On October 15, 2026, Cloudflare added a Forward action and Custom Functions to Cloudflare Gateway, running your own code at the exact moment a security policy makes its decision. If you maintain NGINX proxy pools for header injection or Logpush pipelines for alerting, replace them with a single Worker.
On 15 October 2026, Cloudflare added reusable BGP filter profiles to Cloudflare WAN and Magic Transit IPsec and GRE tunnels, applied without resetting the BGP session. If you announce prefixes through Cloudflare, build an allow-list export filter now to prevent route leaks.
On October 16, 2026, four months after buying VoidZero, Cloudflare releases Void as open source — a platform companies can self-host to deploy and govern the internal applications employees build with AI. If your staff already vibe-codes its tools, Void gives those apps a home — but not yet a mandatory security review.
On October 9, 2026, Cloudflare made on-demand CPU and memory profiling generally available for Workers and Durable Objects, with interactive flamegraphs generated directly in production. Use it to chase memory leaks and hot functions instead of guessing from logs and aggregate metrics.
Cloudflare is absorbing Ryan Dahl’s Deno team and merging the workerd runtime with celld, Deno’s open-source implementation of Workers and Durable Objects released in August. If you want to run Worker-style apps on your own infrastructure, celld is now the path to watch.
On 29 September 2026, Cloudflare announced its intent to become a public certificate authority, twelve years after launching Universal SSL, with a root acquired from GlobalSign and applications to the Chrome, Apple, Microsoft, and Mozilla root programs. It is targeting post-quantum certificates and Merkle Tree Certificates as early as Q1 2027: a second mass-scale free provider is taking shape, and your ACME deployment chain must be able to switch.
Cloudflare folds logs, traces, alerts, and analytics into a single platform, and opens Traces in beta to follow a request end to end. Unified pricing lands on December 1, 2026, so audit your log volumes now.
On September 24, 2026, Cloudflare disclosed that a thin provisioning setting in Cloudflare Containers let a customer read data another customer had left behind on the same server. Customers have nothing to do, but the flaw is a reminder that cloud multi-tenant isolation can hinge on a single default parameter.
The public resolver 1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, the NIST-standardized post-quantum algorithm whose every signature weighs 2,420 bytes. It is the first Internet-scale test of carrying oversized DNS responses and blocking downgrade to weakened algorithms.
On August 31, 2026, between 07:35 and 21:45 UTC, an attacker compromised a Coder Cloudflare API key and redirected part of the module registry’s traffic to a malicious server that exfiltrated cloud credentials. Check your logs for coder-infra[.]com and rotate the affected secrets.
On July 1, 2026, Cloudflare replaced its one-click ’Block AI Bots’ switch with three distinct classes — Search, Agent, and Training. On September 15, 2026, Training and Agent bots will be blocked by default on pages that show ads: check your settings before that date.
In late August 2026 Cloudflare released EmDash, a TypeScript CMS pitched as the spiritual successor to WordPress, and moved its own blog onto it. The core idea is one mechanism: isolating every plugin in a sandbox with declared permissions, where 96% of WordPress flaws come from plugins.
On September 1, 2026, Cloudflare detailed Cache Transcoding, a prototype that compresses eligible assets with Zstandard directly inside Pingora. Encoding shrinks on-disk size to roughly a third, for a few points of CPU, and cuts bandwidth between data centers.
Between August 7 and 14, 2026, Cloudflare logged thirteen distinct incidents in eight days, touching R2, Workers KV, Durable Objects, and regional traffic across four continents. The lesson is not to flee the edge but to instrument the path between origin and user — where failures escape your monitoring.
Cloudflare’s H1 2026 DDoS report documents an explosion of hyper-volumetric attacks and reflection vectors built on DNS and CLDAP. Attacks now last seconds, which makes manual mitigation structurally obsolete.
Cloudflare unveiled Kitesurf, a headless Rust browser purpose-built for AI agents on the Workers platform, delivering 3–7× CPU and memory savings versus Chromium. DevOps teams running autonomous agents should evaluate it before the beta window closes.
On August 5, 2026, Cloudflare open-sourced Cloudflare OS, a platform that gives every employee an AI agent connected to internal systems, with a governance framework that tracks what the agent has read.
Cloudflare absorbs 500 Tbps of network traffic and OVHcloud protects every server against attacks up to 1.3 Tbit/s at no extra cost. The difference between DNS amplification and Slowloris changes everything about how you choose your protection.
NIST published SP 800-207 in August 2020, the Biden administration mandated Zero Trust for all US federal agencies in January 2022, and Google has been running BeyondCorp internally since 2011 without a VPN. If your network security still relies on the assumption that a packet is clean because it originated on the LAN, you have already lost.
