From Cloudflare Blog · 40 stories
Cloudflare introduces task-based OAuth consent with scope customization
Cloudflare has launched OAuth scope customization, allowing users to deselect optional scopes during authorization. This change moves from an all-or-nothing consent model to a more granular, task-based approach, enhancing user control over application permissions.
Cloudflare introduces WriteGuard for fine-grained control over AI agent actions on MCP servers
Cloudflare has launched WriteGuard, a new control system designed to manage and restrict the actions of AI agents connected to Model Context Protocol (MCP) servers. This system addresses the risk of AI agents performing unintended or destructive operations by providing granular permissions, preventing scenarios like mass ticket closures or data deletion. WriteGuard is now available in private beta for Cloudflare MCP server portals.
Cloudflare launches CI SDK for running CI/CD pipelines on its platform
Cloudflare introduced a CI SDK built on Cloudflare Workflows, enabling continuous integration (CI) pipelines to run directly on its platform. This development allows platforms to manage CI/CD for their own code and their customers' code, integrating with Cloudflare Artifacts for versioned code storage.
Cloudflare Introduces Agent Tracing and Local Debugging for AI Agents on Workers
Cloudflare has launched Cloudflare Agents, a platform for deploying and managing hosted agents, starting with agent tracing for visibility into agent behavior. Concurrently, `wrangler dev` and `vite dev` now automatically capture OpenTelemetry traces for local Worker invocations, enabling AI agents to debug issues using a new Local Explorer API. This provides structured feedback for agents during local development, reducing manual logging.
Cloudflare Reports 519% Surge in 1 Tbps DDoS Attacks in Q2 2026
Cloudflare's H1 2026 DDoS Threat Report indicates a 519% quarter-over-quarter increase in network-layer DDoS attacks exceeding 1 Tbps between Q1 and Q2 2026. The report, based on data from Cloudflare's network, highlights a shift in attack vectors, with DNS-based attacks becoming the primary method, and notes the influence of geopolitical events on the threat landscape.
Cloudflare Internal DNS Launches for Private Networks
Cloudflare has launched its Internal DNS, providing unified management of authoritative and recursive DNS for private networks. This service aims to simplify DNS operations by consolidating public and private DNS management on a single platform, thereby enhancing security and visibility across networks.
Cloudflare open-sources 'pvcli' debugger for OHTTP and MASQUE privacy protocols
Cloudflare has open-sourced "privacy-client" (pvcli), a command-line debugger for Oblivious HTTP (OHTTP) and MASQUE protocols, under an Apache 2.0 license. This tool addresses the difficulty of troubleshooting privacy services like Apple's iCloud Private Relay and Microsoft's Edge Secure Network VPN, which split trust across multiple operators to prevent any single entity from linking user identity to online activity.
Cloudflare introduces new analytics and policies for personal agent traffic
Cloudflare launched new analytics and granular access policies to provide site owners with better visibility and control over personal agent traffic. These tools allow businesses to understand how personal agents interact with their sites and manage access based on specific needs, rather than blocking all automated traffic.
Cloudflare Services for Private Origins Now Generally Available
Cloudflare has made its services for private origins generally available, allowing users to proxy DNS records to private IPs and access Cloudflare's application services. This enables WAF, caching, bot management, and Workers to function for internal APIs and tools without exposing them to the public internet, addressing a previous gap in security and control for private applications.
Cloudflare launches Origin Range Requests for efficient large file delivery
Cloudflare released Origin Range Requests, a new self-service feature that optimizes how its CDN handles HTTP range requests for large files. This update reduces wasted bandwidth and disk operations by dynamically adjusting range sizes, improving performance for services like R2 object storage.
Cloudflare Achieves South Korea's ISMS-P Certification, Localizes User Consent
Cloudflare obtained South Korea's Information Security Management System (ISMS) certification under the ISMS-P framework after a ten-day audit by KISA. This certification required Cloudflare to localize its user consent process for Korean users, including itemized agreements for terms of service, personal information collection, and overseas data transfer.
Cloudflare WAF Adds Full Transaction Detections and Response Rules
Cloudflare has introduced full transaction detections and response rules to its Web Application Firewall (WAF). These new features evaluate HTTP requests alongside their responses to identify exploitation attempts and block malicious responses before they reach the requester, addressing vulnerabilities like php2shell.
Cloudflare and Commerce.com Implement WebMCP to Prepare Storefronts for AI Agents
Cloudflare has launched a beta edge implementation of WebMCP, a Google browser standard that provides structured tools for AI agents on websites. Commerce.com is adopting this technology across its nearly 100,000 domains to enable AI agents to interact with online stores more efficiently and reliably, allowing merchants to retain customer relationships and control over checkout processes.
AI Code Reviewer Reduces Inference Costs by 68% and Review Time by 63%
An AI code reviewer reduced its average review cost by 68% to $0.77 and median review time by 63% to 1 minute 32 seconds. This optimization was achieved through code changes, model selection, and managing token usage, addressing a previous cost increase from $1.19 to $2.46 per review.
Cloudflare Introduces Continuous Accountability System for Verified Bots
Cloudflare launched a new system to continuously evaluate and report on the behavior of Verified Bots. This system assesses whether bots adhere to stated intentions and avoid abusive actions, ensuring ongoing trustworthiness beyond initial identity verification. It aims to maintain trust by monitoring compliance with website preferences and direct feedback.
Cloudflare Gateway and DLP integrate with edge computing for programmable security
Cloudflare has integrated its Gateway and Data Loss Prevention (DLP) services with its edge computing platform, introducing new 'Forward' actions and custom validation functions. This allows users to run custom code via Cloudflare Workers for traffic manipulation and policy evaluation, addressing limitations of traditional secure web gateways.
Cloudflare Hyperdrive for MySQL Reaches General Availability
Cloudflare's Hyperdrive, a database connection pooler for Workers, is now generally available for MySQL, following its initial support for Postgres. This release addresses 20 bug fixes identified during the beta phase, including a rare caching bug, to improve reliability and performance for MySQL database connections.
Cloudflare D1 Scales to Millions of Databases, Supporting 65x Growth in Two Years
Cloudflare's D1 serverless database, based on SQLite, has scaled its control plane to support millions of databases, experiencing a 65x growth in live databases over two years. This scaling allows D1 to accommodate applications that use many small databases per user or tenant, addressing a shift in database architecture driven by AI-assisted development platforms.
Cloudflare Workers and Durable Objects now support on-demand CPU and memory profiling
Cloudflare has introduced on-demand CPU and memory profiling with flamegraphs for Workers and Durable Objects. This feature allows developers to identify exact functions consuming CPU or allocating memory, improving resource optimization in production environments.
DNS Root Key-Signing Key (KSK) Rollover Scheduled for October 2026
The DNS root's key-signing key (KSK) will undergo its second-ever rollover on October 11, 2026, impacting DNSSEC's chain of trust. DNSSEC-validating resolvers must trust the new key, KSK-2024, before the switch to prevent websites from becoming unreachable. Most website operators do not need to take action, but resolver operators should verify their systems trust the new key.
Cloudflare launches Streamline developer playground for custom video pipelines
Cloudflare introduced Streamline, a new developer playground demonstrating how to build custom video pipelines using Cloudflare Stream, Workers, and Containers. Streamline allows developers to create dynamic video experiences like live annotations or burned-in subtitles by modifying video and publishing the output as a livestream or hosted video. This provides a framework for developers to implement bespoke video processing workflows on Cloudflare's platform.
Cloudflare is now the fastest provider in 74% of the top 1,000 global networks
Cloudflare announced it is now the fastest provider in 74% of the 1,000 largest global networks, an increase from 60% in April 2026. This improvement means users can access applications, APIs, and websites more quickly, impacting overall internet experience.
Cloudflare Quick Tunnels Add Accountless Authentication for Local Development Sharing
Cloudflare has updated its Quick Tunnels feature to include an accountless authentication option, allowing developers to restrict access to shared local services. This update addresses security concerns for sharing development projects, particularly with the rise of AI agents utilizing Quick Tunnels for publishing work.
Cloudflare launches new fraud dashboard for Account Abuse Protection
Cloudflare introduced a new fraud dashboard for its Account Abuse Protection (AAP) service, initially for Early Access customers. This dashboard helps website owners detect and investigate account abuse by providing stateful overviews of login and signup activity, moving beyond traditional point-in-time identity checks.
Cloudflare expands enterprise features to all plans, including Logpush and Transformers
Cloudflare is making more enterprise-tier features available to all customers, including free and pay-as-you-go plans. This change allows smaller businesses and individual users to access advanced capabilities like Logpush and Logpush Transformers, previously restricted to Enterprise accounts. The move aims to democratize access to Cloudflare's full suite of tools, enabling more users to monitor traffic and analyze data.
Cloudflare OS now offers fully managed deployments for agent workspaces
Cloudflare has opened a waitlist for fully managed deployments of Cloudflare OS, an agent workspace designed to connect to company data and systems. This new offering allows organizations to deploy Cloudflare OS with simplified configuration and maintenance, building on the previously released open-source version.
Cloudflare launches Workers KV Instant for faster global data replication
Cloudflare introduced Workers KV Instant, a new mode for its Workers KV service, which utilizes the Quicksilver key-value store. This update provides 100 times faster p99 reads and immediate global updates for data, addressing the need for rapid access to infrequently updated application configurations.
Cloudflare Basin, an open and serverless data platform, is now generally available
Cloudflare announced the general availability of Cloudflare Basin, a serverless data analytics platform built on Apache Iceberg and R2 Object Storage. Basin provides an end-to-end analytics solution, allowing users to collect data from various sources and query it using SQL, addressing the need for portable and cost-efficient data analytics.
Cloudflare Workers introduces 'Issues' for automated error monitoring and agent integration
Cloudflare has launched 'Issues' in open beta for Cloudflare Workers, providing built-in error monitoring that groups exceptions, 5xx responses, and error logs. This feature automatically sends error context to coding agents, streamlining the process of identifying and resolving production issues.
Vinext 1.0 Released, Enabling Next.js App Deployment to Any Web Platform
Vinext 1.0 has been released, allowing Next.js applications to be deployed to various web platforms like Cloudflare Workers, Netlify, or AWS Lambda. This update improves compatibility and stability for both Pages and App Router Next.js projects, making them more portable.
Cloudflare Releases BEACON Dataset for Real-User Web Performance Monitoring
Cloudflare has released BEACON, an anonymized dataset containing billions of real-world web performance measurements from 10,000 major websites. This dataset, updated daily in Google BigQuery, provides researchers with detailed insights into web performance across various browsers, devices, and countries, expanding the RUM Archive project.
Cloudflare Workers Adds Experimental Emscripten Target Support for Native Rust and Tokio
Cloudflare announced experimental preview support for the Emscripten `wasm32-unknown-emscripten` Rust compiler target within the `wasm-bindgen` toolchain for Workers. This enables native Rust code, including Tokio-based applications, to run on Cloudflare's platform with improved library compatibility and virtualized native features like TCP sockets.
Cloudflare Kitesurf Browser Adds WebMCP Support for AI Agents
Cloudflare's Kitesurf browser, designed for AI agents, now supports WebMCP (Web Machine-readable Communication Protocol). This allows AI agents to interact with websites programmatically using exposed functions, improving reliability and efficiency over simulating human clicks.
VoidZero JavaScript Toolchain Achieves Significant Performance Gains Since Joining Cloudflare
VoidZero, acquired by Cloudflare four months ago, has released over 80 updates across its JavaScript toolchain, including performance improvements for Oxc React Compiler, Vitest, and tsgolint. These updates aim to enhance developer productivity for both human developers and AI agents by speeding up critical development processes.
Cloudflare launches Turnstile Spin for simplified bot protection setup
Cloudflare introduced Turnstile Spin, an agent-mediated implementation of its Turnstile bot protection service. This new tool simplifies the setup process for Turnstile, making it accessible to a wider range of users beyond developers, and addresses the rise of AI coding agents in web development.
Cloudflare introduces new granular access controls and roles for Workers
Cloudflare has released new access controls for its Workers platform, allowing users to assign specific access levels to individual Workers. This update includes four new roles and the ability to apply permissions at the Developer Platform, product, or resource level, enhancing security and adherence to the principle of least privilege.
Cloudflare CASB Introduces Automatic Remediation Policies for SaaS Security
Cloudflare CASB now includes automatic remediation policies, allowing security teams to configure event-driven logic to revoke risky file shares and dispatch webhooks without manual intervention. This update shifts the tool from a passive alarm system to an active remediation platform, addressing the challenge of rapidly fixing misconfigurations in SaaS applications.
Cloudflare Workers' Module Registry Rewritten for Node.js Compatibility
Cloudflare has rewritten the module registry in workerd, the core component of its Workers runtime, to improve Node.js compatibility and standards adherence. This update allows for better resolution, loading, and caching of modules, enabling deployment of larger Node.js applications to Cloudflare Workers.
Cloudflare Launches Bot Preference Sync to Automate robots.txt Updates for AI Bot Management
Cloudflare introduced Bot Preference Sync, a new feature that automatically updates a website's robots.txt file to reflect AI bot configurations set within Cloudflare's platform. This aims to simplify managing how different AI bot categories, such as search, agent, and training crawlers, interact with website content, ensuring consistency between stated preferences and enforcement rules.
Cloudflare's Certificate Transparency Monitoring is now generally available with filtered alerts
Cloudflare has made its Certificate Transparency Monitoring generally available, now featuring a filter that removes alerts for certificates Cloudflare itself issues. This change addresses a significant "noise problem" by only notifying users of unexpected certificates, making the service more effective for identifying mis-issued certificates.