless interoperability between Python and JavaScript Workers, eliminating the need for custom APIs or serialization formats. Developers can now…

Introducing the Billable Usage API: programmatic cost visibility for Cloudflare

Cloudflare introduced the Billable Usage API to provide real-time, programmatic visibility into usage-based costs across products like Workers, R2, and AI services. The API returns daily-updated cost …

Cloudflare launches @cloudflare/computer agent runtime in preview

Cloudflare released an early preview of @cloudflare/computer, an open-source agent runtime that dynamically orchestrates between isolates and containers for each task. The runtime provides agents with…

Load Balancing - See fallback pool traffic separately in load balancing analytics

Load balancing analytics now shows traffic served by your fallback pool separately from traffic routed to the same pool by normal steering. Previously, requests were grouped by pool name alone. If the…

Cloudflare enables billing for R2 SQL on non-enterprise accounts

Cloudflare has enabled billing for R2 SQL on non-enterprise accounts, charging $0.0025/GB for data scanned beyond the 10 GB monthly free tier. The pricing is additive to existing R2 storage and Data C…

Cloudflare Workers gains Local Explorer for browser-based local debugging

Cloudflare introduced Local Explorer, a browser-based interface for viewing, editing, and debugging local bindings and Worker invocations during development. It supports KV, R2, D1, Durable Objects, a…

Cloudflare enables billing for Pipelines on non-enterprise accounts

Cloudflare Pipelines now bills non-enterprise users for usage beyond the free tier, with SQL transforms at $0.04/GB and sinks at $0.03–$0.06/GB. Workers Paid plans include 50 GB/month for both dimensi…

Cloudflare Access adds control over eager redirect cookies for multi-domain apps

Cloudflare Access administrators can now toggle whether authorization cookies are preemptively set across all hostnames in multi-domain applications, regardless of hostname count. Previously, this beh…

Cloudflare enables billing for R2 Data Catalog on non-enterprise accounts

Cloudflare introduced billing for R2 Data Catalog on non-enterprise accounts, with charges for catalog operations ($9/million) and compaction ($0.005/GB + $2/million objects). Each dimension includes …

Cloudflare Workers RPC system expands with function passing and streaming support

Cloudflare updated its Workers RPC system to enable passing functions as parameters and return values, enabling closures to execute remotely while maintaining local-like syntax. The system now support…

Cloudflare Workers adds RPC via WorkerEntrypoint for Worker-to-Worker communication

Cloudflare Workers now supports RPC between Workers using the WorkerEntrypoint class, enabling direct method calls without public URLs. Developers can extend WorkerEntrypoint to expose public methods …

Cloudflare Workers RPC adds Python-JavaScript cross-language calls

Cloudflare Workers RPC now enables direct method calls between Python and JavaScript Workers without extra dependencies or schema definitions. Exceptions propagate and structured cloneable types are a…

Welcome to Agents Week

Cloudflare redefined its approach to cloud infrastructure by framing a new 'Agent Cloud' paradigm, shifting focus from human-centric design to agent-specific needs like speed, structure, and secure ac…