Skip to content

Accept All すべて承認

Cloudflare Blog

14 stories

Cloudflare BlogTools4 real? Tracking exploitation and patching of eMudhra’s weak keys On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they…

Cloudflare BlogToolsCloudflare services for private origins is now generally available Today, Cloudflare services for private origins is generally available. Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection .

Cloudflare BlogToolsCloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following…

Cloudflare BlogToolsIntroducing the Cloudflare PHP Capture the Flag challenge Update — October 30, 2026: Thank you to everyone who has participated in the PHP Capture the Flag challenge.

Cloudflare BlogToolsCross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic , to a tenant isolation issue affecting the GLM-5.3 Workers AI model ( @cf/zai-org/glm-5.3 ) starting on August…

Cloudflare BlogToolsOrigin Range Requests: Serving large files without range-request tuning A video player seeking to the middle of a movie asks for a few megabytes. Under our old range caching, that one request could make Cloudflare pull 128 MiB from the origin and move it between data…

Cloudflare BlogToolsBringing post-quantum cryptography to geographically fenced key management Today, Cloudflare is launching a post-quantum geographically restricted key manager in support of our Data Localization Suite (DLS) in closed beta.

Cloudflare BlogToolsIntroducing full transaction detection for Cloudflare WAF Today, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules.

Cloudflare BlogToolsCloudflare deploys protections against php2shell vulnerability Update - On October 23, the PHP project published an informational advisory for a related vulnerability, CVE-2026-115560, in PHP's session upload progress feature.

Cloudflare BlogToolsHow Commerce.com and Cloudflare are getting storefronts ready for AI agents AI can write code and pass the bar exam, but it still struggles to buy a pair of shoes online. That’s because websites were built for humans, not agents.

Cloudflare BlogTools8 eMudhra certificates are compromised. Here's what you need to know On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised.

Cloudflare BlogToolsIntroducing tsrs: A port of TypeScript to Rust Cloudflare and VoidZero are now working with Max Schwenk of Owner.com on tsrs , a Rust port of the TypeScript compiler.

Cloudflare BlogToolsCutting our inference bill by 68% by being obsessive about optimization When we previously blogged about our AI code reviewer in April , an average review cost a palatable $1.19. By the end of August, that figure had shot up to about $2.46.

Cloudflare BlogToolsIntroducing Clairic, a new System One class of extraction models Today, we're announcing a preview of a new class of System One-style models: extraction models. Our first one, Clairic, is available hosted on Workers AI as @cf/cloudflare/clairic.

On the calendar

予定 · Conferences and launch events, this week's stories from each corner of the industry, and what its press is covering — in English

On view

This week, from that corner the newest stories from the corner of the industry you picked

The wire their own posts, translated

How code moves in 2026 from the industry's own reports

Sources

Fetched every six hours, linked to the original

About

The name is the button.

An agent writes the code now, and a human thumb hovers over Accept all a hundred times a day. The honest question of this decade is what, exactly, you just accepted. So I read the diff.

Eight years as a backend engineer in Stockholm, back in Tokyo since 2023, and I still ship something small most nights, usually badly. My one rule: the only real review of a model is the thing you built with it. That is why there is no leaderboard on this site.

Around a hundred and forty sources come through — the labs' own posts, the papers, the tools, the runtimes and languages nobody is watching yet, the chip under the demo, and the newsletters people actually forward. What is moving gets counted so the week reads at a glance, and every few days I explain one mechanism in plain words.

A story here is a headline, a short excerpt, one image and the link to whoever wrote it. We never reproduce the post; the images belong to their authors. A post written in Japanese appears in Japanese, exactly as it was published, and the link goes to the original.

— Yuki Halvorsen, Tokyo