# Cloudflare Blog Technical deep dives, product updates, and insights from the teams that are helping to build a better Internet. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts DevFeed: [When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts]() Original publisher: [Read original article]() Author: Denzil Correa Published: 2026-09-16T20:06:17Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Cloudflare](), [Machine Learning, Security Attacks](), [Security](), [JavaScript]() Tags: [ai](), [application-security](), [attacks](), [client-side-security](), [cloudflare](), [cybersecurity](), [developer-platform](), [developers](), [ecommerce](), [javascript](), [machine-learning](), [malicious-javascript](), [page-shield](), [security](), [security-research](), [virustotal](), [workers-ai]() ### AI overview Cloudflare describes how its Client-Side Security machine learning model detected four malicious JavaScript operations involving eight payloads in live storefront traffic. The post says humans verified the findings after automated detection, while most payloads were absent from VirusTotal and received no malicious verdict from URLScan. ### Source excerpt A modern storefront can look healthy while malicious JavaScript quietly siphons revenue, hijacks clicks, or rewrites analytics. See how Cloudflare's machine learning models surface evasive client-side attacks for analyst investigation. ## Cloudflare adds controls to allow search indexing while disallowing AI training DevFeed: [Cloudflare adds controls to allow search indexing while disallowing AI training]() Original publisher: [Read original article]() Author: Bryan Becker Published: 2026-09-15T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Cloudflare](), [Artificial Intelligence](), [Crawler](), [Google](), [Microsoft]() Tags: [ai](), [ai-bots](), [blocking](), [bot-management](), [bots](), [cloudflare](), [content](), [google](), [internet](), [microsoft](), [network-services](), [product-news](), [search](), [security]() ### AI overview Cloudflare announces a Disallow AI Training setting that lets website owners remain indexed in search while refusing AI training by mixed-use crawlers. Apple, Google, and Microsoft honor or have committed to honor the setting. ### Source excerpt Cloudflare is giving site owners a way to stay discoverable while disallowing AI training. New controls and an Accountable designation establish a shared model with Apple, Google, and Microsoft. ## Give every teammate and agent the right level of access to your Workers DevFeed: [Give every teammate and agent the right level of access to your Workers]() Original publisher: [Read original article]() Author: Visal In Published: 2026-09-15T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Workers](), [Authorization](), [Developer Platform](), [debug]() Tags: [agent](), [api](), [cloudflare](), [debug](), [developer](), [developer-platform](), [developers](), [identity](), [least-privilege](), [logs](), [metrics](), [monitor](), [product-news](), [scope](), [security](), [traces](), [workers](), [workflows]() ### AI overview Cloudflare now lets teams scope access to individual Workers and assign narrower Developer Platform roles. Teammates, CI tokens, and agents can receive only the permissions needed to debug, deploy, or monitor safely. ### Source excerpt You can now scope access to individual Workers and assign narrower Developer Platform roles, so teammates, CI tokens, and agents get only the access they need to debug, deploy, or monitor safely. ## Introducing automatic remediation policies with Cloudflare CASB DevFeed: [Introducing automatic remediation policies with Cloudflare CASB]() Original publisher: [Read original article]() Author: Abe Carryl Published: 2026-09-11T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Software as a service](), [Cloudflare One](), [Orchestration](), [Authorization]() Tags: [automation](), [casb](), [cloudflare](), [cloudflare-one](), [event-driven](), [oauth](), [orchestration](), [policy](), [reactive](), [saas](), [security](), [security-operations-center](), [zero-trust]() ### AI overview Cloudflare introduces CASB policies that automatically remediate SaaS security findings, including revoking risky file shares and sending webhooks after a finding is detected. ### Source excerpt Cloudflare CASB policies introduce a native automation engine built directly on the Cloudflare developer platform to remediate SaaS risks automatically. Security teams can now design event-driven logic to revoke risky file shares and send webhooks without manual intervention. ## 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it DevFeed: [1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it]() Original publisher: [Read original article]() Author: Bas Westerbaan Published: 2026-09-10T13:00:00Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Cryptography]() Tags: [1-1-1-1](), [algorithms](), [cryptography](), [dns](), [dnssec](), [post-quantum](), [research](), [security](), [testing](), [tls](), [validation]() ### AI overview Cloudflare's 1.1.1.1 now validates DNSSEC signatures using the post-quantum ML-DSA-44 algorithm. The article discusses testing oversized DNS responses and preventing downgrade to conventional signatures while retaining compatibility with older resolvers. ### Source excerpt 1.1.1.1 now validates DNSSEC signatures using NIST's post-quantum ML-DSA-44 algorithm. Here is how we manage 2,420-byte signatures and downgrade risks at scale. ## How we rebuilt Cloudflare Workers' module registry for Node.js compatibility DevFeed: [How we rebuilt Cloudflare Workers' module registry for Node.js compatibility]() Original publisher: [Read original article]() Author: James Snell Published: 2026-09-09T13:00:00Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Workers](), [Node.js]() Tags: [cloudflare](), [cloudflare-workers](), [developer-platform](), [developers](), [javascript](), [node-js](), [open-source](), [webassembly](), [workers]() ### AI overview Cloudflare rebuilt the Workers runtime module registry to improve Node.js compatibility, URL-based module resolution, module caching, import validation, lazy compilation, and WebAssembly support. ### Source excerpt Workers now enables Node.js compatibility by default, supports applications up to 64 mebibytes, and adds a URL-based module registry with import.meta, lazy compilation, shared code caches, and clearer errors. ## Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting) DevFeed: [Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)]() Original publisher: [Read original article]() Author: Alex Krivit Published: 2026-09-08T13:10:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Cryptography](), [SSL](), [Latency](), [Encryption]() Tags: [application-security](), [application-services](), [cloudflare](), [encryption](), [latency](), [performance](), [post-quantum](), [research](), [ssl](), [tls]() ### AI overview Cloudflare announces Automatic Key Exchange, which probes TLS 1.3 origins for supported key-agreement algorithms and uses the preferred option on the first connection attempt. The rollout reduces HelloRetryRequests and handshake latency while automatically preferring post-quantum hybrid connections where supported. ### Source excerpt Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it. ## Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models DevFeed: [Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models]() Original publisher: [Read original article]() Author: Blake Darché Published: 2026-09-03T21:03:02Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Vulnerabilities](), [Language models](), [AI-assisted coding]() Tags: [artificial-intelligence](), [cloudflare](), [code](), [developers](), [edge](), [firewall](), [gpt](), [large-language-models](), [openai](), [product-news](), [production](), [security](), [vulnerability](), [workers]() ### AI overview Cloudflare announces early access to an invitation-only service that prioritizes code vulnerabilities using production traffic, security signals, WAF context, and OpenAI Daybreak models. It proposes and validates patches or mitigations for customer review, while customers decide whether to implement them. ### Source excerpt Use production traffic and security signals to prioritize findings, prepare edge mitigations when safe, and propose code patches. By combining WAF data with OpenAI Daybreak models, Vulnerability Discovery and Remediation helps teams identify and patch the most critical threats first. ## How we could save petabytes of cache storage with Zstandard and Pingora DevFeed: [How we could save petabytes of cache storage with Zstandard and Pingora]() Original publisher: [Read original article]() Author: Aashi Patel Published: 2026-09-01T12:59:00Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Caching](), [Pingora](), [cloud-infrastructure](), [Hardware]() Tags: [cache](), [cloudflare](), [compression](), [cpu](), [data-center](), [hardware](), [internship-experience](), [performance](), [pingora](), [prototyping](), [storage](), [testing]() ### AI overview Cloudflare describes a Cache Transcoding prototype that stores eligible cached assets in Zstandard-compressed form. The approach aims to increase effective cache capacity and reduce inter-data-center transfers while adding a small CPU cost during cache fills. ### Source excerpt Could we get more cache space with the same hardware? We prototyped compression inside Cloudflare's cache to find out. ## Introducing Adaptive Intelligence: Undermining the economics of every bot attack DevFeed: [Introducing Adaptive Intelligence: Undermining the economics of every bot attack]() Original publisher: [Read original article]() Author: Chris Pope Published: 2026-08-31T12:59:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Bot](), [Artificial Intelligence](), [Cloudflare](), [Network](), [releases]() Tags: [ai](), [application-security](), [attacks](), [bot-management](), [cloudflare](), [machine-learning](), [network](), [product-news](), [releases]() ### AI overview Cloudflare introduces Adaptive Intelligence, a bot detection engine designed to undermine the economics of automated attacks. It responds to attackers' changing tactics by learning from live traffic and making attacks slower and more costly to sustain. ### Source excerpt Bot operators have historically had the economic advantage, bypassing static, deterministic detection rules with cheap proxies and retooling. Cloudflare's new Adaptive Intelligence engine flips this dynamic by autonomously learning from the meta-signals of live traffic and deploying disposable rules, making automated attacks too expensive to sustain. ## BotBase for Operators: A clearer path to joining Cloudflare's directory of bots and agents DevFeed: [BotBase for Operators: A clearer path to joining Cloudflare's directory of bots and agents]() Original publisher: [Read original article]() Author: Julian Laxman Published: 2026-08-28T12:59:44Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [AI Bots]() Tags: [agents](), [ai-bots](), [application-security](), [bot-management](), [bots](), [cloudflare](), [content](), [model](), [update]() ### AI overview Cloudflare launched BotBase for Operators, adding a dashboard area where bot operators can browse the directory, submit bots, and track submission history. The update also provides submission-status visibility, editing, and a behavior model for declaring content use. ### Source excerpt Bot operators now have a home in the Cloudflare dashboard to manage submissions. This update adds submission status tracking, submission editing, and a behavior model so operators can accurately declare how their bots use content. ## How we saved 100 terabytes of memory by optimizing 1.1.1.1's DNS cache DevFeed: [How we saved 100 terabytes of memory by optimizing 1.1.1.1's DNS cache]() Original publisher: [Read original article]() Author: Sebastiaan Neuteboom Published: 2026-08-27T17:02:35Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Cache](), [Caching](), [Cloudflare](), [Rust](), [benchmarking](), [Latency](), [datacenter]() Tags: [1-1-1-1](), [benchmarking](), [cache](), [cloudflare](), [data-center](), [deep-dive](), [dns](), [engineering](), [latency](), [memory](), [net-maui](), [optimization](), [performance](), [rust]() ### AI overview Cloudflare describes five Rust-level changes to the memory layout of Big Pineapple, the platform behind 1.1.1.1 and other DNS services. The changes reduced DNS cache entry size by over 50%, freed roughly 100 terabytes of memory across the fleet, increased insert throughput by 43%, and reduced lookup latency by 19%. ### Source excerpt Five Rust-level memory optimizations to the DNS cache layout of Big Pineapple cut per-entry memory by 56%, freeing approximately 100 TB of memory across Cloudflare's fleet. ## The Cloudflare Blog -- brought to you by EmDash DevFeed: [The Cloudflare Blog -- brought to you by EmDash]() Original publisher: [Read original article]() Author: Amy Dutton Published: 2026-08-24T19:00:00Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [EmDash](), [Content Management System](), [migration](), [Astro](), [Cloudflare](), [Usability](), [Front end]() Tags: [astro](), [cloudflare](), [cloudflare-workers](), [content](), [developer-platform](), [developers](), [emdash](), [engineering](), [frontend](), [infrastructure](), [migration](), [performance](), [usability]() ### AI overview Cloudflare describes migrating its blog to EmDash, a CMS built for Astro and Cloudflare. The article covers the Customer Zero approach, migration lessons, usability testing, scalability, production validation, and frontend improvements including dark mode. ### Source excerpt We migrated the Cloudflare Blog to EmDash to prove our stack at massive scale. Here is how we stress-tested performance, safely routed production traffic, and redesigned the frontend experience. ## Say it once: Introducing Bot Preference Sync DevFeed: [Say it once: Introducing Bot Preference Sync]() Original publisher: [Read original article]() Author: Jin-Hee Lee Published: 2026-08-21T23:19:57Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [AI Bots]() Tags: [ai](), [ai-bots](), [ai-models](), [ai-training](), [bot-management](), [bots](), [cloudflare](), [network-services](), [product-news](), [robots](), [search](), [sync](), [training]() ### AI overview Cloudflare introduces Bot Preference Sync, which updates robots.txt preferences to match configured AI bot policies for Search, Agent, and Training traffic. ### Source excerpt Cloudflare's new Bot Preference Sync automatically aligns your robots.txt file with your AI bot policies for Search, Agent, and Training. Easily manage which bots access your content without maintaining static files. ## From all-or-nothing to task-based OAuth consent DevFeed: [From all-or-nothing to task-based OAuth consent]() Original publisher: [Read original article]() Author: José Enrique Rodríguez Published: 2026-08-20T17:03:03Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Authorization](), [Security](), [Cloudflare](), [MCP Server](), [App](), [Low-Code / Internal Tools](), [Software as a service]() Tags: [agent](), [agents](), [api](), [applications](), [cloudflare](), [developer-platform](), [developers](), [identity](), [integrations](), [internal-tools](), [mcp](), [mcp-server](), [oauth](), [product-news](), [security](), [workflows]() ### AI overview Cloudflare OAuth now supports customizable consent scopes, allowing users to grant only the optional permissions needed for a specific task while developers retain required scopes. ### Source excerpt Cloudflare OAuth now supports optional scopes, giving users more control over what an app can access and helping developers build secure consent flows around the task at hand. ## A revisit of remote Spectre attacks on Cloudflare Workers DevFeed: [A revisit of remote Spectre attacks on Cloudflare Workers]() Original publisher: [Read original article]() Author: Albert Pedersen Published: 2026-08-19T16:00:28Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [vulnerability](), [Processes](), [out-of-process]() Tags: [attacks](), [cloudflare](), [cloudflare-workers](), [edge](), [javascript](), [linux](), [memory](), [processes](), [remote](), [research](), [sandbox](), [security](), [vulnerabilities]() ### AI overview Cloudflare reassessed remote Spectre attacks against Workers and found that a limitation in Dynamic Process Isolation allowed reliable data leakage in production. The attack is already mitigated through improved isolation measures, including the V8 Sandbox and in-process isolation. ### Source excerpt In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and how new defenses further harden Cloudflare Workers. ## BGP Role model: tracking the adoption of RFC 9234 DevFeed: [BGP Role model: tracking the adoption of RFC 9234]() Original publisher: [Read original article]() Author: Mingwei Zhang Published: 2026-08-18T15:21:32Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [BGP](), [networking](), [Networks](), [Routing (disambiguation)](), [Protocol (disambiguation)](), [Cloudflare](), [Monitoring]() Tags: [analysis](), [bgp](), [cloudflare](), [internet](), [monitoring](), [network](), [networks](), [research](), [router](), [routing](), [routing-security](), [rpki]() ### AI overview This article examines the adoption of RFC 9234, which uses BGP Roles and the Only to Customer (OTC) attribute to help routers prevent and detect route leaks. Cloudflare measured deployment through its global peering presence and found that two large Tier-1 networks were stripping OTC attributes from forwarded routes. ### Source excerpt RFC 9234 lets routers reject route leaks on their own, using BGP Roles and the Only to Customer attribute. We measured who has deployed it, and found two Tier 1 networks unexpectedly stripping OTC. ## How Cloudflare detects MCP traffic and helps secure it DevFeed: [How Cloudflare detects MCP traffic and helps secure it]() Original publisher: [Read original article]() Author: Kenny Johnson Published: 2026-08-14T13:12:12Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [MSP MCP](), [AI Chat]() Tags: [agentic-ai](), [agents](), [ai](), [api](), [cloudflare-one](), [mcp](), [product-news](), [sase](), [security](), [zero-trust]() ### AI overview Cloudflare announces Cloudflare One controls for identifying MCP traffic, finding shadow connections, and enforcing Portal-only access to trusted MCP servers on managed network paths. ### Source excerpt Cloudflare Gateway identifies MCP requests using protocol-level heuristics. Security teams can use that signal to find shadow MCP traffic, enforce Portal-only access for approved servers, and block direct connections on managed network paths. ## Secure all your internal vibe-coded applications -- in one click DevFeed: [Secure all your internal vibe-coded applications -- in one click]() Original publisher: [Read original article]() Author: Matt Provost Published: 2026-08-14T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Cloudflare Access](), [Workers](), [Authentication](), [Cloudflare](), [Deployment](), [App]() Tags: [ai](), [authentication](), [cloudflare](), [cloudflare-access](), [cloudflare-workers](), [deployment](), [developer](), [developer-platform](), [developers](), [policy](), [product-news](), [sase](), [workers](), [zero-trust]() ### AI overview Cloudflare introduces Cloudflare Access for Workers, allowing account-level or application-level policies to require company authentication for preview and production deployments. Policies can protect Workers across custom domains, routes, workers.dev subdomains, and preview URLs, while authenticated user details can be accessed directly in application code. ### Source excerpt Introducing Cloudflare Access for Workers. Attach an Access policy directly to a Worker and it applies everywhere that Worker runs -- routes, custom domains, workers.dev, and previews -- automatically. ## Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal DevFeed: [Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal]() Original publisher: [Read original article]() Author: Lai Yi Ohlsen Published: 2026-08-13T19:58:01Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Internet Traffic](), [Cloudflare](), [data]() Tags: [blog](), [cloudflare](), [data](), [internet](), [internet-traffic](), [internet-trends](), [radar]() ### AI overview Cloudflare Radar data shows that Internet traffic decreased as a total solar eclipse deepened across affected European countries, with the largest dips along the path of totality and traffic typically rebounding within minutes after maximum coverage. ### Source excerpt Cloudflare's data shows a clear impact on Internet traffic from Iceland to Spain and Portugal, following the path of totality of the total solar eclipse that occurred on August 12, 2026. ## Certificate Transparency Monitoring is now generally available DevFeed: [Certificate Transparency Monitoring is now generally available]() Original publisher: [Read original article]() Author: Pravallika Nakarikanti Published: 2026-08-13T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Certificate Transparency]() Tags: [certificate-transparency](), [cloudflare](), [monitoring](), [ssl](), [tls]() ### AI overview Cloudflare has made Certificate Transparency Monitoring generally available. It now filters certificates Cloudflare issued for a domain, reducing renewal-alert noise and highlighting unexpected external certificates. ### Source excerpt Cloudflare's Certificate Transparency Monitoring is now generally available. The biggest change: we no longer email you about certificates Cloudflare issued for your domain, so when an alert lands in your inbox, it's worth a look. ## Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave DevFeed: [Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave]() Original publisher: [Read original article]() Author: Cloudforce One Published: 2026-08-11T13:00:00Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [DDoS](), [Cloudflare](), [Threat Research](), [Cloudforce One](), [Network](), [data](), [Cybercrime](), [High Profile Threats]() Tags: [analysis](), [attacks](), [cloudflare](), [cloudforce-one](), [data](), [ddos](), [dns](), [drive](), [global](), [government](), [industry](), [iran](), [media](), [network](), [radar](), [streaming](), [threat-report]() ### AI overview Cloudflare's H1 2026 DDoS Threat Report analyzes attacks from January through June 2026. It highlights a 519% quarter-over-quarter increase in attacks exceeding 1 Tbps, a shift toward DNS and CLDAP reflection and amplification vectors, and the influence of geopolitical events on attack patterns. The report also covers attack volumes, an April peak, and the possible impact of Operation PowerOFF. ### Source excerpt In the first half of 2026, Cloudflare detected a 519% surge in hyper-volumetric DDos attacks across its network. These attacks were driven heavily by DNS and CLDAP reflection vectors. This report breaks down how major geopolitical conflicts reshaped the global cyber threat landscape. ## Everything we launched during Agents Week DevFeed: [Everything we launched during Agents Week]() Original publisher: [Read original article]() Author: Kathy Liao Published: 2026-08-10T18:34:10Z Content type: news Language: en Sources: [Cloudflare Blog]() Topics: [Artificial Intelligence](), [Cloudflare](), [Architecture & Design](), [Orchestration](), [Security](), [Cloud](), [observability](), [changelog]() Tags: [agents](), [agents-week](), [ai](), [announcements](), [changelog](), [cloud](), [cloudflare](), [cloudflare-one](), [cloudflare-workers](), [developer-platform](), [developers](), [identity](), [infrastructure](), [observability](), [orchestration](), [sase](), [updates](), [zero-trust]() ### AI overview Cloudflare's Agents Week recap covers announcements about building and operating autonomous, AI-native applications. It describes the platform foundations for agents, including execution infrastructure, development lifecycle, identity, communication, orchestration, memory, observability, and security, along with the concept of an Agentic Internet. ### Source excerpt Our latest Agents Week has come to a close. Here's a recap of all the announcements we made from Wallets to Radar.