All news with #cloudflare tag

🧩 Cloudflare has extended Workers RPC to enable direct cross-language calls between JavaScript and Python Workers. Using Pyodide’s FFI and a custom type-conversion layer, objects, functions, keyword arguments and callbacks translate seamlessly across the boundary. The workers-runtime-sdk provides native Python wrappers for Web API objects, and no extra dependencies are required to call Python from JS or vice versa. Examples include calling Python packages like Pygments from JavaScript using simple Service bindings.

🧾 Cloudflare announced a new Billable Usage API for self-serve accounts that returns usage and cost by product and charge period in a machine-consumable format. The single endpoint covers usage-based products like Workers, R2, D1, Workers AI, Vectorize, Images, and Stream, with daily updates today and more real-time data planned. The response aligns with the FinOps Open Cost and Usage Specification (FOCUS) naming and integrates natively with Vantage for cost reporting, budgets, and alerts.

🛠️ Cloudflare announces private beta support for inbound TCP connections and expanded gRPC capabilities on Workers. The update adds a connect() handler to accept raw sockets, routing via Durable Objects and Containers, and a Spectrum integration to expose TCP applications. Developers can deploy bidirectional gRPC servers in any language, use gRPC-web translation for Workers, and leverage Cloudflare’s global network for low-latency, real-time voice and AI applications.

🤖 This week Cloudflare is hosting Agents Week to explore what an Agent Cloud must provide for autonomous software agents. The company reframes the question away from human-centric design toward agent-native needs for speed, structure, and access. The series will cover primitives, the agentic development lifecycle, secure enterprise integration, and how agents reshape the web. Readers are invited to query their own agents and share insights.

🛰️ Cloudflare has added isolation and access controls to its global Media over QUIC (MoQ) network by introducing a provisioning API that creates isolated relays (scopes) and issues publish/subscribe tokens. The relays are available across Cloudflare’s network within seconds with no servers to deploy and support draft-14 and draft-16 MoQ transport features; the beta is free to use. Tokens are scoped, revocable, and manageable via API or dashboard, and Cloudflare is documenting the control-plane model as an IETF Internet-Draft for broader interoperability.

🛠️ cdnjs, a major open-source CDN for JavaScript and CSS, now runs entirely on the Cloudflare Developer Platform. The migration centralized file content in R2, moved metadata to KV, and rebuilt the publishing pipeline with Workflows, Queues, Containers, and Durable Objects. The change improved observability, simplified architecture, and introduced multi-region mirrors with DigitalOcean Spaces as a live fallback.

🔒 Cloudflare now supports post-quantum authentication for Authenticated Origin Pulls and the Custom Origin Trust Store using ML-DSA signatures. This enables mutually authenticated TLS between Cloudflare and customer origin servers to resist quantum-enabled impersonation attacks. The company describes configuration steps, verification methods, and engineering changes made to support ML-DSA in its control and data plane services.

🛰️ In Q2 2026 Cloudflare Radar documented notable Internet disruptions worldwide, from Super Typhoon Sinlaku near Guam to frequent government-mandated shutdowns in Sudan. The quarter also included Iran’s partial restoration after an 88-day blackout, AWS region outages following drone strikes, a DNSSEC mishap affecting Germany’s .de zone, and a submarine cable cut impacting Saint Lucia. These incidents highlight the fragility and interdependence of global Internet infrastructure.

🔒 Cloudflare has open sourced pvcli, a command-line tool designed to simplify debugging and testing of privacy-preserving protocols such as Oblivious HTTP (OHTTP). The tool automates binary HTTP encoding, key parsing, encryption steps, and protocol flows across relay, gateway, and origin, replacing fragile, script-heavy workflows. Released under the Apache-2.0 License, pvcli supports curl-like arguments, detailed logs, headers forwarding, and mTLS, and will expand to include MASQUE and other privacy protocols.

📘 Cloudflare examines the BGP ORIGIN attribute, a mandatory path attribute intended to signal how a route was injected into BGP. Their experiments show widespread modification of ORIGIN values—predominantly to IGP—by many networks, including Tier-1s, altering route selection and diverting traffic for commercial advantage. The report describes methodology, measurements across IPv4/IPv6, and the resulting routing and economic impacts.

🛠️ Cloudflare announced Cache Response Rules, a new rule type that runs after an origin response arrives but before Cloudflare caches it. These rules let you rewrite Cache-Control, manage cache-tags, and strip headers like Set-Cookie, ETag, and Last-Modified without changing the origin. The feature complements existing Cache Rules by giving the response phase final control over whether and how Cloudflare caches content.

📈 Cloudflare Radar analyzed HTTP, DNS, and security signals across its global network during the June–July 2026 World Cup to measure how matches changed Internet activity. Using a four-week median baseline and log2 ratios, the study compared per-country deviations by kickoff time, revealing large spikes for overnight matches and smaller evening bumps. The report ranks matches and teams by worldwide impact and examines regional behaviors, streaming effects, and distinct halftime and hydration-break patterns.

🔒 Cloudflare Internal DNS is now generally available, providing authoritative and recursive DNS for private networks on the same control plane used for public DNS, Zero Trust, and networking. It consolidates public and private DNS management, simplifies split-horizon setups, and extends Zero Trust enforcement to DNS. Enterprise customers get this capability included with Cloudflare Gateway, with Terraform support and integration across Cloudflare connectivity methods.

🛡️ Cloudflare has deployed new Web Application Firewall protections to block two critical WordPress vulnerabilities: an unauthenticated RCE in the REST API and a related SQL injection. The rules, activated on July 17, 2026 at 17:03 UTC, protect all proxied customers including Free plans. Customers should still apply WordPress patches (7.0.2 and backports) and ensure Managed Rules remain set to Block while monitoring Security Events.

🛡️ On July 3, 2026, Albania's .AL TLD experienced a failed DNSSEC key rollover that caused widespread validation failures for validating resolvers, including Cloudflare's 1.1.1.1. Cloudflare applied a Negative Trust Anchor (NTA) to restore resolution and for the first time returned a new Extended DNS Error (EDE 33) to signal that DNSSEC validation had been bypassed. The change provides visibility into responses served under an NTA and complements EDE codes like EDE 9 to show the underlying DNSSEC failure.

🔍 Precursor is a client-side, session-scoped verification system from Cloudflare that continuously collects behavioral signals via a lightweight injected script to distinguish humans from bots across an entire user journey. It complements Turnstile as part of Enterprise Bot Management, feeding session-level signals into edge evaluators and existing bot-scoring and challenge systems. Designed with privacy in mind, Precursor captures minimal interaction metadata (timing, rhythms, movement patterns) rather than content and provides session-based analytics in Security Analytics. It is rolling out now and will be free until GA.

🛡️ QiAnXin attributes a new Rust-based remote access trojan named MODBEACON to the China-linked Silver Fox cluster. The memory-resident implant uses a modular, plugin-based architecture and leverages gRPC tunnel streaming with transport borrowed from open-source proxy tools (Xray/V2Ray) for its C2 channel. Distributors push the malware via counterfeit installers promoted through SEO poisoning and host C2 infrastructure on Amazon and Cloudflare CDNs.

🔧 Smart Tiered Cache now supports public cloud regions by accepting a user-provided region hint. Cloudflare maps ambiguous anycast or regional unicast origins to the correct cloud region so it can select optimal primary and fallback upper tiers, improving cache efficiency and reducing hairpin latency. The feature is available via dashboard, API, and Terraform and initially supports AWS, GCP, Azure, and Oracle Cloud.

🔒 Cloudflare explains why ML‑DSA, the NIST‑standardized post‑quantum signature, must be used for the initial migration even though better schemes may arrive later. The post‑quantum transition is underway: most traffic already uses ML‑KEM encryption, and Cloudflare targets full post‑quantum protection by 2029. The post outlines tradeoffs among candidate signature families — size, speed, and implementation risks — and highlights why specialization and generalist schemes will both be needed.

🟢 Cloudflare introduces Meerkat, an experimental distributed consensus service designed to provide strong consistency and global fault tolerance across 330+ data centers. Built atop the QuePaxa algorithm, Meerkat lets every replica accept writes and avoids leader-timeout availability failures common in Raft. Initially internal, Meerkat hosts applications like a transactional key-value store and leasing system by converting client operations into a replicated log, ensuring linearizability and majority-based safety.