All news with #cloudflare tag

⚠️ On February 20, 2026, Cloudflare introduced a change to how it manages BYOIP addresses that triggered a cleanup sub-task to erroneously withdraw customer prefixes via BGP, causing connectivity failures for affected customers. About 1,100 prefixes (≈25% of BYOIP prefixes on the peer) were withdrawn, including a subset of one.one.one.one. Engineers reverted the change, restored configurations, and resolved the incident in roughly six hours; Cloudflare confirmed the issue was not due to malicious activity.

🧰 Cloudflare introduces a new MCP server that uses Code Mode to expose the entire Cloudflare API through just two tools, search() and execute(). By letting agents write compact JavaScript against a typed OpenAPI spec and executing it inside a sandboxed Dynamic Worker, the server dramatically reduces model context token use. The footprint remains fixed regardless of API size, enabling progressive discovery, OAuth 2.1 downscoping, and safe execution for agents.

🔁 ecdysis is a Cloudflare open-source Rust library that enables graceful process restarts without dropping live connections or refusing new connections. It uses a fork-then-exec model with inherited listening sockets and a readiness handshake so the new process can initialize safely. The design provides crash safety during upgrades and prevents gaps where the kernel would refuse connections. The library integrates with Tokio and systemd and has been production-proven since 2021, saving millions of requests across Cloudflare’s global network.

📝 Cloudflare has introduced Markdown for Agents, an edge feature that converts HTML to Markdown in real time when a client requests text/markdown via content negotiation. The service returns a markdown body, a content-type of text/markdown, and an x-markdown-tokens header estimating token count to help with chunking and context-window planning. Converted responses also include a Content-Signal header (ai-train=yes, search=yes, ai-input=yes) to indicate permitted downstream uses. The feature is available in Beta at no additional cost for Pro, Business, Enterprise and SSL for SaaS customers.

🚨 Cloudflare attributed a record hyper‑volumetric HTTP DDoS to the AISURU/Kimwolf botnet that peaked at 31.4 Tbps and lasted 35 seconds in November 2025. The group was also linked to a campaign codenamed The Night Before Christmas, which began on December 19, 2025, and produced averages near 3 Bpps, 4 Tbps and 54 Mrps. Google and Cloudflare disrupted the IPIDEA residential proxy network used to recruit more than 2 million Android devices.

🛡️ Cloudflare's 24th Quarterly DDoS Threat Report documents a record-setting 2025 capped by a 31.4 Tbps attack and a late-December campaign from the Aisuru-Kimwolf botnet. The firm observed a 121% year-over-year surge in DDoS activity, averaging 5,376 mitigations per hour and a tripling of network-layer assaults to 34.4 million. Hyper-volumetric HTTP floods—largely from infected Android TVs—peaked above 200 Mrps and targeted telcos, gaming, and AI providers, while Cloudflare's autonomous defenses automatically detected and mitigated these incidents.

🚀 Cloudflare has launched R2 Local Uploads in open beta to speed global writes by first writing object data to storage near the client and then asynchronously replicating it to the bucket's home region. Uploads remain strongly consistent and immediately accessible after the initial write, and private-beta tests show up to a 75% reduction in Time to Last Byte for cross-region uploads. Enable Local Uploads via the Cloudflare Dashboard or with Wrangler; there is no additional charge beyond standard Class A operation costs.

⚖️ Cloudflare welcomes the UK CMA’s consultation on proposed conduct requirements for Google but argues the measures do not go far enough to protect publishers and competition. Cloudflare’s analysis shows Googlebot accesses substantially more unique pages than other AI crawlers, giving Google an entrenched advantage that can undercut publisher revenue. The company urges mandatory crawler separation so sites can permit search indexing while blocking use of content for generative AI, restoring publisher choice and enabling fairer market competition.

🔀 Cloudflare released a Worker template for Vertical Microfrontends, enabling multiple independent Cloudflare Workers to serve a single domain by mapping routes (e.g., /docs, /dash) to distinct teams. The Router Worker leverages service bindings to call specific Workers, rewrites asset paths with HTMLRewriter, and can inject CSS view transitions plus speculation-rule preloads to create seamless, preloaded navigation. Teams keep full stack autonomy while users experience a unified application.

🔴 Cloudflare says the Aisuru/Kimwolf botnet launched a record DDoS campaign on December 19 that peaked at 31.4 Tbps and about 200 million requests per second. The attacks, dubbed The Night Before Christmas, targeted telecommunications and IT providers and hit Cloudflare’s dashboard and infrastructure. Sources were identified as compromised Android TVs rather than typical IoT routers, and most bursts lasted one to two minutes. Cloudflare reports the attacks were detected and mitigated automatically without triggering internal alerts.

🤖 Cloudflare published Moltworker, an adaptation of the open-source Moltbot personal AI agent designed to run on the Cloudflare Developer Platform instead of dedicated local hardware. The implementation combines Workers, the Sandbox SDK, Browser Rendering, and R2 to run agent workloads at the edge with controlled persistence. Integration with AI Gateway adds centralized observability, BYOK support, unified billing and fallback behavior. The repo is open-source and the project is presented as a proof-of-concept that requires a paid Workers plan.

🔒 Cloudflare ported a Matrix homeserver to Cloudflare Workers as a proof-of-concept, combining edge execution with built-in post-quantum TLS to reduce operational burden. The implementation remaps traditional components — Postgres to D1, Redis to KV, filesystem to R2, and coordination to Durable Objects — to provide strong consistency where needed and near-zero idle cost. End-to-end encryption remains client-side via Megolm, so Workers terminate TLS but only handle ciphertext. The result is a low-latency, easy-to-deploy homeserver with automatic DDoS protection and request-based pricing.

🔒 Cloudflare describes a proof-of-concept Matrix homeserver implemented on Cloudflare Workers, porting core logic from Synapse to a TypeScript service. By mapping Postgres to D1, Redis to KV, filesystem to R2, and coordination to Durable Objects, the architecture removes much of the traditional operational burden. The Worker preserves full Matrix E2EE (Megolm) while TLS automatically negotiates a post-quantum hybrid key agreement (X25519MLKEM768), delivering lower latency, usage-based cost scaling, and global distribution.

⚠️ Cloudflare disclosed that a policy misconfiguration on a router caused a 25-minute Border Gateway Protocol (BGP) route leak for IPv6 traffic on January 22, producing congestion, packet loss, and roughly 12 Gbps of dropped traffic. The change removed specific prefix filters and made export rules overly permissive, redistributing internal IPv6 routes externally from Miami. Engineers detected and manually reverted the change, paused automation, and restored normal operations within 25 minutes. Cloudflare says it will add stricter export safeguards, CI/CD policy checks, improved detection, and promote RPKI ASPA adoption.

🌐 In Q4 2025 Cloudflare observed over 180 Internet disruptions worldwide driven by government-directed shutdowns, submarine cable cuts, power failures, extreme weather, military action, and technical faults at operators and hyperscalers. Significant incidents included a Tanzania shutdown, multiple fiber and submarine cable outages affecting Haiti, Pakistan, Cameroon and the Dominican Republic, and catastrophic cyclone damage in Sri Lanka and Indonesia. Several provider-side and hyperscaler incidents also reduced availability for many sites and applications, while two Cloudflare-specific outages impacted service for subsets of customers. Verified anomalies and outage details are tracked in Cloudflare Radar and available via the Radar API.

⚠️On January 22, 2026, an automated routing policy change caused Cloudflare to unintentionally advertise IPv6 routes from a Miami router for 25 minutes. The misconfiguration accepted internal IBGP routes and redistributed them to peers and transit providers, funneling non-Cloudflare traffic into Miami and causing congestion, elevated packet loss, and higher latency on backbone links. Firewall filters on the router discarded around 12 Gbps of ingress traffic for those non-downstream prefixes. Cloudflare paused automation, reverted the change, restored normal operation, and apologized to affected users, customers, and external networks.

🔒 Cloudflare patched a vulnerability in its ACME HTTP-01 validation logic that could allow requests to bypass WAF protections and reach customer origin servers. Discovered by FearsOff in October 2025, the flaw arose when edge logic disabled WAF handling for requests matching an ACME challenge token without confirming the token belonged to the requested hostname. Cloudflare said it found no evidence of exploitation and implemented a code change on October 27, 2025 to only disable WAF features when the token is a valid challenge for that specific hostname.

🔒 Cloudflare patched a logic flaw in its ACME HTTP-01 handling that could disable certain WAF protections for specific challenge paths. The issue was reported by researchers from FearsOff through Cloudflare’s bug bounty program on October 13, 2025, and affected requests to /.well-known/acme-challenge/*. In some cases, challenge requests could reach customer origins when they should have been blocked because WAF features were incorrectly disabled. Cloudflare implemented a code change to ensure WAF disabling only occurs when Cloudflare will serve a valid ACME challenge response; no customer action is required and there is no known abuse.

🚀 Cloudflare has acquired The Astro Technology Company and will integrate the Astro web framework into its platform while keeping the project open source under the MIT license. All full-time Astro employees have joined Cloudflare and the company pledges continued support for the Astro Ecosystem Fund alongside partners. Astro 6 is in public beta, featuring a redesigned development server built on the Vite Environments API, stable Live Content Collections, improved Content Security Policy support, and simpler APIs.

🤝 Cloudflare has acquired Human Native, a UK AI data marketplace that converts multimedia into licensed, structured datasets for AI developers. The team will help Cloudflare expand tools like AI Crawl Control, Pay Per Crawl and the AI Index, enabling publishers to expose structured updates and control access. It emphasizes licensed, high-quality data, creator compensation and greater control over how content is used by AI systems.