What Cloudflare shipped in September 2026

Cut your AI spend with AI Gateway's Auto Router

Cloudflare introduced Auto Router in public beta for AI Gateway, automatically selecting the most cost-effective AI model for each task without user intervention. Internal testing showed up to 30% cos…

Detect and send production issues straight to your agent

Cloudflare introduced Issues, a built-in error monitoring tool for Cloudflare Workers in open beta, to automate the detection and resolution of production issues. Issues groups failures, captures cont…

Simplifying domains for people and agents

Cloudflare launched a redesigned domain search experience showing all 420+ supported extensions in real-time, with dynamic filtering and sorting. It introduced a Registrar API (now in beta) accessible…

Monetization Gateway beta: charge AI agents for consumption with HTTP 402

Cloudflare introduced a closed beta for its Monetization Gateway, allowing domain owners to charge AI agents for access to websites, APIs, or datasets using HTTP 402 Payment Required. The feature supp…

Pay Per Use: when AI uses your work, you should get paid

Cloudflare introduced Pay Per Use, a beta product enabling publishers to monetize AI-driven uses of their content by accepting offers from verified AI buyers. Publishers track usage and earnings via C…

Identify AI model overuse with User Insights

Cloudflare enhanced its User Insights feature for AI Gateway to help teams identify AI model overuse by adding task context, user/agent anomalies, and model-fit analysis. The update introduces a 'mode…

The Internet has a second audience

Cloudflare reports AI agent traffic now exceeds 50% of internet requests, disrupting traditional web monetization. To address this, Cloudflare launched AI Crawl Control, Business Insights, Bot Base, a…

Cloudflare Containers, rebuilt to scale agent sandboxes

Cloudflare rearchitected Containers to optimize for agent workloads, enabling runtime image selection, 6x faster startup (648ms median), and filesystem snapshots in public beta. The update leverages D…

Cloudflare Sandbox SDK 0.x to 1.0 migration guide with Durable Objects

Cloudflare is sunsetting Sandbox SDK 0.x in favor of SDK 1.0, which replaces the Sandbox class with a Durable Object class starting containers in under 600ms. SDK 0.x receives bug/security fixes until…

Cloudflare adds Container snapshots for sandbox workspaces

Cloudflare introduced Container snapshots in public beta for its sandbox environments, allowing developers to save a sandbox’s filesystem as a snapshot, stop the instance, and restore files in a new i…

Cloudflare launches Linux sandbox for AI agents to run shell commands

Cloudflare introduced a Linux sandbox feature for its AI agents, enabling secure execution of shell commands, scripts, and code in a Debian-based container. The sandbox runs in a virtual machine with …

Cloudflare adds in-browser terminal for Linux sandboxes via WebSocket

Cloudflare introduced a feature allowing users to open a live terminal in the browser that connects to a Linux sandbox over WebSocket. The terminal uses xterm.js and tmux to maintain a persistent shel…

Cloudflare Sandbox SDK 0.x deprecated; move to 1.0

Cloudflare documented Sandbox SDK 0.x as deprecated, directing users to migrate to version 1.0 which uses Durable Objects to start containers. The 0.x SDK remains available on Workers Paid plans but i…

Cloudflare adds Durable Object scheduling policy for Containers in public beta

Cloudflare introduced a new `durable_object` scheduling policy for its Containers product, allowing per-instance configuration via Durable Object code rather than centralized Wrangler settings. The po…

Cloudflare launches Durable Object Container API for direct container control

Cloudflare introduced a new Durable Object Container API that allows direct management of container workloads alongside Durable Object state. The API enables starting, stopping, inspecting, and execut…

Cloudflare Containers enters public beta with snapshot and restore APIs

Cloudflare introduced snapshot and restore APIs in public beta for its Containers product, enabling developers to persist point-in-time filesystem states and restore them after container restarts or h…

Cloudflare adds durable_object scheduling policy for Containers in public beta

Cloudflare introduced a new `durable_object` scheduling policy for Containers, allowing Durable Objects to dynamically select images and instance sizes at runtime instead of using a centralized config…

Cloudflare launches Quick Tunnels for temporary local service exposure

Cloudflare introduced Quick Tunnels, a feature allowing users to create temporary `trycloudflare.com` URLs for local services without requiring a Cloudflare account or domain. The feature supports ema…

Cloudflare WAF adds new detections for GitLab path traversal and request smuggling

Cloudflare’s September 30, 2026 WAF release introduces new detections targeting a GitLab path traversal vulnerability (CVE-2026-85706) and advanced generic rules for HTTP request smuggling, directory …

Cloudflare AI Gateway adds x402 machine payments for inference requests

Cloudflare introduced Machine Payments (x402) for its AI Gateway, enabling U.S.-based clients to pay for inference calls to select open models directly from stablecoin wallets without prepaid credits.…

Cloudflare enables secure API calls from sandboxes without exposing tokens

Cloudflare introduced a method for code running in Containers or Dynamic Workers to call authenticated APIs without exposing the access token. The token remains in the Worker, which intercepts and for…

Cloudflare Sandbox SDK 1.0 adds granular sandbox control via Durable Objects

Cloudflare released Sandbox SDK 1.0, letting Durable Objects directly control sandbox containers with granular choices over images, instance sizes, network access, and lifetimes. New capabilities incl…

Cloudflare adds Machine Payments (x402) for AI Gateway inference

Cloudflare introduced Machine Payments in beta, allowing AI Gateway clients to pay for eligible inference requests directly from stablecoin wallets using the x402 protocol. The feature requires a U.S.…

Cloudflare launches Monetization Gateway closed beta for paid API access

Cloudflare introduced Monetization Gateway in closed beta, enabling sellers to charge for access to APIs, MCP tools, sites, and datasets. Buyers pay via x402 protocol authorization within HTTP flows, …

Cloudflare adds RBAC to Browser Isolation policies in Cloudflare One

Cloudflare introduced role-based access control (RBAC) for Browser Isolation policies, allowing granular permissions via Gateway’s account-level and resource-scoped roles. Admins can now restrict poli…

Cloudflare ships Windows WARP client beta with 20+ fixes and IPv4 routing support

Cloudflare released a beta update for its Windows Cloudflare One Client (version 2026.8.2033.1) addressing over 20 issues, including improved reauthentication, DNS reliability, and support for routing…

Cloudflare Logpush now available on all plans with usage-based pricing

Cloudflare expanded Logpush to all plans (Free, Pro, Business, Enterprise) with usage-based pricing, replacing prior access restrictions. Each account gets included monthly usage (25 GB for exports, 1…

Cloudflare adds granular permissions for Gateway traffic policies and lists

Cloudflare introduced resource-scoped permissions allowing admins to restrict member access to specific Gateway traffic policies or lists instead of granting account-wide access. This complements exis…

Adaptive application security for the AI era: how Cloudflare connects code, traffic, and intelligence to stop attacks

Cloudflare introduced a new adaptive application security framework to counter AI-driven attacks, integrating discovery, governance, runtime protection, and continuous improvement. Key launches includ…

Building a post-quantum certificate authority with Merkle Tree Certificates

Cloudflare announced the creation of a new certificate authority (CA) that will support Merkle Tree Certificates (MTCs), a post-quantum cryptography solution designed to scale efficiently. The CA will…

We tested our own WAF with frontier AI models. Here’s what we found

Cloudflare tested its WAF using frontier AI models to simulate hacker behavior, generating 1,107 attack attempts across six categories. The WAF blocked the vast majority, but 49 findings led to three …

Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account

Cloudflare introduced Threat Signals, a new feature that automates the processing of open-source threat intelligence reports into actionable indicators. Available to all accounts, it summarizes report…

Preventing quantum downgrade attacks against IPsec

Cloudflare introduced a downgrade protection mechanism for IPsec to prevent quantum attacks that could bypass post-quantum cryptography. The feature, developed with the IETF, is now in beta for Cloudf…

Enforce positive security with Cloudflare Application Profiles

Cloudflare introduced Application Profiles, a feature that enforces positive security by learning the expected structure of HTTP requests for web applications and flagging deviations. This reduces att…

Is your domain using post-quantum encryption? Now you can see for yourself

Cloudflare introduced granular post-quantum (PQ) cryptography visibility tools in its Application Security and Logs products, allowing customers to inspect and graph PQ TLS 1.3 encryption adoption per…

Using AI to chart a course for our post-quantum migration

Cloudflare is accelerating its 2029 post-quantum readiness goal by developing CryptoLabe, an AI-driven internal tool to discover, classify, and analyze cryptographic usage across its codebase. The too…

Building a certificate authority for the whole Internet

Cloudflare announced plans to become a public certificate authority, applying for inclusion in Chrome, Apple, Microsoft, and Mozilla root programs and acquiring a GlobalSign root for broad device reac…

Cloudflare launches new CLI tool `cf` for API and Workers management

Cloudflare introduced `cf`, a new command-line interface in beta that unifies management of the public Cloudflare API and Workers projects. The tool supports over 2,900 API commands, typed project con…

Cloudflare Browser Run now supports concurrent session connections

Cloudflare’s Browser Run sessions now allow multiple concurrent connections, enabling multiple Workers to share a single browser instance. This reduces cold-start time and lowers the count of concurre…

Cloudflare launches typed cloudflare.config.ts for Workers projects

Cloudflare introduced `cloudflare.config.ts`, a new typed TypeScript configuration file for Workers projects that replaces manual wrangler.toml setups. The file supports imports, async values, and env…

Cloudflare launches `cf migrate` to convert Wrangler projects to `cf` CLI

Cloudflare introduced `cf migrate`, a tool to convert Wrangler configuration files to its new `cf` CLI format (`cloudflare.config.ts`). The migration handles most conversions automatically but require…

Cloudflare launches new 'cf' CLI with enhanced authentication and workflows

Cloudflare introduced a new command-line interface (CLI) named 'cf' that replaces and expands upon Wrangler, offering unified authentication, project-level credential management, and shell completion.…

Cloudflare AI Gateway adds User Insights for task-based model optimization

Cloudflare introduced User Insights in AI Gateway to analyze AI traffic by task, highlighting where models exceed task needs and suggesting faster or cheaper alternatives. The feature is available to …

Cloudflare One Client for macOS beta adds DNS and WireGuard fixes, non-RFC 1918 routing

Cloudflare released a beta version of its macOS Cloudflare One Client (2026.8.2028.1) addressing 15 issues, including DNS reliability on low-MTU networks, WireGuard connectivity during key rotation, a…

Cloudflare removes disk-to-memory ratio limit for custom Container instances

Cloudflare removed the disk-to-memory ratio limit for custom Container instance types, allowing up to 20 GB of disk regardless of memory allocation. Previously, disk was capped at 2 GB per 1 GiB of me…

Cloudflare adds Mesh, Workers VPC, and Tunnel replica visibility to network logs

Cloudflare introduced new fields in Gateway network logs and Zero Trust Network Session Logs to distinguish traffic from Cloudflare Mesh nodes, Workers VPC bindings, and specific Cloudflare Tunnel rep…

Cloudflare updates Windows WARP client with 20+ fixes and new IPv4 routing support

Cloudflare released a beta update for its Windows Cloudflare One Client (version 2026.8.2028.1) addressing over 20 issues, including improved DNS reliability, IPv4 routing for non-RFC 1918 networks, a…

Cloudflare updates cache invalidation with detailed revalidation mechanics

Cloudflare expanded documentation on its cache invalidation feature, clarifying how invalidation marks content as stale for revalidation with the origin. The update explains differences between purge …

Cloudflare Cache Reserve now integrates with Smart Shield and updates eligibility rules

Cloudflare introduced Cache Reserve, a persistent storage layer built on R2, to eliminate cache evictions by reserving space for cacheable content. Assets must meet a 10-hour TTL and other criteria, w…

Next.js applications, powered by Vite: introducing Vinext 1.0

Cloudflare announced Vinext 1.0, a framework enabling Next.js applications (both Pages and App Router) to be deployed to any web platform, including Cloudflare Workers, Netlify, or AWS Lambda. Vinext …

Introducing cf: the agentic CLI for the entire Cloudflare API

Cloudflare introduced 'cf', a new CLI designed for agentic development, replacing Wrangler to provide access to over 3,000 API operations (vs. Wrangler's ~280). The tool includes agent-focused feature…

How fast is the web? Explore billions of real-user measurements with BEACON

Cloudflare published the anonymized BEACON dataset, derived from billions of real-user measurements across 10,000 websites, to provide objective insights into how real users experience the web. The da…

Polestar case study highlights Cloudflare’s China Network and Workers for global performance

Polestar adopted Cloudflare’s China Network and global CDN to resolve connectivity issues in China and improve web performance, including during a Super Bowl ad that drove 500% traffic growth. The com…

Cloudflare case study: NCR reduces payment fraud with Bot Management and SSL for SaaS

Cloudflare’s case study highlights NCR’s use of Cloudflare’s Bot Management, SSL for SaaS, and Workers to combat sophisticated payment fraud, including brute-force and credit card tumbling attacks. NC…

Cloudflare powers Q2’s distributed banking platform with Magic Transit and edge security

Q2, a digital banking platform serving 1 in 10 US consumers and 35% of the top 100 banks, adopted Cloudflare’s Magic Transit, WAF, and Load Balancing to secure and scale its distributed cloud environm…

Zendesk case study highlights Cloudflare’s role in security and performance

Zendesk’s case study details how it leverages Cloudflare’s connectivity cloud—including CDN, DDoS protection, bot management, and WAF—to secure global customer interactions, mitigate threats like HTTP…

EmDash 1.0: the stable CMS with a secure plugin registry

Cloudflare released EmDash 1.0, a free and open-source CMS built on Astro, marking its transition from beta to a stable production-ready platform. The release includes a decentralized plugin registry …

Supporting native Rust in Workers with the new Emscripten target for wasm-bindgen

Cloudflare announced experimental support for the Emscripten Rust compiler target (wasm32-unknown-emscripten) in wasm-bindgen, enabling native Rust and Tokio-based applications to run on Workers. This…

Four months of VoidZero at Cloudflare: making the open-source JavaScript toolchain faster for all humans and agents

Cloudflare’s VoidZero initiative shipped over 80 releases in four months, including a 10x faster Oxc React Compiler, Vitest 5 (up to 50% faster), tsglint (12-18x faster than ESLint), and Oxfmt (7x fas…

Introducing Forge: the open source pipeline for generating SDKs, CLIs, docs, and more

Cloudflare introduced Forge, an open-source, pluggable generation pipeline for creating SDKs, CLIs, and documentation from API specifications. Initially powering the cf CLI, Forge will expand to Cloud…

The road to the agentic browser: A Kitesurf update

Cloudflare’s agentic browser Kitesurf now supports WebMCP for programmatic site interaction, expanded browser standards (730K+ WPT subtests passed), and terminal-based rendering via Kitty/ANSI protoco…

Introducing The Cold Start: pitch your startup live at Cloudflare Connect

Cloudflare introduced The Cold Start, a live startup pitch competition for five early-stage companies at its Cloudflare Connect event in San Francisco on October 19, 2026. Winners receive $500,000 in …

Cloudflare CLI enters beta for unified API and Workers management

Cloudflare launched a beta version of its new CLI tool, `cf`, consolidating management of Cloudflare’s API and Workers projects into a single command-line interface. The tool supports over 2,900 comma…

Cloudflare Cache Reserve purge now forces cache miss instead of revalidation

Cloudflare changed Cache Reserve purge behavior so that purging by tag, hostname, prefix, or everything now forces a cache miss rather than revalidation. This increases origin egress costs as Cloudfla…

Cloudflare enables programmatic API token creation via API

Cloudflare added API support to create user-owned and account-owned API tokens programmatically, complementing its existing dashboard-based token generation. The feature requires an initial token crea…

Cloudflare Browser Run adds WebMCP to Kitesurf and adopts document.modelContext

Cloudflare’s Browser Run now supports WebMCP in Kitesurf sessions and Lab sessions via the `document.modelContext` API, replacing the deprecated `navigator.modelContextTesting`. The feature can be tes…

Cloudflare introduces cache invalidation to refresh stale content without full purge

Cloudflare launched a new cache invalidation feature that marks content as stale and revalidates it with the origin on the next request, reusing unchanged assets if the origin returns a 304 Not Modifi…

Cloudflare Browser Run adds session reuse to cut cold-start latency

Cloudflare introduced a session reuse feature for Browser Run, allowing multiple clients to connect to the same running browser instance instead of launching new ones. This reduces cold-start time and…

Cloudflare’s 2026 Annual Founders’ Letter

Cloudflare’s 2026 Founders’ Letter highlights a surge in web growth driven by AI-powered creators and a 1,000x explosion in automated traffic by 2031. The letter warns of risks to new entrants and sma…

Cloudflare enables calling Workflows via ctx.exports in Workers

Cloudflare now lets Workers call Workflows declared in the Wrangler exports field directly through ctx.exports, eliminating the need for a workflows binding. The change simplifies local development an…

Cloudflare expands Email Sending suppression API with bulk operations and domain-level controls

Cloudflare’s Email Sending suppression API now supports full CRUD operations (GET, POST, PATCH, DELETE) for managing suppressions at the account or sending-domain level, including bulk import function…

Agents can now set up your website’s security with Turnstile Spin

Cloudflare introduced Turnstile Spin, an agent-mediated implementation of its Turnstile bot protection service, designed to automate the two-step setup process for AI coding agents. Spin handles widge…

Cloudflare Email Service updates suppression lists with new enforcement and scope rules

Cloudflare’s Email Service now enforces suppression lists differently based on the sending method, with suppressed recipients automatically dropped when the 'Drop suppressed recipients' setting is ena…

Cloudflare Workers Metrics now shows all releases and gradual deployments

Cloudflare’s Workers Metrics charts now display every release and gradual deployment within a selected time range, including traffic allocation changes. Users can hover over rollouts to see version de…

Cloudflare adds Browser Run crawl event subscriptions to Queues

Cloudflare now lets Browser Run crawl jobs publish lifecycle events (started, updated, finished) to Cloudflare Queues, enabling real-time tracking without polling. Users can subscribe via Wrangler CLI…

Cloudflare emergency WAF update blocks exploits for WordPress and JFrog Artifactory CVEs

Cloudflare issued an emergency WAF update on September 25, 2026, to block exploits targeting critical vulnerabilities in WordPress (CVE-2026-87902) and JFrog Artifactory (CVE-2026-42018, CVE-2026-8232…

Cloudflare Email Sending adds domain-level suppression controls

Cloudflare’s Email Sending now supports domain-scoped suppressions, allowing bounce and complaint blocks to apply to a single sending domain rather than the entire account. This prevents issues with o…

Cloudflare enables Managed Rulesets in Unified Routing mode

Cloudflare Advanced Network Firewall Managed Rulesets now support Unified Routing mode, expanding security policy enforcement to accounts using this traffic steering method. The change applies to Clou…

Cloudflare Workers gains new tracing APIs for custom spans

Cloudflare introduced four new Workers tracing APIs—getActiveSpan(), recordException(), startSpan(), and setAttributes()—expanding OpenTelemetry span support. These enable developers to annotate spans…

How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

Cloudflare patched a cross-tenant data exposure vulnerability in its Containers and Sandboxes products after a researcher reported it via the bug bounty program. The flaw allowed a paid account custom…

Cloudflare case study: VFS Global secures visa systems with Cloudflare

VFS Global, a visa and consular services provider, adopted Cloudflare to consolidate security, performance, and compliance tools into a single solution. Cloudflare’s WAF, Bot Management, Rate Limiting…

ComfortDelGro strengthens digital resilience with Cloudflare across 13 countries

ComfortDelGro, a global transport operator, deployed Cloudflare to mitigate bot-driven disruptions and API attacks across its 13-country operations. The solution reduced bot disruption by 90%, maintai…

Gusto switches to Cloudflare for Zero Trust, improving reliability and support

Gusto migrated from a traditional VPN to Cloudflare’s Zero Trust Network Access (ZTNA) solution, reducing migration time from over a year to under three months. The switch improved remote access relia…

Cloudflare powers CrazyGames’ global gaming platform with 25M threat mitigations monthly

CrazyGames, a top-500 global gaming platform with 50M monthly users, relies on Cloudflare to mitigate 25M threats monthly and deliver reliable performance via CDN, DNS, WAF, Workers, and Images. The 5…

Hack The Box scales cybersecurity training platform with Cloudflare, blocking 13.37M threats monthly

Hack The Box, a global cybersecurity training platform with 4M users, relies on Cloudflare to block 13.37M monthly threats while reducing latency by 30-45% for users in 170 countries. Cloudflare’s WAF…

Olive Young scales K-beauty globally with Cloudflare’s bot defense and WAN

Olive Young integrated Cloudflare’s AI bot management and Cloudflare WAN to modernize its global retail infrastructure, achieving 25% better bot detection precision, 80% faster mitigation, and a cloud…

Cloudflare highlights Cinder’s use of Zero Trust and Workers for AI safety infrastructure

Cloudflare’s case study details how Cinder, an AI safety infrastructure provider, leverages Cloudflare’s connectivity cloud, Zero Trust (SASE), and Workers to onboard engineers in days, automate fraud…

TAP Air Portugal adopts Cloudflare for cybersecurity and operational agility

TAP Air Portugal, a major European airline, migrated to Cloudflare’s cybersecurity stack in 2024 to address DDoS attacks, bot traffic, and operational bottlenecks. The shift enabled real-time rule upd…

Cloudflare 1.1.1.1 adds RFC 8509 root key trust anchor sentinels for DNSSEC rollover diagnostics

Cloudflare’s 1.1.1.1 DNS resolver now supports RFC 8509 root key trust anchor sentinels, enabling users to verify resolver trust in DNSSEC root keys before key rollovers. The feature allows diagnostic…

Cloudflare launches MCP server portals in general availability

Cloudflare announced the general availability of MCP server portals, providing customers with a single endpoint to connect, secure, and monitor approved Model Context Protocol (MCP) servers. The featu…

Cloudflare adds unsafe and custom topic detection for AI app security

Cloudflare introduced AI Security for Apps with two layers of topic detection: default unsafe categories (e.g., violence, hate speech) and custom topics defined by users. Custom topics use a zero-shot…

Cloudflare adds Workflow exports to Wrangler configuration

Cloudflare now lets developers declare Workflows in a Worker’s `exports` field of the Wrangler config instead of requiring a `workflows` binding. This change simplifies configuration while maintaining…

Cloudflare AI Gateway adds User Insights for spend tracking and anomaly detection

Cloudflare introduced User Insights for AI Gateway, enabling organizations to track AI spend, attribute usage to identities, and detect anomalous sessions. The feature works with existing gateway traf…

Cloudflare R2 adds storage, operations, and bandwidth analytics via GraphQL

Cloudflare expanded R2 object storage with three new analytics datasets—operations, storage, and bandwidth—accessible via the Cloudflare dashboard and GraphQL Analytics API. The datasets provide granu…

R2 - R2 bandwidth usage metrics

Cloudflare introduced a new R2 bandwidth usage metrics page in its dashboard, allowing users to view total or per-bucket bandwidth split by upload and download. The same metrics are now accessible via…

Cloudflare One, Cloudflare Mesh - Add Mesh participants with guided onboarding

Cloudflare Mesh now offers guided onboarding in the dashboard to simplify adding and managing participants. Users can deploy a Mesh node or connect a client device directly from the Networking section…

Cloudflare adds Traffic Destination selector to Gateway policies

Cloudflare introduced a Traffic Destination selector in Gateway HTTP and Network policies, enabling administrators to write rules based on how traffic exits Cloudflare. The selector supports five off-…

Cloudflare increases Durable Object name search limit to 128 characters

Cloudflare expanded Durable Object name search in its dashboard from 20 to 128 characters, improving usability for developers managing large deployments. The change applies to object filters in the Me…

Cloudflare adds transformation analytics for Images

Cloudflare introduced account-level analytics for Images transformation usage, accessible via Images & Stream > Transformations > Analytics. The feature provides sampled estimates of image transformat…

We just shipped support for the ugliest part of HTTP: Vary

Cloudflare introduced Vary support in Cache Rules across all plans, allowing customers to control how the CDN handles HTTP Vary headers. The feature lets origins declare which request headers may affe…

Introducing Worker Previews: isolated preview environments for every change your agent makes

Cloudflare introduced Worker Previews, providing isolated, production-like environments for every Git branch. Each branch gets its own URL, configuration, state, and observability tools, enabling atom…

Cloudflare Workers introduces Preview deployments for testing

Cloudflare added Worker Previews to its Workers platform, allowing developers to create preview deployments of Workers without deploying to production. The feature requires Wrangler 4.135.0 or later a…

Cloudflare Workers Previews gains full observability with logs, traces, and metrics

Cloudflare expanded Workers Previews with independent observability features, including logs, traces, metrics, and Tail Workers, all configurable per Preview. Preview telemetry is now fully separated …

Cloudflare launches Worker Previews for isolated PR testing

Cloudflare introduced Worker Previews, enabling every pull request to deploy into an isolated, production-like environment with its own URL, configuration, observability, and isolated Durable Objects …

Cloudflare Workers Previews gains scoped configuration and secrets management

Cloudflare updated Workers Previews to support scoped configuration via a dedicated `previews` block in Wrangler files, allowing teams to define Preview-specific variables, bindings, and secrets separ…

Cloudflare Rules now support up to 32 arguments in concat()

Cloudflare increased the maximum number of arguments for the `concat()` function in Rules expressions from 16 to 32, enabling richer dynamic value combinations. This change simplifies configurations t…

Cloudflare Workers Previews: resource isolation and binding behavior clarified

Cloudflare updated Workers Previews documentation to clarify how resources like Durable Objects, KV namespaces, D1 databases, and Containers are isolated or shared across Previews. Key changes include…

Cloudflare adds private MCP server support for MCP portals

Cloudflare now lets MCP server portals connect to private MCP servers via Cloudflare Gateway without exposing them to the public internet. Private servers are reachable through Cloudflare Tunnel, Mesh…

Cloudflare WAF adds SSRF and SSTI detections in 2026-09-22 release

Cloudflare’s WAF managed ruleset now blocks SSRF attempts using non-standard IP notations and jar loopback payloads, and prevents Server-Side Template Injection in Jinja environments. All new detectio…

Cloudflare adds automatic cleanup for inactive Access service tokens

Cloudflare Access now lets administrators automatically disable or delete service tokens that haven’t authenticated for 30–365 days. Eligible tokens must be older than the set period, unused, and not …

Cloudflare Workers Builds integrates with Cursor Origin for automated deployments

Cloudflare added Cursor Origin support to Workers Builds, enabling automatic production deployments, branch preview URLs, and build status updates directly in Cursor Origin pull requests. Developers c…

Cloudflare integrates Workers with Cursor Origin for automated CI/CD

Cloudflare launched a Cursor Origin integration enabling automatic builds and deployments of Workers when code is pushed to a production branch. The integration posts build status comments in pull req…

Python Workers are now generally available

Cloudflare announced Python Workers are now generally available, making Python a first-class language in the Cloudflare Workers runtime. Developers can run Python frameworks like FastAPI, Django, and …

Cloudflare adds dry-run validation for rules and rulesets before deployment

Cloudflare introduced a dry-run validation feature that checks rule and ruleset changes for syntax, permissions, and plan compatibility without deploying them. The feature is available in the dashboar…

Cloudflare One Client for macOS beta adds IPv4 routing, DNS reliability fixes

Cloudflare released a beta update for its macOS Cloudflare One Client (version 2026.8.1755.1) addressing 15 bugs and adding support for routing non-RFC 1918 local IPv4 networks through WARP tunnels wh…

Cloudflare released a beta update (v2026.8.1755.1) for its Windows Cloudflare One Client, addressing over 20 issues including DNS reliability, captive portal handling, and TPM-backed authentication. T

Cloudflare adds scoped access controls for Workers in dashboard

Cloudflare introduced a new feature allowing Super Administrators to invite teammates and grant scoped access to individual Workers directly from the Workers dashboard. Four access levels are availabl…

Cloudflare Browser Run adds typed session and DevTools methods

Cloudflare’s Browser Run browser bindings now include typed methods for session management, outbound Worker routing, and DevTools operations. Developers can acquire sessions, manage targets, and route…

Saving another 100TB of RAM with math (and Rust)

Cloudflare reduced the memory footprint of its Pingora Backend Router by optimizing consistent hashing algorithms and Rust structs, reclaiming over 100TB of RAM globally. The changes stemmed from a ti…

Cloudflare adds Inspect panel to Browser Run Session Recordings

Cloudflare introduced an Inspect panel for Browser Run Session Recordings, enabling developers to review console logs, network requests, and DOM structure after a session ends. The feature includes se…

Cloudflare launches Unified Routing for WAN and Magic Transit

Cloudflare announced the general availability of Unified Routing, a new routing fabric integrating Cloudflare One with WAN and Magic Transit on-ramps. It introduces features like Automatic Return Rout…

Cloudflare to deprecate 32-bit Windows and Intel-based macOS cloudflared builds in 2027

Cloudflare announced it will deprecate 32-bit Windows and Intel-based macOS builds of cloudflared starting in 2027, halting new releases for these architectures. The move aligns with the end of OS sup…

Cloudflare adds DDoS attack traffic filtering to Logpush

Cloudflare introduced a feature to exclude identified DDoS attack traffic from Logpush datasets before delivery. The option applies to `http_requests`, `firewall_events`, and `network_analytics_logs` …

Cloudflare enables self-serve Free account creation via dashboard, API, and Enterprise orgs

Cloudflare now allows all customers to create additional Free accounts directly in the dashboard, while Enterprise Super Administrators can provision up to five Free accounts within their organization…

Cloudflare adds rejectIfBusy option for Workers AI synchronous inference

Cloudflare introduced the `rejectIfBusy` option for Workers AI synchronous inference requests, allowing them to fail immediately when capacity is unavailable instead of waiting in a queue. The feature…

Cloudflare expands Workflows Workers API with new step methods and instance management

Cloudflare updated its Workflows Workers API to introduce enhanced step methods like `step.do` with rollback options, `step.sleep`, `step.sleepUntil`, and `step.waitForEvent`, alongside improved insta…

Cloudflare Workers now includes JavaScript RPC session spans in traces

Cloudflare Workers traces now automatically include JavaScript RPC session spans for Worker-to-Worker and Worker-to-Durable Object calls, providing deeper visibility into call lifetimes, method invoca…

Cloudflare R2 Data Catalog adds automated table maintenance for Iceberg tables

Cloudflare’s R2 Data Catalog now automates two critical maintenance operations for Apache Iceberg tables: compaction (combining small files into larger, efficient ones) and snapshot expiration (removi…

Cloudflare expands Workers tracing with new spans and attributes

Cloudflare Workers now automatically captures a broader set of spans and attributes for observability without requiring code changes. New attributes include detailed HTTP request/response metadata, ca…

Cloudflare adds dry-run validation for Rulesets changes

Cloudflare introduced automatic validation for Rulesets changes in the dashboard and a new `dry_run=true` parameter for the Rulesets API. This prevents invalid configurations from being published by c…

Cloudflare adds batch and individual deletion for Workflow instances

Cloudflare introduced the ability to delete one or up to 100 Workflow instances and their stored state via the Workflows API or Wrangler 4.125.0+. Deleting an instance stops execution and frees storag…

Cloudflare Workers AI adds rejectIfBusy to fail synchronous inference requests when capacity is unavailable

Cloudflare introduced a `rejectIfBusy` option for Workers AI that immediately rejects synchronous inference requests when capacity is unavailable, returning a 429 error with code 3040. The feature is …

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare’s Page Shield ML detected four live malicious JavaScript campaigns on storefronts that evaded traditional scanners like VirusTotal and URLScan. The GNN-based model caught all eight payloads…

Cloudflare updates AI Gateway with new guardrails, DLP, and rate-limiting controls

Cloudflare expanded its AI Gateway API with new updateable parameters including configurable guardrails (prompt/response blocking), data loss prevention (DLP) policies with BLOCK/FLAG actions, rate-li…

Cloudflare launches containerized Mesh node for Docker and Kubernetes

Cloudflare introduced a Docker image (`cloudflare/mesh`) packaging its Mesh node for Linux containers, enabling deployment in Docker Compose, Kubernetes, and CI/CD pipelines without host installations…

Cloudflare Tunnel gains bulk route creation, origin settings UI, and live log streaming

Cloudflare Tunnel received three major updates: bulk route creation for multiple tunnels/mesh routes in one action, direct dashboard configuration of origin application settings (HTTP/TLS/connection p…

Cloudflare adds Hyperdrive support for Python Workers to connect to PostgreSQL and MySQL

Cloudflare now allows Python Workers to connect to PostgreSQL and MySQL databases via Hyperdrive, providing connection pooling and query caching. This expands Workers' database integration capabilitie…

Cloudflare R2 Data Catalog gains table maintenance visibility and manual queueing

Cloudflare’s R2 Data Catalog now offers table-level maintenance visibility and manual compaction queueing in the dashboard. Users can inspect schedules, review audit logs of completed operations, and …

Cloudflare enables client device enrollment in Mesh for private network access

Cloudflare updated its Mesh documentation to guide users in enrolling client devices—laptops, phones, and desktops—into Cloudflare Mesh via the Cloudflare One Client. Enrolled devices receive a Mesh I…

Cloudflare Workers gains granular authorization with scoped roles

Cloudflare introduced four new Developer Platform roles (Metadata Read-Only, Content Read-Only, Editor, Admin) to scope access to individual Workers, enabling least-privilege permissions for teammates…

Cloudflare adds Hyperdrive support for Python Workers in beta

Cloudflare expanded Hyperdrive database connectivity to Python Workers, enabling PostgreSQL and MySQL connections via TCP sockets in beta. The feature requires a compatibility date of September 8, 202…

Cloudflare Workflows adds real-time event subscription without polling

Cloudflare Workflows introduced a `subscribe()` method allowing developers to receive historical and live instance events in real time without polling the `status()` API. Subscriptions deliver retaine…

Cloudflare launches Data Studio for Durable Objects storage management

Cloudflare introduced Data Studio, a UI tool in its dashboard for viewing and editing SQLite-backed Durable Object storage data. The feature supports only SQLite-backed objects and SQL API data, with …

Cloudflare adds tag-based target criteria to Access for Infrastructure

Cloudflare’s Access for Infrastructure now supports attaching key-value tags to infrastructure targets and using those tags in access policies via include, require, and exclude operators. Tags can be …

Cloudflare Workers rolls out granular role-based permissions and scopes

Cloudflare introduced a new role-based permission system for Workers, replacing legacy permissions with four distinct roles (Metadata Read-Only, Content Read-Only, Editor, Admin) and two scope levels …

Cloudflare adds .subscribe() to stream Workflow instance events

Cloudflare Workflows instances now support a .subscribe() method and a new API endpoint to stream real-time events, including step attempts, sleeps, waits, and rollbacks. Workers and applications can …

Cloudflare adds granular Worker permissions with four new roles

Cloudflare introduced four new roles to control access to specific Workers, enabling fine-grained permissions for teammates, agents, and CI/CD workflows. Roles range from Metadata Read-Only to Admin, …

Cloudflare Access gains tag-based policies, fresh SAML auth, and Worker-wide protection

Cloudflare Access introduced tag-based target criteria for infrastructure applications, enabling policy matching by hostname or tags with include/require/exclude operators. It also added fresh SAML re…

Cloudflare WAF release adds SSRF and command injection protections

Cloudflare’s September 15, 2026 WAF release introduces new threat detections for command injection, SSRF targeting cloud metadata, and version control information disclosure. Three managed rulesets no…

Cloudflare AI Gateway adds provider credential requirement to prevent Unified Billing fallback

Cloudflare’s AI Gateway now enforces provider credential requirements for third-party requests to prevent fallback to Unified Billing. Users can enable the 'Require provider credentials' setting or se…

Cloudflare adds shadowed record warnings for all zones

Cloudflare now displays warnings for shadowed DNS records across all zones, helping users identify records no longer authoritative due to subdomain delegation. Shadow metadata is also available via th…

Cloudflare adds force reauthentication for SAML identity providers

Cloudflare Access now supports requiring fresh authentication from SAML identity providers for every login via a new 'Require reauthentication' setting. Admins can enable this in the dashboard or set …

Cloudflare updates cache behavior for HTTP range requests

Cloudflare revised its documentation to explain how it processes HTTP range requests, including eligibility rules, client response behavior, and origin request alignment. The update clarifies caching …

Cloudflare adds hostname guardrails to Browser Run for secure automation

Cloudflare’s Browser Run now enforces hostname-based guardrails to restrict HTTP/HTTPS requests to permitted domains during browser automation sessions. This prevents external content loading and ensu…

Data Loss Prevention - Discover where sensitive data goes before you create a Data Loss Prevention policy

Cloudflare introduced Passive Detection for its Data Loss Prevention (DLP) product, enabling organizations to analyze sampled HTTP traffic for sensitive data types and their destinations before creati…

Cloudflare CASB adds automatic remediation policies for SaaS risks

Cloudflare introduced automatic remediation policies in its Cloudflare CASB (Cloud Access Security Broker) to proactively address SaaS misconfigurations without manual intervention. Security teams can…

Cloudflare adds per-turn metrics and diagnostics to Voice Agents SDK

Cloudflare’s @cloudflare/voice v0.4.0 introduces per-turn metrics and browser diagnostics for Voice Agents, enabling developers to inspect latency and outcomes for each interaction. The update provide…

Cloudflare integrates R2 with AI Search for document indexing

Cloudflare now supports connecting R2 buckets as a data source for AI Search, enabling automatic indexing of stored documents. Users can configure inclusion/exclusion rules, set custom metadata for fi…

Cloudflare AI Search now indexes extensionless R2 objects with Content-Type metadata

Cloudflare’s AI Search can now index R2 objects without filename extensions if they include supported Content-Type metadata, enabling file-type validation during indexing. This expands indexing capabi…

Cloudflare launches Passive Detection for Zero Trust DLP to identify sensitive data before policy creation

Cloudflare introduced Passive Detection, a feature that scans a sampled subset of Gateway HTTP traffic to identify sensitive data types before creating DLP policies. It provides a dashboard to analyze…

Cloudflare reduces default Workflows retention to seven days on Workers Paid

Cloudflare changed the default instance retention for new Workflows on the Workers Paid plan from 30 days to seven days, effective September 10, 2026. The maximum retention limit remains 30 days, and …

Cloudflare integrates OpenAI Agents API with Cloudflare Containers

Cloudflare now supports running OpenAI Agents API sessions in self-hosted Cloudflare Containers via a new executor template. The integration uses a Cloudflare Worker to manage OpenAI webhooks and a co…

Cloudflare integrates Containers with OpenAI Agents API for Codex execution

Cloudflare now supports running Codex via the OpenAI Agents API using Cloudflare Containers as self-hosted execution environments. The integration provides an open-source Workers template that manages…

Cloudflare emergency WAF release blocks Adobe Commerce zero-day RCE

Cloudflare deployed an emergency WAF update on September 10, 2026, to block a high-severity zero-day RCE vulnerability (CVE-2026-75650) in Adobe Commerce and Magento Open Source. The rule blocks unaut…

Cloudflare Workers upgrades module registry for Node.js compatibility

Cloudflare Workers now enables Node.js compatibility by default, supports applications up to 64 MiB, and introduces a URL-based module registry with import.meta support, lazy compilation, shared code …

Urgent Action Required: Critical Security Update Available for Adobe Commerce (APSB26-146)

Adobe released a critical security update (APSB26-146) for Adobe Commerce and Magento Open Source to address a zero-day vulnerability (CVE-2026-75650) allowing unauthenticated arbitrary code execution…

Cloudflare updates Windows WARP client with LAN routing and DNS fixes

Cloudflare released a beta update for its Windows Cloudflare One Client (v2026.8.1290.1) on September 9, 2026, adding support for routing non-RFC 1918 local IPv4 networks through WARP tunnels and impr…

Cloudflare CASB integrates with Zoom for security scanning

Cloudflare CASB now integrates with Zoom to scan for security misconfigurations and data risks across account settings, users, meetings, and recordings. The integration uses Cloudflare's pre-built OAu…

Cloudflare AI Gateway adds custom per-request cost controls

Cloudflare’s AI Gateway now supports custom cost overrides at the request level, allowing users to set precise input, output, cache-read, and cache-write token rates. These override default or public …

Cloudflare released a beta update for its macOS Cloudflare One Client (v2026.8.1290.1) on September 9, 2026, enabling routing of non-RFC 1918 local IPv4 networks through WARP tunnels and improving DNS

Cloudflare CASB adds Zoom integration, AI summaries, and automated remediation

Cloudflare CASB introduced a Zoom integration to scan meetings, recordings, and account settings for security misconfigurations and data exposure risks. New features include AI-generated Cloudy Summar…

Cloudflare R2 launches Data Access Logs for per-request tracking

Cloudflare R2 introduced Data Access Logs to record per-request object operations with HTTP status codes below 400, enabling granular observability in Workers Observability. The feature captures opera…

Cloudflare improves iOS tap-to-type experience in Browser Isolation

Cloudflare updated its Browser Isolation feature to display an inline tap-to-type prompt for iOS users instead of a full-screen overlay, reducing disruption during text entry. The change applies autom…

Cloudflare AI Gateway adds custom cache token costs

Cloudflare’s AI Gateway now supports custom cache-read and cache-write token rates in its cost model, allowing providers to reflect negotiated cache pricing. The feature uses new `per_cache_read_token…

Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Cloudflare introduced Automatic Key Exchange, an extension of Automatic SSL/TLS, to dynamically select the optimal key agreement algorithm for origin connections. This reduces HelloRetryRequests from …

Cloudflare WAF consolidates Next.js RCE beta rules into baseline signatures

Cloudflare’s September 8, 2026 WAF release merges two active beta rules targeting Next.js remote code execution (RCE) vulnerabilities into their baseline managed rulesets. Previously logging-only acti…

Cloudflare Python Workers now default to Python 3.14

Cloudflare’s Python Workers now default to Python 3.14, replacing the previous runtime with Pyodide 314.0.6. The change applies to all new Python workers using compatibility date 2026-09-08 or later.…

Cloudflare Radar search adds Internet events and outage tracking

Cloudflare Radar search now surfaces Internet events and outages alongside traditional results, enabling searches by event descriptions, locations, ASes, or domains. Event links include date ranges fo…

Cloudflare Miniflare v5 updates local development APIs for cf CLI

Cloudflare released Miniflare v5 to align its local development tooling with the upcoming `cf` CLI and the new `cloudflare.config.ts` format. The update removes deprecated APIs, internal bindings, and…

Cloudflare R2 Data Access Logs now generally available

Cloudflare launched R2 Data Access Logs, a generally available feature that records object operations (reads, writes, deletes, etc.) with response codes below 400. Logs are accessible in Workers Obser…

Cloudflare removes compressed Worker size limits, raises limit to 64 MiB

Cloudflare removed compressed size limits for Workers (3 MB free / 10 MB paid) and now enforces only an uncompressed bundle size limit of 64 MiB across all plans. This allows developers to deploy larg…

Cloudflare Enterprise customers can now self-configure CDN upload limits up to 5 GB

Cloudflare Enterprise customers can now raise a zone's CDN maximum upload size to 5 GB directly from the Cloudflare dashboard, eliminating the need to contact support for limits between 500 MB and 5 G…

Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models

Cloudflare introduced Vulnerability Discovery and Remediation, an early-access service that uses OpenAI Daybreak models (including GPT-5.6 Cyber) to detect and prioritize vulnerabilities in customer c…

Cloudflare integrates OpenAI Daybreak models for AI-powered vulnerability management

Cloudflare launched Vulnerability Discovery and Remediation, an AI-powered service using OpenAI Daybreak models (including GPT-5.6 Cyber) to detect, block, and fix software vulnerabilities in real tim…

Cursor enables self-hosted Cloud Agent execution for private, custom hardware deployments

Cursor introduced Self-Hosted Machines, allowing teams to run Cloud Agent tool execution on their own managed machines while keeping the agent loop, inference, and planning in Cursor’s cloud. This add…

Summer 2024 weather report: Cloudflare with a chance of Intern-ets

Cloudflare welcomed around 60 interns globally for Summer 2024, contributing to high-impact projects across teams like engineering, product, security, and business development. Interns worked on initi…

Cloudflare enables Cursor Cloud Agents to run via self-hosted machines

Cloudflare introduced a new integration allowing Cursor Cloud Agents to deploy on Cloudflare Containers, enabling each agent session to run in isolated containers. The setup requires Cursor Enterprise…

Cloudflare launches account-owned API tokens with durable service principal support

Cloudflare introduced account-owned API tokens (`cfat_` prefixed) to enable durable integrations like CI/CD and SIEMs, acting as service principals with fixed permissions. These tokens remain function…

Cloudflare adds Origin Range Requests control via Rulesets API

Cloudflare’s Rulesets API now supports Origin Range Requests in Cache Rules, allowing customers to configure how Cloudflare fetches large files from origins using byte-range requests. Admins can set t…

Cloudflare Python Workers now support WSGI/ASGI web frameworks

Cloudflare’s Python Workers now support WSGI frameworks like Django and Flask, and ASGI frameworks like FastAPI, enabling developers to deploy existing Python web apps directly on Workers. The update …

Cloudflare integrates Cursor Cloud Agents with Cloudflare Sandboxes

Cloudflare announced support for running Cursor Cloud Agents on Cloudflare Sandboxes, enabling developers to execute AI coding agent tasks in secure, customer-controlled environments. The integration …

Sandbox SDK - Run Cursor Cloud Agents on Cloudflare via self-hosted machines

Cloudflare now supports running Cursor Cloud Agents on its platform using self-hosted machines. The integration leverages Cloudflare Containers for isolated sessions, with Cursor handling agent logic …

Cloudflare adds DHCP options configuration to Cloudflare One Appliance dashboard

Cloudflare introduced a dashboard UI to configure custom DHCP options for LANs using Cloudflare One Appliance as the DHCP server, eliminating the need for API or Terraform. Users can now select predef…

Cloudflare adds Prioritized Traffic to Cloudflare One Appliance

Cloudflare introduced Prioritized Traffic in Cloudflare One Appliance, allowing users to define which applications are processed first by inspecting DNS requests. The feature supports both Cloudflare-…

Cloudflare Images adds text rasterization and binding updates

Cloudflare expanded its Cloudflare Images binding with text rasterization, allowing developers to convert text into images directly within Workers. The update also enables metadata filtering for hoste…

Cloudflare adds image overlay and watermark support in Workers

Cloudflare introduced two methods to draw text, logos, and watermarks over images using Workers: via the `cf.image` fetch subrequest with a `draw` array and via the Images binding with chainable `.dra…

Cloudflare adds custom application traffic steering in Cloudflare One Appliance dashboard

Cloudflare introduced the ability to create, edit, and delete custom applications for breakout and prioritized traffic directly in the Cloudflare One Appliance dashboard. Users can now match traffic b…

Cloudflare adds breakout traffic feature to Cloudflare One Appliance

Cloudflare introduced breakout traffic in Cloudflare One Appliance, allowing users to bypass security filtering for specific applications by configuring DNS-based traffic steering. The feature support…

Cloudflare enables bulk creation of Tunnel and Mesh routes

Cloudflare’s Routes page now allows users to create multiple Cloudflare Tunnel and Cloudflare Mesh routes in a single action, including adding multiple destinations via comma-separated lists and queui…

Cloudflare prototypes cache transcoding with Zstandard to save petabytes of storage

Cloudflare prototyped Cache Transcoding, encoding eligible assets with Zstandard (zstd) inside their Pingora proxy before writing to disk. This reduces on-disk size to ~1/3 of original for compressibl…