Subscribe to receive notifications of new posts:

Toxic combinations: when small signals add up to a security incident

2026-02-27

Minor misconfigurations or request anomalies often seem harmless in isolation. But when these small signals converge, they can trigger a security incident known as a toxic combination. Here’s how to spot the signs. ...

Continue reading »
Toxic combinations: when small signals add up to a security incident

We deserve a better streams API for JavaScript

2026-02-27

StandardsJavaScriptTypeScriptOpen SourceCloudflare WorkersNode.jsPerformanceAPI

The Web streams API has become ubiquitous in JavaScript runtimes but was designed for a different era. Here's what a modern streaming API could (should?) look like....

The most-seen UI on the Internet? Redesigning Turnstile and Challenge Pages

2026-02-27

Security WeekTurnstileChallenge PageDesignProduct DesignUser ResearchBotsBot ManagementWAFEngineeringProduct NewsAccessibility

We serve 7.6 billion challenges daily. Here’s how we used research, AAA accessibility standards, and a unified architecture to redesign the Internet’s most-seen user interface....

Bringing more transparency to post-quantum usage, encrypted messaging, and routing security

2026-02-27

RadarSecurityPrivacyPost-QuantumRoutingResearch

Cloudflare Radar has added new tools for monitoring PQ adoption, KT logs for messaging, and ASPA routing records to track the Internet's migration toward more secure encryption and routing standards. ...

ASPA: making Internet routing more secure

2026-02-27

Security WeekBGPRPKIRoutingRouting SecurityRadar

ASPA is the cryptographic upgrade for BGP that helps prevent route leaks by verifying the path network traffic takes. New features in Cloudflare Radar make tracking its adoption easy....

How we rebuilt Next.js with AI in one week

2026-02-24

AICloudflare WorkersWorkers AIDevelopersDeveloper PlatformJavaScriptOpen SourcePerformance

One engineer used AI to rebuild Next.js on Vite in a week. vinext builds up to 4x faster, produces 57% smaller bundles, and deploys to Cloudflare Workers with a single command....

Cloudflare One is the first SASE offering modern post-quantum encryption across the full platform

2026-02-23

Post-QuantumZero TrustCryptographyCloudflare OneIPsec

We’ve upgraded Cloudflare One to support post-quantum encryption by implementing the latest IETF drafts for hybrid ML-KEM into our Cloudflare IPsec product. This extends post-quantum encryption across all major Cloudflare One on-ramps and off-ramps....

Cloudflare outage on February 20, 2026

2026-02-21

Post MortemIncident ResponseOutage

Cloudflare suffered a service outage on February 20, 2026. A subset of customers who use Cloudflare’s Bring Your Own IP (BYOIP) service saw their routes to the Internet withdrawn via Border Gateway Protocol (BGP)....

Code Mode: give agents an entire API in 1,000 tokens

2026-02-20

DevelopersDeveloper PlatformAIWorkers AICloudflare WorkersOptimizationOpen Source

The Cloudflare API has over 2,500 endpoints. Exposing each one as an MCP tool would consume over 2 million tokens. With Code Mode, we collapsed all of it into two tools and roughly 1,000 tokens of context....

Shedding old code with ecdysis: graceful restarts for Rust services at Cloudflare

2026-02-13

RustOpen SourceInfrastructureEngineeringEdgeDevelopersDeveloper PlatformApplication ServicesRust

ecdysis is a Rust library enabling zero-downtime upgrades for network services. After five years protecting millions of connections at Cloudflare, it’s now open source....

Introducing Markdown for Agents

2026-02-12

AIAgentsDevelopersDeveloper Platform

The way content is discovered online is shifting, from traditional search engines to AI agents that need structured data from a Web built for humans. It’s time to consider not just human visitors, but start to treat agents as first-class citizens. Markdown for Agents automatically converts any HTML page requested from our network to markdown....

2025 Q4 DDoS threat report: A record-setting 31.4 Tbps attack caps a year of massive DDoS assaults

2026-02-05

DDoS ReportsDDoSCloudforce OneSecurityAdvanced DDoSAI

The number of DDoS attacks more than doubled in 2025. The network layer is under particular threat as hyper-volumetric attacks grew 700%....

Improve global upload performance with R2 Local Uploads

2026-02-03

R2PerformanceStorage

Local Uploads on R2 reduces request duration for uploads by up to 75%. It writes object data to a nearby location and asynchronously copies it to your bucket, all while data is available immediately. ...

Google’s AI advantage: why crawler separation is the only path to a fair Internet

2026-01-30

AIAI BotsGoogleLegalPolicy & Legal

Google's dual-purpose crawler creates an unfair AI advantage. To protect publishers and foster competition, the UK’s Competition and Markets Authority must mandate crawler separation for search and AI....

Building vertical microfrontends on Cloudflare’s platform

2026-01-30

Cloudflare WorkersDeveloper PlatformDevelopersDashboardFront EndMicro-frontends

Deploy multiple Workers under a single domain with the ability to make them feel like single-page applications. We take a look at how service bindings enable URL path routing to multiple projects....

Introducing Moltworker: a self-hosted personal AI agent, minus the minis

2026-01-29

AIAgentsCloudflare WorkersContainersSandbox

Moltworker is a middleware Worker and adapted scripts that allows running OpenClaw (formerly Moltbot, formerly Clawdbot) on Cloudflare's Sandbox SDK and our Developer Platform APIs. So you can self-host an AI personal assistant — without any new hardware....

Building a serverless, post-quantum Matrix homeserver

2026-01-27

Cloudflare WorkersDurable ObjectsD1Cloudflare Workers KVR2SecurityDeveloper PlatformDevelopersRustWebAssemblyPost-QuantumEncryption

As a proof of concept, we built a Matrix homeserver to Cloudflare Workers — delivering encrypted messaging at the edge with automatic post-quantum cryptography....

Cable cuts, storms, and DNS: a look at Internet disruptions in Q4 2025

2026-01-26

RadarInternet ShutdownInternet TrafficOutageInternet TrendsAWSMicrosoft AzureConsumer Services

The last quarter of 2025 brought several notable disruptions to Internet connectivity. Cloudflare Radar data reveals the impact of cable cuts, power outages, extreme weather, technical problems, and more....

Route leak incident on January 22, 2026

2026-01-23

BGPPost Mortem

An automated routing policy configuration error caused us to leak some Border Gateway Protocol prefixes unintentionally from a router at our Miami data center. We discuss the impact and the changes we are implementing as a result....

How we mitigated a vulnerability in Cloudflare’s ACME validation logic

2026-01-19

VulnerabilitiesWAFSecurityNetwork Services

A vulnerability was recently identified in Cloudflare’s automation of certificate validation. Here we explain the vulnerability and outline the steps we’ve taken to mitigate it. ...