What Cloudflare shipped in October 2026

Cloudflare adds batch DNS records API for multi-operation transactions

Cloudflare introduced a new POST /zones/{zone_id}/dns_records/batch endpoint enabling developers to execute multiple DNS record operations—deletes, patches, puts, and posts—in a single API call. Opera…

Cloudflare makes WAF, bot management, caching, and Workers available for private origins

Cloudflare announced general availability of its services for private origins, allowing customers to proxy DNS records pointing to private IPs through Cloudflare One connectivity. This enables WAF, bo…

Cloudflare Keyless SSL now supports TLS 1.3 with ECDSA certificates

Cloudflare’s Keyless SSL now negotiates TLS 1.3 for ECDSA certificates when enabled on a zone, while RSA-based Keyless SSL remains capped at TLS 1.2. Private keys stay on customer-controlled key serve…

Cloudflare Browser Run upgrades to Chrome 152 with Quick Actions improvements

Cloudflare’s Browser Run service now defaults to Chrome 152, delivering current web platform features, rendering fixes, and security patches. The update also improves Quick Actions reliability with a …

Cloudflare Durable Objects now defer code updates by default

Cloudflare Durable Objects now defer code updates by default, allowing active objects up to 5 minutes to finish in-flight work before adopting new code. Developers can configure the delay (0–86,400 se…

Cloudflare updates SCIM population viewer for identity provider management

Cloudflare introduced a SCIM population viewer in Cloudflare One to inspect users and groups provisioned via identity providers, enabling troubleshooting of provisioning issues and resource attribute …

Cloudflare issues emergency WAF update for Nuxt Image/IPX vulnerability

Cloudflare released an emergency update to its Managed Ruleset adding a new rule for a vulnerability in Nuxt Image and IPX, disabled by default. The rule offers partial coverage, and users are advised…

Cloudflare updates WAF rules for PHP OOM vulnerabilities

Cloudflare released updates to its WAF managed, free, and response rulesets to address PHP out-of-memory vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560). The changes refine rule de…

Cloudflare adds SCIM population viewer for Zero Trust identity management

Cloudflare introduced a SCIM population viewer in Cloudflare One to inspect provisioned users and groups from identity providers without API requests or support tickets. The tool allows searching, att…

Cloudflare launches PHP Capture the Flag challenge to test WAF protections

Cloudflare introduced a PHP-focused Capture the Flag (CTF) challenge integrated with its Bug Bounty program to test and improve its WAF protections against recent PHP vulnerabilities (CVE-2026-109618 …

Cloudflare D1 to enforce 50 MB query result size limit starting November 4, 2026

Cloudflare’s D1 serverless database will block queries returning results over 50 MB starting November 4, 2026, returning an error for oversized responses. The limit targets the 99.999th percentile of …

Cloudflare Audit Logs v2 adds account-level analytics for security investigations

Cloudflare introduced account-level analytics in Audit Logs v2, enabling users to track successful and failed actions over time, view summary metrics like total actions and failure rates, and filter b…

Cloudflare WAN adds regional Gateway HTTP inspection for data sovereignty

Cloudflare WAN now supports selecting a Gateway processing region for TLS decryption and HTTP inspection, allowing organizations to control where sensitive traffic is processed. Traffic enters Cloudfl…

Cloudflare retires classic DNS records page, migrates all users to new experience

Cloudflare retired its classic DNS records page on October 30, 2026, making the new DNS records experience the default for all users across all plans. The update includes support for changing record t…

Cloudflare Workers subrequests now preserve context for BYOIP destinations

Cloudflare updated Workers subrequests to preserve request and Bot Management context when targeting Cloudflare-proxied BYOIP destinations, fixing prior inconsistencies in security rule evaluation and…

Cloudflare enables Agent Skills storage in Computer Workspace

Cloudflare introduced a new way to store and manage Agent Skills as files in a Computer Workspace, allowing skills written by agents or users to persist across sessions without deployment. Changes to …

Cloudflare Agents SDK v0.32.0: Agent Skills now files in Workspace

Cloudflare’s Agents SDK now treats Agent Skills as files stored in an agent’s Workspace, R2 bucket, or codebase, eliminating build steps and enabling dynamic skill updates. The change removes legacy A…

Cloudflare launches Agent Skills tools for AI agent harnesses

Cloudflare introduced new tools to enable AI agents to dynamically discover, load, and execute skills on demand using their Agent Skills framework. The tools—activate_skill, read_skill_resource, and r…

Cloudflare China-native Challenge Pages now use locally hosted Turnstile widgets

Cloudflare now serves Challenge Pages through its China Network using Turnstile widgets hosted in Mainland China, eliminating cross-border requests for visitors in China. The change is automatic for C…

Cloudflare patches eMudhra weak certificate keys after exploitation attempts

Cloudflare disclosed that eMudhra’s eight weak certificate keys (including the number 4) allowed anyone to forge certificates for any domain, posing an unprecedented risk. Cloudflare patched all high-…

Cloudflare enables per-VPC network selection for Workers VPC bindings

Cloudflare added support for selecting specific virtual networks in VPC Network bindings via a `network_id` parameter using `cf1:vnet:<UUID>`. This allows Workers to bind to multiple distinct VPCs, en…

Cloudflare Workers Builds extends build log retention to 90 days

Cloudflare Workers Builds now retains each build and its logs for 90 days, up from a shorter period, while versions and deployments remain unaffected. Builds older than 90 days are removed, but versio…

Cloudflare launches Workers Builds REST API for programmatic CI/CD

Cloudflare introduced a new REST API for its Workers Builds service, enabling programmatic triggering, management, and monitoring of builds. The API requires user-scoped API tokens, uses immutable Wor…

Cloudflare updates Workers Builds pricing and limits

Cloudflare increased Workers Builds resources for paid plans, doubling build minutes to 6,000/month and concurrent builds to 6, with additional minutes billed at $0.005. Free plans remain capped at 3,…

Cloudflare adds response_status filter to MCP tool-call analytics

Cloudflare introduced a `response_status` query parameter for MCP tool-call analytics endpoints, allowing users to filter counts by `success`, `error`, `cached`, or `all` statuses. The default is now …

Cloudflare Workers adds subdirectory routing for static assets

Cloudflare updated its Workers documentation to support serving static assets from a URL subpath using the `assets.base_path` configuration in Wrangler 4.148.0+. This allows developers to mount assets…

Cloudflare enables path prefix routing for Workers Static Assets

Cloudflare now lets Workers Static Assets serve from a custom URL path prefix (e.g., /blog) without altering directory structure. The feature is configurable via Wrangler 4.148.0+ or cloudflare.config…

Cloudflare Agents SDK adds internal hostnames for private dev server previews

Cloudflare introduced internal hostnames in its Agents SDK, allowing AI agents to preview dev servers in a browser without exposing them to the public internet. The feature enables secure, private acc…

Cloudflare released updates to its WAF managed and free rulesets to address PHP out-of-memory vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560). The changes improve detection for rem

Cloudflare achieves FedRAMP Moderate Authorization for Cloudflare for Government

Cloudflare announced FedRAMP Moderate Authorization for its Cloudflare for Government suite, enabling U.S. public sector agencies to adopt Cloudflare’s security and networking services. The authorizat…

What took the Internet offline in Q3 2026

Cloudflare’s Radar observed 49 internet disruptions in Q3 2026, primarily driven by government-directed shutdowns (19 incidents, mostly exam-related in Iraq) and power outages (14 incidents across 10 …

Introducing the Cloudflare PHP Capture the Flag challenge

Cloudflare introduced a PHP-focused Capture the Flag challenge via its Bug Bounty program on HackerOne, inviting security researchers to bypass WAF protections and exploit deliberately vulnerable PHP …

Cloudflare Workflows gains jurisdiction-based data location controls

Cloudflare added the ability to restrict Workflows instances to run and store data within specific jurisdictions (EU, US, or FedRAMP) to comply with data localization regulations like GDPR or FedRAMP.…

Cloudflare Access gains custom HTML/Liquid templates for user-facing pages

Cloudflare Access now allows fully customizable login, denial, forbidden, and command-line approval pages using HTML and Liquid templates. Users can control branding, provide request-specific instruct…

Cloudflare expands Access custom pages with HTML and Liquid templates

Cloudflare introduced customizable Access pages for sign-in, denial, and command-line approvals using HTML and Liquid templates. The feature allows administrators to tailor UI presentation without alt…

Cloudflare adds jurisdiction restrictions to Workflows for data localization compliance

Cloudflare Workflows now supports restricting instances to run and store data within specific jurisdictions (EU, US, or FedRAMP-Moderate) to comply with regulations like GDPR or FedRAMP. The jurisdict…

Cloudflare SQL API introspection adds `include_attributes` parameter

Cloudflare’s SQL API introspection endpoint now supports an `include_attributes` query parameter to discover keys in the `attributes` JSON column of datasets, replacing the deprecated `include_custom_…

Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang

Cloudflare disclosed a tenant isolation issue in its GLM-5.3 Workers AI model (affecting prompts >681,280 tokens) that caused responses to leak data from other customers' sessions between August 27 an…

Cloudflare Workers gains spanContext(), setStatus(), and updateName() tracing APIs

Cloudflare added three new OpenTelemetry-compatible tracing methods to Workers: spanContext() to expose trace and span IDs, setStatus() to mark spans as successful or failed, and updateName() to renam…

Cloudflare Computer adds durable JavaScript with recovery and approval gates

Cloudflare Computer’s @cloudflare/computer v0.7.0 introduces durable JavaScript that resumes after deploys or crashes and pauses for external approvals. Runs can replay from the start using recorded r…

Cloudflare transitions Advanced Nameservers to nameserver type in DNS API

Cloudflare is replacing the `foundation_dns: true` boolean with `nameservers.type: "cloudflare.advanced"` in its DNS settings API endpoints. The change rolls out over seven days starting October 26, 2…

Cloudflare RealtimeKit adds participant token management and presets for meetings

Cloudflare’s RealtimeKit now requires backend enrollment of participants via an Add Participant API, which issues JWT tokens for authentication. Tokens are scoped to meetings and participants, default…

Cloudflare Workers Builds updates default versions and supported tooling in build image

Cloudflare updated the default versions of runtimes and tools in its Workers Builds image, including Go 1.27.3, Node.js 24.22.1, Python 3.14.8, and Ruby 3.4.11. The image now preinstalls Node.js 22.23…

Cloudflare adds emergency WAF rules for Brotli CVE and Next.js image endpoint

Cloudflare issued an emergency update to its Managed Ruleset adding two new rules to detect Brotli-encoded request bodies (CVE-2026-111497) and Next.js image optimization traffic. Both rules default t…

Origin Range Requests: Serving large files without range-request tuning

Cloudflare introduced Origin Range Requests, a self-service feature that eliminates manual range-size tuning for large-file caching. Built on its Pingora-based cache, the feature reduces cache traffic…

Bringing post-quantum cryptography to geographically fenced key management

Cloudflare introduced a post-quantum geographically restricted key manager in closed beta, enabling customers to ensure decryption keys are only accessible in their chosen geography. This builds on Ge…

Cloudflare adds undelete capability to D1 databases

Cloudflare introduced a new API endpoint to undelete D1 databases within 7 days of deletion, restoring them with their original name unless a new name is specified. Undeleted databases count against a…

Cloudflare Workers Builds now pins npm version via packageManager

Cloudflare Workers Builds now respects the npm version specified in the packageManager field of package.json, ensuring builds use the same npm version as local development. This prevents lockfile mism…

Cloudflare D1 undelete API now limited to 7-day window

Cloudflare’s D1 undelete API now only restores databases deleted within the last 7 days, failing requests for older deletions. Users must act quickly to recover accidentally deleted databases within t…

Cloudflare rejects compromised eMudhra certificates in Workers Builds and Pages

Cloudflare updated its Workers Builds and Pages build images to reject certificates from eight compromised eMudhra intermediate CAs, which could allow forgery of any hostname in their chain. The chang…

Cloudflare Flagship adds structured evaluation context with nested objects and array operators

Cloudflare Flagship now supports nested objects, arrays, and null values in evaluation context, enabling dot-path targeting and array membership operators like 'has' and 'not_has'. This allows direct …

Cloudflare redesigns Radar homepage with interactive map and insights tabs

Cloudflare launched a redesigned homepage for its Radar product on October 23, 2026, featuring an interactive global map of internet traffic and outages, a curated insights section with tabbed navigat…

Localizing compliance at scale: achieving South Korea’s ISMS certification

Cloudflare obtained South Korea’s ISMS certification under the ISMS-P framework after a 10-day audit by KISA, covering 80 controls aligned with Korean law and data protection regulations. The certific…

Cloudflare launches Granular Tunnel Read And Monitor role

Cloudflare introduced a new 'Granular Tunnel Read And Monitor' role that allows delegating read access and log streaming for specific Cloudflare Tunnels without granting write permissions or account-w…

Cloudflare updates Free Ruleset WAF to address CVEs 2026-109618 and 2026-109619

Cloudflare issued an emergency update to seven rules in its Free Ruleset to address CVEs 2026-109618 and 2026-109619, refining rule metadata and descriptions while keeping detection logic and actions …

Cloudflare Tunnel adds URL normalization in cloudflared 2026.10.0

Cloudflare Tunnel now supports URL normalization starting with cloudflared 2026.10.0, improving security for ingress rules requiring Access validation. The feature is off by default but will be enable…

Cloudflare retires /sse endpoint for MCP servers

Cloudflare’s product-specific MCP servers now serve only the `/mcp` endpoint, retiring `/sse` which returns a `410 Gone` error. Clients using `/sse` must update to `/mcp`; existing `/mcp` connections …

Cloudflare Agents SDK v0.30.0 adds Pi 1.4 support with hibernation and crash recovery

Cloudflare’s Agents SDK v0.30.0 now supports Pi 1.4, enabling Durable Objects to hibernate during task sleep cycles and recover more reliably from crashes and storage errors. The update introduces par…

Cloudflare Sandbox SDK 0.12.14 patches eMudhra certificate trust issue

Cloudflare released Sandbox SDK 0.12.14 to address a critical security flaw where images before 0.12.14 trusted compromised eMudhra intermediate CAs, enabling certificate forgery. Users must update im…

Cloudflare One macOS client adds Global Acceleration, MTU handling, and TLS inspection support

Cloudflare released a beta update (v2026.9.1555.1) for its macOS Cloudflare One Client, raising the minimum macOS version to 15.0 and introducing automatic endpoint selection for Global Acceleration. …

Cloudflare One Client for Windows adds Global Acceleration, anti-tampering, and MTU handling

Cloudflare released a beta update for its Windows Cloudflare One Client (v2026.9.1555.1) introducing automatic endpoint selection for Global Acceleration, anti-tampering protections requiring admin co…

Cloudflare emergency WAF update addresses CVE-2026-109618 and CVE-2026-109619

Cloudflare issued an emergency update to its Managed Ruleset to refine metadata for seven existing rules targeting PHP Remote Code Execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Dete…

Cloudflare One Client - Cloudflare One Client for Windows (version 2026.7.1384.0)

Cloudflare released the general availability version 2026.7.1384.0 of its Windows client for Cloudflare One, addressing a critical issue with trusted certificate chain building. The update is now avai…

Cloudflare One Client - Cloudflare One Client for macOS (version 2026.7.1384.0)

Cloudflare announced the general availability of version 2026.7.1384.0 of its macOS Cloudflare One Client, now available on the stable releases downloads page. The update fixes an issue with building …

Cloudflare WAF gains full transaction detection and response rules

Cloudflare introduced full transaction detection for its WAF, correlating HTTP requests with responses to identify successful exploits, data exposure, and misconfigurations. New response rules can blo…

How Commerce.com and Cloudflare are getting storefronts ready for AI agents

Cloudflare and Commerce.com launched an edge-level implementation of WebMCP, a Google-proposed browser standard, to enable AI agents to interact with storefronts more efficiently. Cloudflare injects a…

Cloudflare Free Ruleset emergency WAF update adds anomalous execution blocking rules

Cloudflare issued an emergency update to its Free Ruleset WAF on October 21, 2026, adding four new rules to block anomalous request patterns under the 'Generic Rules - Anomalous Execution' category. A…

Cloudflare deploys WAF protections against php2shell PHP vulnerabilities

Cloudflare deployed default WAF protections against two critical PHP vulnerabilities (php2shell) affecting PHP 5.4+ before public disclosure, shielding all WAF customers (including Free tier) starting…

Cloudflare launches createAI to unify AI providers in Agents SDK

Cloudflare introduced a new `createAI` function in its Agents SDK to consolidate functionality previously handled by `workers-ai-provider` and `ai-gateway-provider`, which are now deprecated. The unif…

Cloudflare Basin SQL adds OFFSET for paginated queries

Cloudflare’s Basin SQL now supports the OFFSET clause, enabling paginated query results by skipping rows with a specified offset. Users can combine OFFSET with LIMIT and ORDER BY to retrieve specific …

Cloudflare adds four emergency WAF rules to block anomalous execution patterns

Cloudflare issued an emergency update to its Managed Ruleset on October 21, 2026, adding four new rules to detect and block anomalous request execution patterns. Two of the rules log matches without b…

8 eMudhra certificates are compromised. Here's what you need to know

Cloudflare disclosed that private keys for eight eMudhra intermediate certificates were compromised on October 19, 2026, enabling potential forgery of any domain's certificate. Cloudflare immediately …

Cloudflare launches DeepSeek-V4.1-Flash multimodal model on Workers AI

Cloudflare introduced DeepSeek-V4.1-Flash, a 552B-parameter multimodal Mixture-of-Experts model supporting up to 1M token contexts, on its Workers AI platform. The model processes images and text nati…

Cloudflare One Client - Cloudflare One Client for Windows (version 2026.8.2115.0)

Cloudflare announced the general availability of Cloudflare One Client for Windows (version 2026.8.2115.0), addressing a critical issue with trusted certificate chain building. The update is available…

Cloudflare One Client - Cloudflare One Client for macOS (version 2026.8.2115.0)

Cloudflare released the general availability version 2026.8.2115.0 of its Cloudflare One Client for macOS, addressing a critical issue with building trusted certificate chains. The update is available…

Cloudflare One Client - Cloudflare One Client for Linux (version 2026.8.2115.0)

Cloudflare released a general availability version (2026.8.2115.0) of its Cloudflare One Client for Linux, addressing a critical issue with building trusted certificate chains. The update is now avail…

Cloudflare launches Agent Skills framework for AI agents

Cloudflare introduced Agent Skills, a framework enabling agents to dynamically load on-demand instructions, resources, and scripts only when a task matches. The system uses a skill registry and tools …

Cloudflare Agents and Think switch to @cloudflare/computer workspace

Cloudflare’s Think agents and Agent Skills now use the @cloudflare/computer workspace and filesystem tools, replacing the deprecated @cloudflare/shell. A JavaScript execution environment can be config…

Cloudflare Workers now upload source maps by default in Wrangler 4.150.0 and cf

Starting October 20, 2026, Cloudflare’s Wrangler CLI (v4.150.0+) and the `cf` tool upload source maps by default during Worker deployments, eliminating the need for manual configuration. Stack traces …

Cloudflare Workers now uploads source maps by default for better debugging

Cloudflare Workers now automatically uploads source maps by default starting with Wrangler 4.150.0, enabling stack traces to show original file names and line numbers without configuration. Earlier ve…

Cloudflare updates Challenge Pages with Managed and Interactive options

Cloudflare introduced updated Challenge Pages that act as full-page interstitial screens to verify visitors before they reach a destination site. The update formalizes Managed Challenges (dynamic, CAP…

Cutting our inference bill by 68% by being obsessive about optimization

Cloudflare reduced the cost of its AI code reviewer by 68%—from $2.46 to $0.77 per review—by optimizing token usage, prompt caching, and model selection. Key changes included splitting shared system p…

Cloudflare launches Clairic AI model for structured data extraction in Workers AI

Cloudflare introduced Clairic, a System One-style AI model in preview for its Workers AI platform, designed to extract, compute, estimate, and forecast values from unstructured text with strong typing…

Cloudflare launches Clairic, a System One extraction model on Workers AI

Cloudflare introduced Clairic, the first System One extraction model, available as `@cf/cloudflare/clairic` on Workers AI. Clairic extracts, computes, estimates, and forecasts values from unstructured…

Cloudflare API MCP server adds step-up authorization for granular access control

Cloudflare’s API MCP server now supports step-up authorization, allowing users to grant minimal scopes initially and approve additional permissions on demand during agent tasks. The feature is availab…

Cloudflare launches Cloud Workload Security proxy to block public R2 bucket access

Cloudflare introduced a new Cloud Workload Security (CWS) proxy that runs locally to enforce policies preventing R2 buckets from being made public. The feature requires a Zero Trust subscription and u…

Cloudflare Workers AI adds extraction models for structured data processing

Cloudflare introduced extraction models in Workers AI to convert unstructured text into typed, application-usable values like amounts, dates, or durations. These models support extraction, computation…

Cloudflare adds DeepSeek V4.1 Flash 1017 to Workers AI with vision and 1M token context

Cloudflare launched DeepSeek V4.1 Flash 1017 on Workers AI, a multimodal MoE model with vision, reasoning, function calling, and a 1,048,576 token context window. The model is optimized for agentic wo…

Cloudflare launches Clairic extraction model on Workers AI

Cloudflare introduced Clairic, a new extraction model on Workers AI that returns typed values (numbers, dates, text spans, lists, estimates, forecasts) with confidence scores in a single pass. The mod…

Cloudflare launches structured JSON context for Flagship Evaluation API

Cloudflare updated its Flagship Evaluation API to support structured JSON context via POST requests, enabling nested objects, arrays, and null values for feature flag evaluations. Previously limited t…

Cloudflare launches Realtime with RealtimeKit and Realtime SFU for live applications

Cloudflare introduced Cloudflare Realtime, a platform enabling live audio, video, and data applications over its global network. It includes RealtimeKit for prebuilt meeting UI and SDKs, and Realtime …

Cloudflare RealtimeKit Core SDK gains advanced initialization and configuration options

Cloudflare updated its RealtimeKit Core SDK documentation to provide developers with full control over video call initialization and configuration. The update introduces new SDK initialization methods…

Cloud Workload Security - Cloud Workload Security is now available in Beta

Cloudflare introduced Cloud Workload Security (CWS) in beta, allowing users to apply policy controls to cloud API requests before they reach their cloud provider. Policies can be defined using request…

Bots - Precursor adds Monitor mode

Cloudflare introduced Monitor mode in Precursor, allowing customers to test detections without impacting bot scores or Challenge clearance. The feature separates Precursor Interstitial controls, enabl…

Cloudflare adds Cron Trigger testing to Local Explorer for Workers

Cloudflare’s Local Explorer now lets developers invoke configured or ad-hoc Cron Triggers with custom scheduled times during local development, eliminating the need to construct request URLs. The feat…

Cloudflare helps BAFTA bring public voting in-house with Workers and R2

BAFTA migrated its public voting system in-house using Cloudflare Workers, Durable Objects, R2, KV, and Logpush to handle unpredictable traffic spikes while reducing costs to tens of dollars per milli…

Caliente.mx case study: Cloudflare cuts latency 56% and secures betting platform

Caliente.mx, Mexico’s leading online gambling company, consolidated its infrastructure onto Cloudflare’s platform to reduce latency by 56%, improve security with API Shield and WAF, and eliminate outa…

Cloudflare introduces continuous accountability system for Verified Bots

Cloudflare launched a system to continuously evaluate whether Verified Bots honor site preferences like robots.txt and HTTP 429 responses, ensuring sustained accountability beyond initial identity ver…

Cloudflare removed 2 pricing tiers

Pricing updated for Cloudflare: - Removed: Business tier - Removed: Pay-as-you-go tier

Cloudflare Tunnel, Cloudflare Tunnel for SASE, Cloudflare Mesh, Cloudflare One - 50,000 routes per account and Tunnels for Platforms

Cloudflare increased the default route limit for Cloudflare Tunnel and Mesh from 1,000 to 50,000 per account, enabling massive scalability for large deployments. Additionally, Cloudflare introduced Tu…

Cloudflare Tunnels for Platforms scales tunnels to 1,000+ per account with new pricing

Cloudflare introduced Tunnels for Platforms, allowing up to 1,000 tunnels per account at no cost, with additional tunnels priced at $4.50/month. The feature supports per-device, per-customer, or per-e…

AI Search - AI Search keyword search supports Japanese, Chinese, and Korean queries

Cloudflare’s AI Search now supports Japanese, Chinese, and Korean queries via a trigram tokenizer, enabling natural-language searches like '経費精算の締め日はいつですか？'. Previously, such queries were treated as s…

Workers, Cloudflare CLI - Search Cloudflare documentation with the Cloudflare CLI

Cloudflare CLI v1.0.0-beta.16 introduces a built-in docs search feature, allowing users and coding agents to query Cloudflare documentation directly from the terminal. The search returns ranked JSON r…

Cloudflare launches Precursor for continuous session-based bot detection

Cloudflare introduced Precursor, a client-side verification system that continuously evaluates visitor behavior across entire sessions rather than single requests. It replaces JavaScript Detections (J…

Cloudflare launches PhoneLLM Mini Alpha 2 for voice agents on Workers AI

Cloudflare introduced PhoneLLM Mini Alpha 2, an open model tuned for voice agents and hosted on Workers AI. Based on Nemotron Nano 30B, the model supports function calling and offers a 262,140-token c…

A fully programmable secure web gateway

Cloudflare introduced true programmability to its Gateway and DLP solutions by integrating them with its edge compute platform, enabling customers to run custom code inline during policy evaluation. T…

Deploy with Void

Cloudflare open-sourced Void, a suite of tools (Void Platform, SDK, CLI) that unify frontend and backend development for Cloudflare Workers. Void enables zero-config infrastructure provisioning, type-…

Cloudflare Workers and Pages GitHub picker now shows only accessible repositories

Cloudflare updated its GitHub repository picker for Workers Builds and Pages to display only repositories accessible to the authenticated GitHub user, improving security and usability. Existing connec…

Cloudflare Workers adds Git integration for automated builds and deployments

Cloudflare introduced a Git integration for Workers that automates builds and deployments when code is pushed to Artifacts, GitHub, or GitLab repositories. The feature supports both new and existing W…

Cloudflare launches RealtimeKit SDK for real-time meetings across web, mobile, and native platforms

Cloudflare introduced RealtimeKit, a new SDK enabling real-time audio/video meetings and collaboration features. The launch includes API token setup, multi-platform SDKs (React, Angular, Android, iOS,…

Cloudflare adds custom DLP match validation via Workers

Cloudflare now lets organizations use Cloudflare Workers to adjust confidence levels or reject matches for custom DLP pattern entries. This enables organization-specific validation logic for data loss…

Cloudflare Pages adds GitHub integration for automated deployments and preview URLs

Cloudflare Pages now supports a native GitHub integration enabling automatic deployments, unique preview URLs for pull requests, and GitHub check runs for build status. Users can skip builds via commi…

Cloudflare releases Gateway Worker templates for capture, watermarking, and redaction

Cloudflare added seven new Worker templates to its Zero Trust Gateway Forward action, enabling tasks like Slack notifications, screenshot capture, file download capture, HTML watermarking, JSON archiv…

Cloudflare launches Gateway Forward action for Workers in public beta

Cloudflare introduced the Gateway Forward action in public beta, allowing Workers to process permitted HTTP traffic before it reaches its destination. This enables request/response transformations and…

Cloudflare expands Gateway Forward action context for Workers with identity and device posture

Cloudflare updated its Gateway Forward action documentation to expose request metadata, user identity, and device posture context to Workers via the `@cloudflare/zt-types` package (v2026.10.1+). The `…

Cloudflare Gateway integrates with Workers in public beta

Cloudflare launched a public beta integrating Gateway HTTP traffic with Cloudflare Workers using a new Forward policy action on all Zero Trust plans. The integration lets teams run custom code on perm…

Cloudflare integrates Workers with DLP for custom match validation

Cloudflare now allows DLP pattern matches to trigger Cloudflare Workers, enabling organizations to adjust confidence scores or reject matches via custom validation logic. Users can deploy a Worker wit…

Cloudflare launches GitHub integration for Workers with automated CI/CD

Cloudflare introduced a GitHub integration for its Workers platform that automatically deploys code on every push and provides real-time build status updates directly in GitHub. Developers receive pul…

Cloudflare adds Pipecat PhoneLLM Mini Alpha 2 to Workers AI

Cloudflare integrated Pipecat’s PhoneLLM Mini Alpha 2, a fast voice-agent model post-trained from NVIDIA Nemotron, into its Workers AI platform. The model enables real-time, multi-turn voice interacti…

Cloudflare adds custom applications to Application Library for Gateway policies

Cloudflare now lets users create custom applications in the Application Library, defined by hostnames, IP subnets, or ports, and reference them in Gateway DNS, Network, and HTTP policies. The update a…

Cloudflare Stream launches WebRTC-based ultra-low latency live streaming

Cloudflare Stream now supports WebRTC for sub-second latency live streaming and playback using WHIP and WHEP protocols, available globally since October 15, 2026. The feature enables real-time experie…

Cloudflare Stream WebRTC goes GA with ultra-low latency live streaming

Cloudflare announced general availability of WebRTC live streaming in Stream, enabling creators to broadcast to thousands of viewers in milliseconds directly from a browser without separate software. …

Cloudflare Gateway expands custom application matching and app type taxonomy

Cloudflare updated Gateway’s application controls to support more granular custom application matching, including hostname/IP subnet/port protocol combinations and support hostnames for dependencies. …

Cloudflare enhances Application Library with confidence scorecards and review workflows

Cloudflare updated its Application Library in Cloudflare One to include automated confidence scorecards for AI and SaaS applications, providing Application Posture and Generative AI Posture scores bas…

Cloudflare enables custom application management in App Library for Gateway policies

Cloudflare introduced expanded custom application functionality in its App Library, allowing users to create, edit, and delete custom applications for use in DNS, HTTP, and Network Gateway policies. C…

Cloudflare adds BGP route filtering for IPsec and GRE tunnels

Cloudflare WAN and Magic Transit now support BGP import and export filtering for IPsec and GRE tunnels, enabling reusable allow/deny profiles with CIDR matching. Changes apply without resetting BGP se…

Yandex outage: Data shows that instead of going dark, malicious bots went on the move

Cloudflare’s Radar and Bot Management data showed Yandex’s network outage (Oct 7–13) disrupted its own bot traffic but did not reduce global malicious automation. Malicious bots migrated to other Russ…

Cloudflare Hyperdrive MySQL support now generally available

Cloudflare announced general availability of MySQL support for Hyperdrive, its distributed database connection pooler for Workers. The update includes 20 bug fixes addressing rare protocol issues, suc…

DNS - Configure Advanced Custom Nameservers with nameserver sets (beta)

Cloudflare introduced nameserver sets in beta for Enterprise accounts, allowing groups of 2–5 custom nameservers with Cloudflare-assigned IPs to be assigned to zones within the same account. This mode…

Cloudflare adds configurable session duration for infrastructure applications

Cloudflare now allows configurable session durations for infrastructure applications in Cloudflare One, defaulting to 24 hours. Previously, sessions could persist beyond 24 hours but were never guaran…

Cloudflare adds trim functions to Rules expressions

Cloudflare introduced three new trim functions—trim(), trim_start(), and trim_end()—for its Rules engine to remove surrounding bytes (default ASCII whitespace or custom bytes) from request values. All…

Cloudflare emergency WAF update blocks critical RCE vulnerability

Cloudflare deployed an emergency update to its WAF managed ruleset to block active exploitation of a critical remote code execution vulnerability in popular web frameworks. The new rule blocks arbitra…

Cloudflare adds account_id to Access deny redirect URLs

Cloudflare’s Access deny redirects now include an `account_id` query parameter in app-aware deny flows, enabling custom block pages to identify the owning account via the `kid` parameter. This support…

Cloudflare Foundation DNS rolls out advanced nameservers with improved resiliency

Cloudflare introduced advanced nameservers for Foundation DNS, featuring three anycast network groups for improved resiliency and consistent assignment. Enterprise customers can now use custom nameser…

Cloudflare updates default tooling versions for Workers Builds

Cloudflare updated the default versions of supported runtimes and package managers in Workers Builds, including Node.js 24.18.0→24.21.0, Bun 1.2.15→1.4.3, Python 3.13.3→3.14.8, and others. Projects sp…

Cloudflare launches nameserver sets for Enterprise DNS

Cloudflare introduced nameserver sets, an account-level feature allowing Enterprise customers to create and manage custom nameserver configurations via API. Sets support 2–5 nameservers with IPv4/IPv6…

Under the hood, off the hot path: How D1 scales to millions of databases

Cloudflare’s D1 serverless database, built on SQLite, achieved 15x growth in live databases and 18x in daily active databases over the past year. To handle this scale, Cloudflare redesigned the D1 con…

Cloudflare adds cf.worker.upstream_zone field to Workers runtime

Cloudflare introduced the `cf.worker.upstream_zone` field in the Workers runtime to identify whether a request originates from a Worker and, if so, the zone name associated with it. This field is empt…

Rewinding the exponential: How we keep hardware usage down

Cloudflare’s Data team reduced hardware expansion needs by 2.5 years through pipeline optimizations, including schema fragmentation (2022), zstd compression (2024), and decentralized sampling (2026). …

Cloudflare Audit Logs v2 now captures view actions

Cloudflare’s Audit Logs v2 now records view actions (GET requests) for supported endpoints, enhancing visibility into read activity across products. These logs are available via API, Logpush, and dash…

Cloudflare Web Analytics - Deeper Core Web Vitals Diagnostics: LCP & INP Sub-Part Metrics in Real User Monitoring

Cloudflare Web Analytics now breaks down Largest Contentful Paint (LCP) and Interaction to Next Paint (INP) into sub-part metrics within Real User Monitoring (RUM), enabling granular diagnostics of pa…

Cloudflare Workers subrequests targeting BYOIP-backed hostnames now preserve original client context and the CF-Worker header, fixing security rule inconsistencies and Bot Management evaluations. Prev

Cloudflare adds DNS64 support to Gateway with EDNS and location-based controls

Cloudflare introduced DNS64 synthesis in Gateway, allowing IPv6-only networks to resolve IPv4-only domains by converting A records to AAAA records. Admins can enable it per DNS location or via EDNS op…

Cloudflare adds persistent browser tool to Agents SDK with tab and login retention

Cloudflare introduced a persistent `browserTool` in its Agents SDK that allows agents to retain the same browser session with tabs, cookies, and logins intact across turns. The tool integrates with Pi…

Cloudflare API MCP server now streams Workers Issues as real-time events

Cloudflare’s API MCP server now streams Workers Issues as MCP Events, enabling real-time alerts for production failures without polling. MCP clients can subscribe to `cloudflare.alert.workers_observab…

Cloudflare Queues API adds jurisdiction controls and consumer settings

Cloudflare updated its Queues API to allow specifying jurisdiction (EU, US, or FedRAMP) when creating a queue and introduced configurable consumer settings like batch size, max concurrency, and retry …

OpenCode integrates with Cloudflare Durable Objects via @opencode/sdk/workerd

OpenCode’s SDK now supports running inside Cloudflare Durable Objects using the `@opencode/sdk/workerd` package, leveraging Durable Object storage and Workerd runtime. The integration enables persiste…

Filter, reshape, and redact logs before export with Transformers

Cloudflare introduced Transformers for Logpush, enabling teams to filter, reshape, and redact logs before export using SQL queries. This eliminates the need for separate processing services, reducing …

Cloudflare adds web_search tool for AI agents via Web Search API

Cloudflare introduced a new 'web_search' tool for AI agents, enabling real-time web searches through the Cloudflare Web Search API via AI Gateway. The tool integrates with Pi Durable, AI SDK, TanStack…

Cloudflare launches web fetch tool for AI agents with document conversion and pagination

Cloudflare introduced a new `web_fetch` tool for AI agents that converts webpages, PDFs, and Office documents into Markdown, supports pagination for long pages, and enforces request controls like host…

Cloudflare WAF adds detections for TanStack XSS and Atlassian file access CVEs

Cloudflare’s October 12, 2026 WAF release introduces new detections for CVE-2026-102989 (TanStack reflected XSS) and CVE-2026-21589 (Atlassian arbitrary file access), both now set to Block in managed …

Cloudflare adds on-demand API Shield schema learning

Cloudflare introduced the ability to manually trigger zone-wide API Shield schema learning runs instead of waiting for the weekly schedule. Users can now initiate learning via the Web Assets > Operati…

Cloudflare enables granular private IP/CIDR routing in Zero Trust via cloudflared

Cloudflare updated its Zero Trust documentation to detail how organizations can securely route private IP/CIDR ranges (e.g., 10.0.0.0/8) through cloudflared tunnels using the Cloudflare One Client. Th…

Cloudflare launches Issues for Workers with built-in error monitoring and automations

Cloudflare introduced 'Issues,' a built-in error monitoring tool for Cloudflare Workers that detects, groups, and investigates recurring failures without requiring an SDK or application wrapper. The f…

Cloudflare adds WebSocket Hibernation API for Durable Objects

Cloudflare introduced a WebSocket Hibernation API for Durable Objects and Workers, significantly reducing duration charges for WebSocket server applications by allowing Durable Objects to hibernate du…

Cloudflare adds outbound Worker routing to Browser Run for private services

Cloudflare introduced outbound Worker routing in Browser Run, allowing selected browser requests to be processed through another Worker for private services, authentication, or response transformation…

Cloudflare Queues adds EU, US, and FedRAMP jurisdiction support

Cloudflare Queues now allows users to create queues restricted to specific jurisdictions (EU, US, or FedRAMP-Moderate), ensuring message storage and processing occurs only within the chosen region. Th…

Cloudflare unifies Zero Trust and main dashboard navigation

Cloudflare merged Zero Trust and main dashboard navigation into a single interface, allowing all customers to access Zero Trust products and other services like developer platform and resource tagging…

Cloudflare One Client for Linux reaches general availability

Cloudflare released the general availability version 2026.8.2110.0 of its Cloudflare One Client for Linux, resolving a critical split-tunnel reconnection bug. The client is now available on the stable…

Cloudflare One Client for macOS reaches GA with split-tunnel fix

Cloudflare released GA version 2026.8.2110.0 of its macOS Cloudflare One Client, resolving a critical split-tunnel issue causing repeated disconnections. The update is available on the stable releases…

Cloudflare adds user risk scoring to Zero Trust with Okta integration

Cloudflare introduced user risk scoring in its Zero Trust platform, assigning Low/Medium/High scores based on detected risky behaviors like impossible travel, DLP triggers, or malicious file interacti…

Cloudflare adds web_search tool to Agents SDK with Cloudflare Web Search API

Cloudflare introduced a new `web_search` tool in its Agents SDK, enabling agents to perform web searches via the Cloudflare Web Search API. The tool supports adapters for Pi Durable, AI SDK, and TanSt…

Cloudflare integrates OpenCode 2.0 with Durable Objects and Workers AI

Cloudflare released OpenCode 2.0 as an extensible agent harness running inside a Durable Object, powered by Workers AI models and bundled plugins. The integration enables durable sessions, interrupted…

Cloudflare adds OpenCode 2.0 harness to Agents SDK with Workers AI integration

Cloudflare introduced an experimental OpenCodeHarness in its Agents SDK, enabling OpenCode 2.0 to run within a Durable Object with Workers AI models and durable sessions. The feature leverages SQLite …

Cloudflare One Client for Windows (v2026.8.2110.0) reaches GA with split-tunnel fix

Cloudflare released GA version 2026.8.2110.0 of its Windows Cloudflare One Client, resolving a bug where the client repeatedly disconnected under hostname-based split tunnel configurations. The update…

Cloudflare adds document conversion and pagination to Agents SDK web_fetch tool

Cloudflare’s Agents SDK 0.28.0 beta introduces a web_fetch tool that reads HTML, PDF, and Office documents via Workers AI Markdown Conversion, returning Markdown or JSON. It supports pagination for lo…

Cloudflare launches MCP server to serve Cloudflare skills

Cloudflare introduced an MCP server that exposes Cloudflare skills via the Skills over MCP extension, enabling MCP clients to discover and use skills through a standardized protocol. Users can add the…

Cloudflare launches clef-omni, a multimodal decision model on Workers AI

Cloudflare introduced clef-omni, a 30B-parameter mixture-of-experts model (3B active) designed to turn structured questions and state inputs into probabilistic decisions. The model processes text, JSO…

Introducing Clef-omni with full multimodality, plus a faster Clef and a cheaper Clef-flash

Cloudflare introduced Clef-omni, a multimodal decision model supporting audio, video, image, and text inputs, alongside faster and cheaper versions of Clef and Clef-flash. Clef-omni leverages a Qwen3-…

Introducing on-demand CPU and memory profiling with flamegraphs for Workers and Durable Objects

Cloudflare introduced on-demand CPU and memory profiling for Workers and Durable Objects via the Workers Observability page, enabling interactive flamegraph analysis and profile downloads. Users can t…

Deno is joining Cloudflare

Cloudflare announced the acquisition of the Deno team to streamline self-hosting of Workers and Durable Objects, enabling developers to use the same primitives across more environments. The move aims …

Cloudflare adds cf.appsec.request.failed_detections field for security rule customization

Cloudflare introduced a new field, cf.appsec.request.failed_detections, which lists IDs of security detections that reported failures for a request. This allows users to act on detection failures in c…

WAF, Rules - Failed detections field available in Rules

Cloudflare introduced a new `cf.appsec.request.failed_detections` field in WAF and Rules to manage requests flagged by failed security detections, including content scanning, attack signatures, leaked…

Cloudflare improves Markdown for Agents with in-process streaming conversion

Cloudflare’s Markdown for Agents now converts HTML using an in-process streaming engine at the edge, reducing overhead and memory use. The update increases the supported HTML size limit from 2 MiB to …

Cloudflare improves HTTP/3 client cancellation reporting with consistent 499 tracking

Cloudflare now consistently handles and reports HTTP/3 client cancellations as 499 status codes across all plans, stopping affected requests sooner and reducing unnecessary origin work. Customers will…

Cloudflare adds R2 bandwidth-by-location analytics

Cloudflare introduced a new R2 bandwidth analytics feature in its UI, allowing users to view bandwidth consumption by Cloudflare edge location for read/write operations. The tool shows the top five lo…

Cloudflare launches Clef-omni with audio/video input, cuts Clef-flash price, speeds up Clef

Cloudflare introduced Clef-omni, a multimodal decision model on Workers AI that accepts text, images, audio, and video inputs, enabling unified reasoning over mixed media. Clef-flash pricing dropped t…

Cloudflare adds unsafe topic categories for LLM prompt detection in AI Security for Apps

Cloudflare expanded its AI Security for Apps feature with six new unsafe topic categories for LLM prompt detection, including violence, non-violent crime, sexual content, child safety, hate/discrimina…

Bridging technical depth and usability: The story behind Radar’s redesign

Cloudflare revamped Radar, its real-time global Internet trends tool, to make it more accessible to non-technical users like journalists and policymakers while preserving depth for experts. The redesi…

Cloudflare Q3 2026 DDoS Threat Report: Short-burst attacks surge 208%, CLDAP collapses 99.5%

Cloudflare mitigated 8,226 DDoS attacks per hour in Q3 2026, with short-burst, low-bandwidth attacks (under 10 minutes and 1 Gbps) surging 208% while hyper-volumetric attacks (>1 Tbps) dropped 69%. CL…

Cloudflare Workflows gains batch instance creation with per-instance error reporting

Cloudflare Workflows’ `createBatch()` method now accepts an options object to create up to 100 instances in one call, either by count or from a list, with detailed per-instance error reporting. The ar…

Cloudflare launches Web Bot Auth for cryptographic bot verification

Cloudflare introduced Web Bot Auth, a method to verify automated bot identity via cryptographic HTTP message signatures using Ed25519 keys. Bots must host a key directory at `/.well-known/http-message…

Building an evidence-grounded agentic security operations harness on Cloudflare

Cloudflare introduced an AI agent-based security operations harness for its Managed Defense service, designed to automate evidence gathering, alert correlation, and triage at scale. The system uses mu…

Cloudflare updates Organizations limitations with new account and API constraints

Cloudflare published updated limitations for its Organizations feature, capping Enterprise and MSSP/Distributor Organizations at 20,000 accounts and 200,000 zones. User API Tokens cannot fully manage …

Cloudflare One Client for macOS (v2026.8.2100.0) reaches GA with split-tunnel and DNS fixes

Cloudflare released GA version 2026.8.2100.0 of its macOS Cloudflare One Client, addressing split-tunnel reconnection issues, improving DNS reliability on low-MTU networks, and reducing memory usage. …

Cloudflare moves Log Explorer datasets into Observability Logs page

Cloudflare has consolidated Log Explorer datasets into the Logs page under Observability in the dashboard, replacing the standalone Log Explorer menu. Users now query datasets from a unified interface…

Cloudflare Organizations now generally available for Enterprise and partners

Cloudflare Organizations has reached general availability, offering a top-level container for centralized management of accounts, members, analytics, and shared policies. Enterprise customers gain sin…

Cloudflare One Client for Linux reaches GA with split-tunnel and DNS improvements

Cloudflare announced the general availability of its Cloudflare One Client for Linux (version 2026.8.2100.0), ending the beta phase. The release improves split-tunnel reliability, adds support for rou…

Cloudflare One Client for Windows reaches GA with reliability and performance improvements

Cloudflare released the general availability version 2026.8.2100.0 of its Cloudflare One Client for Windows, addressing critical reliability and performance issues. Key fixes include stable split-tunn…

Cloudflare updates unsafe topic detection for AI Security for Apps

Cloudflare updated the unsafe topic categories in AI Security for Apps, changing the values available in `cf.llm.prompt.unsafe_topic_categories`. Existing WAF custom rules remain valid, but those refe…

The keys to the Internet change on October 11. Are you ready?

On October 11, 2026, the DNS root will switch to a new key-signing key (KSK-2024) for DNSSEC, replacing KSK-2017. Cloudflare’s 1.1.1.1 resolver and Gateway DNS already trust the new key, but DNSSEC-va…

Cloudflare adds DNS records quota warnings at 85% usage

Cloudflare’s DNS records page now displays a warning when users reach 85% of their DNS records quota, helping prevent service disruptions. The warning adapts to either zone-level or account-level quot…

Cloudflare CASB adds custom finding types with Rego for tailored security detections

Cloudflare CASB now allows customers to define custom security finding types using Rego expressions, enabling tailored detection logic for SaaS and cloud app risks. Unlike standard predefined findings…

Cloudflare WAF adds F5 BIG-IP buffer overflow detection and merges command injection rules

Cloudflare’s October 6, 2026 WAF release introduces a new rule to block a heap-based buffer overflow vulnerability in F5 BIG-IP (CVE-2026-94127) and promotes a beta command injection protection to the…

Cloudflare standardizes AI Gateway provider credential error responses

Cloudflare’s AI Gateway REST API now returns consistent HTTP 401 responses with error code 2009 for provider credential rejections, replacing provider-specific status codes. This change affects Eleven…

One year later: the power of 1.1.1.1 interns

Cloudflare hired 750 interns across 48 teams in 2025, aiming for 1,111 in 2026, leveraging AI to accelerate early-career impact. Interns shipped real products like Cache Transcoding, EmDash CMS improv…

Everything we launched during Birthday Week 2026

Cloudflare marked its 16th birthday by unveiling 46 new features across open-source tools, security, developer platforms, and monetization. Key highlights include the agentic CLI (cf), a post-quantum …

Cloudflare launches BGP over IPsec and GRE tunnels for production workloads

Cloudflare announced general availability of BGP peering over IPsec and GRE tunnels for Cloudflare WAN and Magic Transit, enabling dynamic route exchanges without manual static route updates. The feat…

Cloudflare CASB adds custom finding types with Rego for tailored security detection

Cloudflare CASB now lets security teams write custom detection logic using Rego to define organization-specific security conditions across SaaS and cloud integrations. The feature enables tailored fin…

Streamline: custom video pipelines with Cloudflare Stream and Workers

Cloudflare introduced Streamline, a developer playground enabling custom video processing pipelines on its platform. The tool leverages Workers for control signaling, Containers for long-running media…