cloudflare·Mar 27, 2026·2 min readCurated summary

How we use Abstract Syntax Trees (ASTs) to turn Workflows code into visual diagrams

Cloudflare uses Abstract Syntax Trees (ASTs) to turn code-based Workflows into visual diagrams. Because Workflows execute dynamically—supporting parallel promises, awaits, loops, and conditionals—the system analyzes code structure and relationships to infer execution order. The resulting diagrams help developers understand workflow shape, especially as coding agents generate more application code. ## Why Code-Based Workflows Are Difficult to Visualize - Unlike declarative workflow builders, Cloudflare Workflows are ordinary code. - Workflows may contain: - `Promise` and `await` relationships - `Promise.all` for parallel execution - Loops and conditionals - Steps nested inside functions or classes - The runtime discovers and executes steps as it encounters them, rather than following a predefined sequence. - Unawaited steps can execute in parallel, while `await` establishes blocking dependencies. ## How Workflow Execution Works - A supervisor Durable Object, called the engine, starts for each workflow instance. - The engine dispatches execution to the user Worker. - When the Worker encounters `step.do`, control returns to the engine. - The engine executes the step, persists its result or error, and invokes the Worker again. - Since the engine does not inherently retain the complete intended order of steps, diagram generation must reconstruct those relationships from the source code. ## Parsing and Building the Workflow Graph - Cloudflare fetches the bundled Worker script at deployment time. - A parser converts the script into an Abstract Syntax Tree. - An internal service: - Identifies `WorkflowEntrypoints` - Finds calls to workflow steps - Builds and traverses an intermediate graph - Produces the final diagram through Cloudflare’s API - AST analysis tracks promises and `await` expressions to determine: - Which steps depend on one another - Which steps block execution - Which steps can run concurrently ## Handling Bundled and Minified JavaScript - Workers are generally bundled with tools such as esbuild and may be minified. - Minified output can obscure the original TypeScript structure and vary between bundlers. - The diagram system therefore has to recognize workflow patterns in dense, transformed JavaScript. - For example, several agent steps—such as summary, correctness, and clarity agents—may be created without awaiting them, indicating parallel execution. - The generated graph makes that concurrency visible even when the deployed code is difficult to read. Cloudflare’s AST-based approach provides a practical way to visualize dynamic, code-defined workflows. Developers can inspect how steps connect, branch, and execute in parallel directly from the dashboard, though the beta diagrams will continue to improve as more workflow patterns are supported.

Read original(opens in new tab)

CloudflareTypeScriptJavaScriptWorkers+4

cloudflare·Mar 26, 2026·2 min readCurated summary

A one-line Kubernetes fix that saved 600 hours a year

Atlantis restarts were taking about 30 minutes, blocking infrastructure changes and consuming more than 50 engineering hours monthly. The delay was caused by Kubernetes recursively changing ownership on a large Ceph-backed PersistentVolume containing millions of files. Setting `fsGroupChangePolicy: OnRootMismatch` avoided unnecessary recursive ownership changes and reduced restart time dramatically. ### The Restart Bottleneck - Atlantis runs as a singleton Kubernetes `StatefulSet`. - Its PersistentVolume stores repository and Terraform state. - Credential rotations, onboarding, and offboarding required restarting Atlantis. - With roughly 100 restarts per month, each 30-minute delay created more than 600 hours of annual lost engineering time. - The volume had grown large enough to exhaust inodes, making storage expansion and pod restarts necessary. ### Kubernetes Made the Delay Look Like a Scheduling Problem - `kubectl rollout restart statefulset atlantis` terminated the old pod and created a replacement. - The new pod was scheduled quickly but remained stuck in `Init:0/1`. - Kubernetes events showed the image pulling successfully, but revealed no obvious cause for the long gap. - Kubelet logs showed the PersistentVolume mounting successfully, followed by repeated `context deadline exceeded` errors while syncing the pod. ### The Hidden Cost of `fsGroup` - Searching logs using the PersistentVolume name exposed the relevant message: - Kubernetes was “setting volume ownership” because an `fsGroup` was configured. - Kubernetes warned that ownership changes could be slow when a volume contained many files. - The default behavior recursively changed ownership across the entire mounted volume. - As Atlantis’s volume accumulated millions of files, this initialization step became the 30-minute bottleneck. ### The One-Line Fix - The volume configuration was changed to: ```yaml fsGroupChangePolicy: OnRootMismatch ``` - With this policy, Kubernetes checks the root directory’s ownership and only performs recursive changes when necessary. - Existing volumes with the correct ownership no longer require a full filesystem traversal during every restart. The practical lesson is to inspect kubelet and volume logs when a pod appears scheduled but remains stuck before initialization. For large persistent volumes, explicitly setting `fsGroupChangePolicy: OnRootMismatch` can eliminate costly recursive ownership changes and prevent substantial operational downtime.

Read original(opens in new tab)

Database DesignKubernetesTerraformPersistent Storage+4

cloudflare·Mar 24, 2026·3 min readCurated summary

Sandboxing AI agents, 100x faster

Cloudflare argues that AI-generated code needs secure execution, but traditional containers are too slow, memory-intensive, and difficult to scale for consumer-scale agents. Its Dynamic Worker Loader uses lightweight V8 isolates to create disposable, isolated sandboxes in milliseconds, with controlled access to APIs and no internet connectivity. The result is a sandbox roughly 100 times faster and substantially more memory-efficient than containers, provided agents can write JavaScript. ## Why Containers Fall Short - AI-generated code cannot safely run directly through `eval()`, since prompts could cause the model to introduce vulnerabilities. - Containers provide isolation but typically: - Take hundreds of milliseconds to start - Consume hundreds of megabytes of memory - Require warm instances to reduce latency - May encourage unsafe container reuse - These limitations make containers poorly suited to running a fresh sandbox for every request or user agent. ## Dynamic Worker Loader - Cloudflare’s Dynamic Worker Loader lets a Worker instantiate another Worker dynamically from runtime-provided code. - The host can: - Supply generated JavaScript modules - Expose selected APIs through RPC stubs - Disable or intercept outbound internet access - Invoke methods exported by the dynamically loaded Worker - The feature is in open beta for paid Workers users. ## Faster, Smaller Isolates - Dynamic Workers use V8 isolates, the same sandboxing technology underlying Cloudflare Workers. - Isolates: - Start in a few milliseconds - Use only a few megabytes of memory - Are approximately 100 times faster and 10–100 times more memory-efficient than typical containers - A new isolate can be created for one request and discarded afterward without maintaining a pool of warm sandboxes. ## Scalability and Latency - Dynamic Worker Loader has no container-style global concurrency or sandbox-creation limits. - It relies on the infrastructure that already scales Cloudflare Workers to millions of requests per second. - Each request could theoretically load its own isolated sandbox, even at very high concurrency. - Dynamic Workers commonly run on the same machine or thread as their parent Worker, avoiding network round trips and warm-sandbox lookup delays. - They are available across Cloudflare’s global network. ## JavaScript as the Agent Runtime - The main limitation is that agent-generated code should generally be JavaScript. - Workers also support Python and WebAssembly, but JavaScript is faster to load for short-lived snippets. - Cloudflare argues this is acceptable because: - LLMs can generate major programming languages - JavaScript has extensive training data - JavaScript was designed for web-based sandboxed execution ## TypeScript APIs for Agent Tools - Agents still need access to external capabilities such as chat systems and APIs. - TypeScript interfaces provide a concise way to describe these programming APIs. - Compared with MCP’s flat tool schemas or verbose OpenAPI specifications, TypeScript can express: - Methods and parameters - Return types and promises - Objects such as messages - Subscription and disposal behavior - This gives agents precise API knowledge with fewer tokens and lets them write direct code rather than issuing numerous tool calls. Dynamic Worker Loader is presented as a practical foundation for secure, disposable AI-agent execution: use V8 isolates for low-latency sandboxing, expose only narrowly defined TypeScript/RPC capabilities, and block network access unless explicitly required.

Read original(opens in new tab)

Large Language ModelsTypeScriptJavaScriptCloudflare Workers+4

cloudflare·Mar 23, 2026·3 min readCurated summary

Launching Cloudflare’s Gen 13 servers- trading cache for cores for 2x edge compute performance

Cloudflare’s Gen 13 servers use AMD EPYC 5th Gen Turin processors to provide up to twice as many cores as Gen 12. However, Turin’s much smaller per-core cache caused the legacy FL1 request-handling layer to suffer severe latency increases, despite higher throughput. Cloudflare found that tuning alone could not fully solve the problem, reinforcing the need for FL2, a Rust-based rewrite designed to scale with cores rather than depend heavily on cache. ## Turin’s Core-Heavy Architecture - Gen 13 Turin processors offer: - Up to 192 cores and 384 SMT threads, compared with Gen 12’s 96 cores. - Improved instructions per cycle through the Zen 5 architecture. - Up to 32% lower power consumption per core. - DDR5-6400 support for greater memory bandwidth. - The tradeoff is substantially less cache: - Gen 12 Genoa-X provides 12 MB of L3 cache per core through 3D V-Cache. - The 192-core Turin 9965 provides only 2 MB per core. - This architecture favors aggregate throughput but challenges workloads dependent on cache locality. ## FL1’s Cache and Latency Problems - FL1, based on NGINX and LuaJIT, was optimized for Gen 12’s large cache. - AMD uProf measurements showed: - Dramatically higher L3 cache miss rates on Turin. - More requests requiring slow DRAM access. - Increasing latency as CPU utilization and cache contention rose. - An L3 hit takes roughly 50 CPU cycles, while a DRAM fetch can take more than 350 cycles. - As a result, Gen 13’s additional cores delivered throughput gains but introduced unacceptable latency penalties. ## Throughput Gains at an Unacceptable Cost - With FL1, Gen 13 produced: - 10% more throughput on the 128-core Turin 9755. - 31% more on the 160-core Turin 9845. - 62% more on the 192-core Turin 9965. - The Turin 9965 offered the strongest total-cost-of-ownership benefits. - However, latency increased by more than 50% at high CPU utilization, which would negatively affect customer experience and violate performance requirements. ## Hardware and Resource Tuning - Cloudflare tested several mitigations with AMD: - Hardware prefetcher and Data Fabric Probe Filter adjustments produced only marginal improvements. - Adding FL1 workers increased throughput but took resources away from other services. - CPU pinning and isolation provided limited benefits. - AMD’s Platform Quality of Service (PQOS) was used to control cache and memory-bandwidth sharing across Turin’s Core Complex Dies. ## Cache Isolation with PQOS - Reserving part of a single CCD’s cache for FL1 produced less than 5% additional throughput. - Configurations assigning FL1 50–75% of each CCD’s cache also delivered less than 5% improvement and caused minor degradation elsewhere. - A socket-level approach was more successful: - Six of twelve CCDs, aligned with a NUMA domain, were dedicated to FL1. - This provided more than 15% incremental throughput while keeping latency acceptable. - These results showed that workload placement and cache locality could help, but they were not a complete substitute for software designed around Turin’s cache profile. Cloudflare’s broader solution was FL2, a Rust-based rewrite of its core request-handling layer. By reducing dependence on large per-core caches, FL2 enabled Gen 13’s higher core count to translate into scalable edge-compute performance without the latency penalties seen with FL1.

Read original(opens in new tab)

Database DesignRustNginxParallel Processing+4

cloudflare·Mar 23, 2026·3 min readCurated summary

Inside Gen 13- how we built our most powerful server yet

Cloudflare’s Gen 13 server is a hardware redesign aligned with its Rust-based FL2 request-processing stack. By choosing a 192-core AMD EPYC Turin 9965, doubling memory, expanding storage and networking, and adding stronger security and accelerator support, Cloudflare targets up to twice the throughput of Gen 12 while remaining within latency limits. The design also improves efficiency, rack density, and operational simplicity. ## Gen 13 at a Glance - Uses a 2U, single-socket design. - Key specifications: - 192-core AMD EPYC 9965 processor - 768 GB of DDR5-6400 memory - Three 7.68 TB E1.S PCIe 5.0 NVMe drives - Dual 100 GbE OCP 3.0 networking - 1,300W Titanium-grade power supply - ASPEED AST2600 BMC and AST1060 hardware root of trust - Compared with Gen 12, Gen 13 provides: - Up to 2× throughput - Up to 50% better performance per watt - Up to 60% more throughput per rack at the same power budget - Twice the memory capacity, 1.5× the storage, and 4× the network bandwidth - PCIe encryption in addition to memory encryption - Better support for high-heat PCIe accelerators ## Choosing the CPU - Gen 12 used a 96-core AMD EPYC Genoa-X 9684X with: - 400W TDP - 1,152 MB of L3 cache - Cloudflare evaluated three Turin processors: - 9755: strongest per-core performance - 9845: lower socket power and fewer cores - 9965: highest core count and better efficiency - The Turin 9965 was selected with 192 cores and 384 threads, doubling Gen 12’s hardware threads. - Its L3 cache is much smaller—384 MB total, or 2 MB per core versus Gen 12’s 12 MB per core—but FL2 workloads depend less on large L3 caches than the previous FL1 stack. - FL2 scales nearly linearly with additional cores, allowing the 9965 to deliver up to 100% higher throughput. - Production testing showed the 9965 achieved the best aggregate requests per second and favorable performance per watt at its 500W TDP. - Higher compute density also means fewer servers to provision, patch, monitor, and operate. - Turin’s support for DDR5-6400, PCIe 5.0, and CXL 2.0 provides a longer upgrade and security-support runway. ## Memory Bandwidth and Capacity - Gen 13 doubles memory from 384 GB to 768 GB while retaining 4 GB per core. - All twelve memory channels are populated using one 64 GB DDR5-6400 ECC RDIMM per channel. - This configuration delivers approximately 614 GB/s of peak memory bandwidth per socket, a 33.3% increase over Gen 12. - Using identical DIMMs across all channels enables balanced interleaving, distributing memory accesses across the full memory subsystem. - The design is intended to prevent the 192-core processor from being starved of data during highly parallel workloads. Cloudflare’s central design choice was to match hardware to the characteristics of FL2 rather than preserve Gen 12’s cache-heavy strategy. For workloads that scale well across cores, the Turin 9965 and fully populated memory system offer higher throughput, better rack economics, and simpler fleet operations.

Read original(opens in new tab)

RustAmd EpycDdr5Nvme+3

cloudflare·Mar 19, 2026·3 min readCurated summary

Powering the agents: Workers AI now runs large models, starting with Kimi K2.5

Cloudflare is expanding Workers AI beyond smaller models by adding Moonshot AI’s Kimi K2.5, a frontier open-source model designed for agentic workloads. With a 256k context window, tool calling, vision, and structured outputs, Kimi can power an agent’s full lifecycle directly on Cloudflare’s platform. Cloudflare argues that its price-performance makes open-source models essential as personal and enterprise agents dramatically increase inference demand. ## Kimi K2.5’s Price-Performance Advantage - Cloudflare uses Kimi internally for: - Agentic coding through OpenCode - Automated code review via the Bonk public code review agent - Security analysis of Cloudflare codebases - A security-review agent processes more than 7 billion tokens daily and has found over 15 confirmed issues in one codebase. - Compared with a mid-tier proprietary model, switching to Kimi reduced the estimated cost of this workload by 77%, from roughly $2.4 million annually. - As employees increasingly run multiple agents continuously, inference costs become a major barrier to scaling. - Cloudflare positions open-source, frontier-quality models as a more economical alternative to proprietary systems. ## Serving Large Models on Workers AI - Supporting Kimi required upgrades to Workers AI’s inference stack, which historically focused on smaller models. - Cloudflare uses its proprietary Infire inference engine and custom kernels to improve: - Model performance - GPU utilization - Throughput - The platform applies advanced serving strategies such as: - Data, tensor, and expert parallelization - Disaggregated prefill, separating input processing from generation across machines - Workers AI handles these infrastructure optimizations so developers do not need specialized machine learning, DevOps, or reliability engineering expertise. ## Prefix Caching for Agent Workloads - Agents frequently resend large prompts containing: - System instructions - Tool definitions - MCP server tools - Conversation history - Entire codebases - Prefix caching avoids reprocessing unchanged input tokens during multi-turn interactions. - This reduces prefill work, improving: - Time to First Token (TTFT) - Tokens Per Second (TPS) - Overall inference cost - Workers AI now exposes cached tokens as a usage metric and charges less for them than regular input tokens. - Cloudflare has also introduced techniques to improve cache hit rates. ## Session Affinity - Workers AI provides an `x-session-affinity` header to route requests from the same session or agent to the same model instance. - Keeping requests on the same instance increases prefix-cache reuse. - Higher cache hit rates lead to faster responses, greater throughput, and lower costs. - Clients should provide a unique session or agent identifier with the header. Cloudflare’s recommendation is to use Workers AI when building agents that need frontier-level reasoning without the cost and operational burden of proprietary models or self-hosted infrastructure.

Read original(opens in new tab)

Database DesignLarge Language ModelsKubernetesCloudflare+4

cloudflare·Mar 18, 2026·2 min readCurated summary

Introducing Custom Regions for precision data control

Cloudflare is expanding Regional Services with three new managed regions—Turkey, the UAE, and IRAP—and introducing Custom Regions. The feature lets customers define exactly where TLS termination and Layer 7 processing occur while still using Cloudflare’s global network for traffic ingestion and DDoS protection. This combines local data-sovereignty control with globally distributed security and performance. ## Global Security with Local Compliance - Traffic enters through the nearest Cloudflare data center, where Cloudflare applies global-scale Layer 3 and Layer 4 DDoS protection. - Before decryption, request metadata is inspected and traffic is routed over Cloudflare’s private backbone to a data center inside the customer’s designated region. - TLS termination and Layer 7 services—including WAF, Bot Management, and Workers—run only within that region. - After processing, traffic is re-encrypted and sent securely to the origin. - This design localizes data inspection without forcing customers to sacrifice Cloudflare’s global attack-mitigation capacity. ## Expanded Cloudflare Managed Regions - Regional Services originally supported the EU, UK, and U.S. - Cloudflare now offers 35 predefined regions. - Newly added options include: - Turkey - United Arab Emirates - IRAP, supporting Australian compliance - ISMAP, supporting Japanese compliance ## Custom Regions - Customers can define their own geographical boundaries instead of selecting only Cloudflare-managed regions. - Custom Regions support: - Individual countries - Arbitrary combinations of countries - Regions that exclude specified countries - Early-access use cases include: - Keeping AI prompts and responses within selected countries - Running country-specific promotions - Meeting government contractual requirements - Aligning regions with corporate structures such as EMEA, MENA, or APAC - Example definitions include North America, everywhere except North America, or countries where Fahrenheit is commonly used. ## How Region Enforcement Works - A region represents a set of Cloudflare data centers. - Managed regions use Cloudflare-defined membership. - Custom Regions use expressions, commonly based on the data center’s ISO country code: - `country_code == "TR"` selects Turkey. - `country_code in ["DE", "FR", "NL"]` selects Germany, France, and the Netherlands. - Negated expressions can exclude specific countries. - The same Regional Services architecture applies regardless of who defines the boundary; Custom Regions simply give the customer control over the membership rules. Custom Regions are best suited to organizations with precise sovereignty, compliance, performance, or organizational requirements. They provide fine-grained control over where sensitive traffic is decrypted and processed while preserving Cloudflare’s global network protections.

Read original(opens in new tab)

CloudflareWeb Application FirewallAi InferenceDdos Mitigation+4

cloudflare·Mar 16, 2026·3 min readCurated summary

Standing up for the open Internet- why we appealed Italy’s Piracy Shield fine

Cloudflare argues that Italy’s “Piracy Shield” undermines the open Internet by allowing private media companies to order broad website and IP-address blocks without judicial oversight, transparency, or due process. After refusing to register with the system, Cloudflare was fined €14 million by Italy’s communications regulator, AGCOM, and appealed the penalty on March 8. The company is also challenging Piracy Shield’s legality under EU law. ### What Piracy Shield Does - Piracy Shield requires registered service providers to block websites and IP addresses within 30 minutes of a submission. - Blocking decisions are made through an electronic portal by an unidentified group of private Italian media companies. - The system provides: - No judicial oversight. - Little or no transparency about who requested a block or why. - No opportunity for website owners to challenge blocks beforehand. - No effective redress for wrongful blocking. - Cloudflare says the system’s design favors major rightsholders, including Italy’s Serie A soccer league. - The system was reportedly donated to the government by SP Tech, an arm of a law firm representing major beneficiaries. ### Problems with IP Blocking - Shared IP addresses can host thousands of unrelated websites, making accidental overblocking unavoidable. - Piracy Shield has caused outages affecting: - Ukrainian government, education, and research websites. - European small businesses and NGOs supporting women and children. - Google Drive, which was inaccessible to many Italian users for more than 12 hours. - A September 2025 University of Twente study found that legitimate sites were routinely blocked for months. - Despite these failures, AGCOM expanded the scheme to global DNS providers and VPNs, services closely linked to privacy and free expression. ### Cloudflare’s Legal Challenge - Cloudflare warned AGCOM in 2024 that Piracy Shield threatened the Internet’s technical architecture and proposed alternative approaches. - It later challenged AGCOM’s attempt to force Cloudflare to register with the system in Italian administrative courts. - Cloudflare and the CCIA also complained to the European Commission, arguing that Piracy Shield conflicts with the EU Digital Services Act. - The DSA requires content restrictions to be proportionate and governed by meaningful procedural safeguards. - The European Commission criticized Piracy Shield’s lack of oversight in a June 2025 letter. - In December 2025, an Italian administrative court ordered AGCOM to provide Cloudflare with records supporting its blocking orders, though Cloudflare says it has not yet received them. ### The €14 Million Fine - AGCOM issued the fine on December 29, 2025, shortly after being ordered to disclose Piracy Shield records. - Cloudflare argues that the penalty’s timing and calculation raise serious concerns. - The article ends while beginning to discuss Italian legal limits on fines and the alleged flaws in AGCOM’s calculation. Cloudflare’s position is that copyright enforcement cannot justify an opaque, privately operated blocking system with no effective safeguards. It recommends defending the legal and technical principles of an open Internet rather than expanding Piracy Shield.

Read original(opens in new tab)

CloudflarePiracy ShieldDigital Services ActIp Address Blocking+3

cloudflare·Mar 16, 2026·4 min readCurated summary

From legacy architecture to Cloudflare One

Moving from fragmented VPNs to Cloudflare One is presented as a gradual modernization effort rather than a risky “big bang” cutover. Cloudflare and CDW recommend a tiered, application-aware migration that combines Zero Trust controls with careful dependency analysis and staged deployment. The central conclusion is that legacy applications can gain modern security protections without immediate code rewrites or major downtime. ## Reducing Big-Bang Migration Risk - Large organizations may need to transition hundreds or thousands of applications and users from legacy VPNs. - A single firewall error, dependency failure, or session timeout can disrupt essential services. - These risks often prevent organizations from adopting Zero Trust despite vulnerable, aging infrastructure. - CDW applies lessons from failed deployments to create a risk-aware migration roadmap. - Applications are categorized by complexity, with simpler systems migrated first and legacy systems handled later under tighter controls. - A public-sector migration of 500 applications caused widespread disruption because more than 4,000 applications had not been prioritized or tiered. ## Treating Migration as Application Modernization - Traditional migrations often treat networks as basic connectivity infrastructure and overlook application ecosystems. - CDW analyzes: - Backend databases and APIs - Identity and authentication dependencies - Hidden service-to-service calls - Legacy session behavior - Security requirements are incorporated into the architecture from the beginning rather than added after connectivity is restored. - The migration becomes an application modernization program instead of a simple VPN replacement. ## Protecting Legacy Applications with Cloudflare Access - Cloudflare Access replaces broad network-level VPN access with request-by-request Zero Trust authorization. - Each request can be evaluated using: - User identity - Device posture - Hardware-based MFA - Other contextual signals - This limits lateral movement and reduces the attack surface. - Legacy applications can be “wrapped” with modern security controls without rewriting their code. - Cloudflare Tunnel provides: - An outbound-only connection - SSO and MFA integration - No public IP exposure for the application - Access policies can require endpoint MFA and a device health check before traffic reaches the server. - This approach allows organizations to modernize security incrementally while legacy applications continue operating. ## Pre-Migration Audit ### Architectural and Identity Assessment - Identify whether applications use a federated identity provider such as Okta or legacy local directories. - Map database, API, and backend dependencies. - Verify that hidden API calls and service-token-based Tunnel connections will continue functioning after migration. - Assess whether applying least-privilege controls could break application behavior. ### Establishing a Strategy and Implementation Firebreak - Create separate groups for: - Security strategy and standards - Deployment and operational implementation - This separation prevents deployment speed from overriding requirements designed to limit lateral movement. ### Testing Persistent Sessions - Identify applications that depend on persistent sessions, particularly for users switching between cellular towers. - Cloudflare’s edge architecture and Dynamic Path MTU Discovery (PMTUD) help maintain sessions even when client IP addresses change. - This assessment can identify opportunities to replace rigid legacy hardware with a modern single-pass architecture. ### Categorizing Applications and Setting Timelines - **Tier 0: Modern SaaS applications** - Native SAML/OIDC support - Cloudflare can act as a clientless identity-provider proxy - Estimated effort: 1–3 hours per application - **Tier 1: Internal web applications** - Support identity headers and modern web protocols - Use a clientless reverse proxy with Cloudflare Tunnel - Estimated effort: 3–6 hours per application - **Tier 2: Non-web client-server applications** - Require specific port/protocol support or thick-client configurations - Use both Cloudflare One Client and Cloudflare Tunnel - Estimated effort: 4–8 hours per application A phased migration built around application dependencies, identity readiness, session behavior, and technical complexity offers a safer path to Cloudflare One. Organizations should begin with an audit and pilot, secure legacy applications using Access and Tunnel, and expand tier by tier rather than attempting a single cutover.

Read original(opens in new tab)

Database DesignCloudflareZero TrustSase+4

cloudflare·Mar 12, 2026·2 min readCurated summary

Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humans

Cloudflare’s new Account Abuse Protection suite targets fraud from both bots and humans, focusing on whether activity is authentic rather than merely automated. It combines leaked-credential detection and account-takeover signals with new tools for identifying risky signups and suspicious identities. The capabilities are in Early Access for Bot Management Enterprise customers at no additional cost temporarily. ## Leaked Credentials and Account Takeover - Cloudflare reports that 41% of network logins use leaked credentials, with password reuse allowing old breaches to compromise valuable accounts. - Its leaked credential check compares hashed passwords against known breach data without storing or accessing plaintext passwords. - More than 60% of login-page traffic during the 2024 Black Friday analysis was automated, enabling attackers to test stolen credentials at scale. - Account takeover (ATO) detections identify customer-specific suspicious login behavior and expose attempted attacks in the Security analytics dashboard. - These detections caught an average of 6.9 billion suspicious login attempts per day across Cloudflare’s network during the referenced week. ## Fraud Requires More Than Bot Detection - Modern abuse combines automation, human fraud farms, device and location spoofing, and synthetic identities. - Attackers may use valid credentials, operate at human speed, or employ AI agents, making simple bot classification insufficient. - Common customer problems include fake users exploiting free trials, attackers logging in with correct passwords, and human-paced account draining. - Effective protection must evaluate intent, identity, and authenticity alongside automation. ## Detecting Suspicious Account Creation - Disposable email addresses allow attackers to create large numbers of accounts for promotions or other abuse without maintaining real email infrastructure. - Cloudflare’s disposable email check provides a binary signal that customers can use in security rules. - Organizations can block disposable addresses outright or challenge users who register with them. - Cloudflare also introduces email-risk assessment based on suspicious email patterns and infrastructure, helping identify potentially fraudulent signups. ## Privacy-Preserving User Identification - Hashed User IDs are per-domain identifiers created by cryptographically hashing usernames. - They help customers correlate suspicious activity and mitigate fraudulent traffic without exposing users’ original identifiers. - The feature is intended to identify risky account behavior while preserving end-user privacy. Cloudflare recommends enabling leaked-credential checks and using the new signup, identity, and behavioral signals together. This layered approach is better suited to fraud campaigns that blend valid credentials, human activity, and automated tools.

Read original(opens in new tab)

CloudflareBot ManagementFraud PreventionDatabase Security+4

cloudflare·Mar 11, 2026·3 min readCurated summary

Slashing agent token costs by 98% with RFC 9457-compliant error responses

Cloudflare argues that HTML error pages are poorly suited to AI agents, wasting tokens while offering little actionable guidance. It now provides RFC 9457-compliant Markdown and JSON responses for Cloudflare-generated errors, including instructions on whether to retry, wait, stop, or escalate. The structured formats reduce payload size and token usage by more than 98% compared with HTML. ## Problems with HTML Error Pages - Cloudflare errors often result from customer policies or edge conditions, including: - DNS or host configuration problems - WAF, geographic, ASN, or bot restrictions - Rate limits - Traditional responses contain large amounts of HTML, CSS, and human-oriented text. - Agents may struggle to identify: - What went wrong - Whether retrying is appropriate - How long to wait - Whether human intervention is required - Custom Error Rules are configuration-dependent and therefore cannot provide a consistent contract across websites. ## RFC 9457 Structured Responses - Cloudflare now supports structured responses for all 1xxx-class errors. - Clients can request: - `Accept: text/markdown` - `Accept: application/json` - `Accept: application/problem+json` - Markdown responses include: - YAML frontmatter with machine-readable fields - “What happened” and “What you should do” guidance - JSON responses expose the same information as a flat object. - Support for Cloudflare-generated 4xx and 5xx errors is planned next. ## Machine-Readable Error Guidance Responses include stable fields such as: - `error_code`, `error_name`, and `error_category` for classification - `retryable` and `retry_after` for automated backoff - `owner_action_required` to indicate when the agent should stop or escalate - `ray_id`, `timestamp`, and `zone` for debugging and support This allows agents to implement durable control flow without scraping HTML or interpreting changing prose. ## Compatibility with RFC 9457 Cloudflare’s JSON format follows the standard Problem Details structure: - `type`: Documentation URL for the error - `status`: Actual HTTP status code - `title`: Short problem description - `detail`: Explanation of the specific occurrence - `instance`: Identifier for the individual error, corresponding to the Ray ID Cloudflare-specific operational fields are included as RFC 9457 extension members. Clients that do not recognize those fields can safely ignore them. ## Example: Rate Limiting A Cloudflare 1015 response identifies the request as rate-limited and includes: - HTTP status `429` - Error code `1015` - Category `rate_limit` - A description stating that the website owner’s configuration caused the limit - A Ray ID and timestamp - Retry-related guidance for implementing backoff The change is automatic across Cloudflare’s network. Browsers continue receiving HTML, while agents receive structured instructions when they explicitly request Markdown or JSON.

Read original(opens in new tab)

CloudflareMarkdownJsonRate Limiting+3

cloudflare·Mar 11, 2026·3 min readCurated summary

AI Security for Apps is now generally available

Cloudflare’s AI Security for Apps is now generally available to help organizations discover, detect, and mitigate threats targeting AI-powered applications. The service protects AI endpoints through Cloudflare’s reverse proxy and integrates AI-specific signals with existing WAF controls. New GA features include free endpoint discovery for all customers, custom topic detection, and custom prompt extraction capabilities. ## Why AI Applications Create a New Attack Surface - Traditional applications follow predictable workflows, while AI applications accept natural-language input and produce probabilistic outputs. - Attackers can exploit models through: - Prompt injection - Sensitive information disclosure - PII exposure - Toxic or off-policy content - Unbounded resource consumption - Risks become more serious when AI agents can call tools to issue refunds, change accounts, apply discounts, or access customer data. - Organizations may struggle to maintain consistent safeguards as teams rapidly adopt new models and providers. ## AI Endpoint Discovery - AI Security for Apps automatically identifies LLM-powered endpoints across web properties, regardless of hosting location or model provider. - Discovery analyzes endpoint behavior rather than relying only on paths such as `/chat/completions`, since AI may also power search, valuation, and recommendation features. - Discovered endpoints appear under **Security → Web Assets** with the `cf-llm` label. - Discovery is now free for Cloudflare Free, Pro, and Business customers: - Free-plan discovery begins when users open the Discovery page. - Paid plans receive recurring background discovery. - Sufficient valid traffic is required to confidently identify AI-powered endpoints. ## Always-On AI Threat Detection - Prompts sent to discovered AI endpoints are evaluated by multiple detection modules. - Built-in protections cover: - Prompt injection - PII exposure and extraction - Sensitive or toxic topics - Detection results are attached as metadata and can be used in custom WAF rules. - Cloudflare intends to use its global network data to identify emerging attack patterns across millions of sites. ## Custom Topics and Prompt Extraction - Custom topics allow organizations to define their own sensitive categories, such as securities, patient data, or competitor products. - Each prompt and response receives a relevance score that can be logged, blocked, or handled through custom policies. - Custom prompt extraction identifies where prompts are located in request bodies, supporting formats such as: - `$.messages[*].content` - `$.requests[*].params.messages[*].content` - `$.property_description` - Standard formats from providers including OpenAI, Anthropic, Google Gemini, Mistral, Cohere, xAI, and DeepSeek are supported. - Unknown payload formats use a default-secure approach that scans the full request body, which may create false positives. - Cloudflare plans to support user-defined JSONPath expressions and automated prompt learning to improve accuracy. ## WAF-Based Mitigation - Organizations can block, log, or customize responses to detected threats using the existing Cloudflare WAF rule builder. - AI-specific signals can be combined with broader request data, including IP reputation, browser fingerprints, bot activity, and attack history. - This lets security teams distinguish isolated suspicious prompts from attacks associated with broader malicious behavior. ## Expanding Partnerships - IBM has selected Cloudflare to provide AI security for its cloud customers. - Cloudflare and Wiz are partnering to provide mutual customers with a unified view of AI security posture. - The service is being extended through Cloudflare’s broader security ecosystem. Organizations adopting AI agents should first inventory their AI endpoints, then apply detection and WAF policies tailored to their data, users, and business risks. Cloudflare’s unified approach is designed to provide a practical fail-safe as AI deployments expand.

Read original(opens in new tab)

Database DesignLarge Language ModelsCloudflareAi Security+4

cloudflare·Mar 10, 2026·3 min readCurated summary

Investigating multi-vector attacks in Log Explorer

Cloudflare Log Explorer provides a unified view for investigating multi-vector attacks across application, network, identity, and endpoint activity. By correlating 14 new datasets from Cloudflare Application Services and Cloudflare One, analysts can connect reconnaissance, credential abuse, DDoS activity, lateral movement, and data-exposure risks. This broader visibility helps reduce Mean Time to Detect and supports faster, more complete forensic investigations. ## Unified Telemetry Across the Stack - Cloudflare describes logs as a “flight recorder” for digital infrastructure, capturing requests, attacks, configuration changes, and performance issues before traffic reaches origin servers. - Log Explorer centralizes telemetry in one interface, allowing analysts to correlate events across: - Application-layer HTTP traffic - Firewall and DDoS activity - DNS queries - Zero Trust access and network sessions - Endpoint, browser, email, and device events ## Zone-Scoped Logs These datasets focus on public websites, edge security, and application performance. - **HTTP Requests:** Reconstruct sessions, exploit attempts, and bot activity. - **Firewall Events:** Show blocked or challenged requests and the rules, IP reputations, or filters involved. - **DNS Logs:** Help detect cache poisoning, domain hijacking, and reconnaissance. - **NEL Reports:** Separate Layer 7 attacks from legitimate client connectivity problems. - **Spectrum Events:** Reveal Layer 4 anomalies and brute-force attempts against services such as SSH or RDP. - **Page Shield and Zaraz Events:** Track unauthorized JavaScript, outbound connections, third-party tools, and privacy-related behavior. ## Account-Scoped Logs Account-level datasets cover internal security, administration, identity, and network operations. - **Access Requests and Zero Trust Network Sessions:** Show who accessed protected applications and how long sessions lasted. - **Audit Logs:** Identify unauthorized Cloudflare configuration changes. - **CASB Findings:** Detect SaaS misconfigurations and potential data exposure. - **Gateway DNS, HTTP, and Network Logs:** Reveal malware callbacks, shadow IT, malicious downloads, unauthorized ports, and lateral movement. - **Magic IDS and Network Analytics:** Detect known exploit signatures, unusual traffic spikes, and volumetric attacks. - **Browser Isolation and Device Posture Logs:** Track risky user actions and whether connecting devices meet security requirements. - **Email Security Alerts:** Trace phishing and other email-based entry points. - **WARP and IPSec Logs:** Identify tampering with security connectivity and monitor encrypted tunnel health. - **DEX telemetry:** Help distinguish security incidents from ordinary application or device-performance problems. - **Sinkhole HTTP Logs:** Confirm attempts by internal devices to contact known botnet infrastructure. ## Investigating Attacks Across Multiple Stages - Public-facing telemetry can reveal how attackers probe websites, while account and Gateway logs show subsequent internal activity. - Analysts can correlate compromised credentials with the applications, devices, and network resources accessed by an attacker. - Magic IDS and Network Analytics extend investigations beyond HTTP to detect network-layer attacks and east-west movement. - Combining these sources gives investigators a timeline spanning initial reconnaissance, exploitation, internal access, and possible command-and-control activity. ## Detecting Reconnaissance - Query `http_requests` for repeated `401`, `403`, or `404` responses from a single IP address. - Look for requests targeting sensitive paths such as: - `/.env` - `/.git` - `/wp-admin` - Use `magic_ids_detections` to identify network-layer scanning. - Suspicious patterns include: - One source IP triggering multiple unique detections - Probes across many destination ports - Activity occurring within a short time window - Magic IDS signatures can identify techniques such as Nmap scans and SYN stealth scans. Log Explorer is most valuable when teams correlate its datasets rather than examining each log source in isolation. Combining application, identity, DNS, network, and endpoint telemetry provides the context needed to identify sophisticated attacks quickly and reconstruct their full scope.

Read original(opens in new tab)

CloudflareZero TrustNetwork SecurityHttp Requests+4

cloudflare·Mar 10, 2026·3 min readCurated summary

Building a security overview dashboard for actionable insights

Cloudflare’s revamped Security Overview dashboard is designed to turn overwhelming security data into prioritized, actionable work. It combines ranked Security Action Items, security-tool status, and deep links into Security Analytics so teams can identify and investigate risks without switching between tools. Behind it is a checker-based system that processes more than 10 million insights daily through scheduled scans and real-time event handlers. ## From Visibility to Action - Security Action Items focus analysts on what needs to be fixed now rather than displaying every available event. - Issues are ranked by severity: - **Critical:** Immediate risks that could be exploited. - **Moderate:** Issues requiring attention to maintain security posture. - **Low:** Hardening recommendations and best-practice improvements. - Analysts can filter items by insight type, including suspicious activity and insecure configuration. ## Closing Configuration Gaps - The Detection Tools module shows whether Cloudflare protections are actively operating. - It highlights issues such as: - Security tools running in “Log Only” mode instead of blocking threats. - Shadow API discovery being disabled or unavailable. - This shifts the focus from whether a security feature exists to whether it is correctly configured and protecting traffic. ## Connected Investigation Workflows - Suspicious Activity cards appear both on the Security Overview and Security Analytics pages. - Selecting a card deep-links into Analytics with relevant filters already applied. - This removes repetitive navigation and filter recreation, helping teams investigate incidents faster. ## Checker-Based Insight Generation - Cloudflare generates and refreshes more than 10 million actionable insights each day. - Specialized microservices called **checkers** handle different areas, such as DNS, SSL certificates, and AI bot configurations. - Checkers can scale independently and operate through: - **Scheduled checks** for comprehensive configuration inspections. - **Real-time listeners** that respond immediately to control-plane events. ## Scheduled Checks and Insight Lifecycles - A scheduler distributes inspection tasks across checkers, such as scanning all DNS records for a zone. - A checker: - Receives a task. - Collects relevant assets and configurations. - Applies specialized validation rules. - Creates an insight when a configuration fails its required threshold. - Updates the insight timestamp if the issue persists. - Removes the insight once the issue is fixed. ## Real-Time Ruleset Handlers - Event handlers listen continuously for configuration changes. - For example, when a WAF ruleset is changed, a handler can immediately detect that it is enabled only in “Log Only” mode. - The handler determines that attacks are being recorded but not blocked, registers an insight, and displays it on the dashboard. - Once the configuration is secured, the insight is cleared automatically. The dashboard’s main benefit is its combination of prioritization, configuration awareness, and immediate investigation paths. By pairing scheduled validation with real-time detection, it helps security teams move from passive monitoring to faster, more proactive remediation.

Read original(opens in new tab)

Database DesignCloudflareMicroservicesSecurity Dashboard+3

cloudflare·Mar 10, 2026·3 min readCurated summary

Translating risk insights into actionable protection: leveling up security posture with Cloudflare and Mastercard

Organizations are expanding their Internet-facing assets faster than they can inventory and secure them, leaving shadow domains, forgotten hosts, and vulnerable services exposed. Cloudflare and Mastercard plan to integrate RiskRecon attack surface intelligence into Cloudflare Security Insights to continuously discover these risks and recommend remediation. The integration is intended to shift security from periodic audits toward ongoing visibility and protection. ## Attack Surface Intelligence - Mastercard RiskRecon maps an organization’s public Internet footprint using outside-in, publicly available data. - It can identify shadow IT, forgotten subdomains, unauthorized cloud servers, exposed services, weak authentication, outdated software, and encryption problems. - A 2025 study of 15,896 breached organizations found that major posture gaps made companies: - 5.3 times more likely to experience ransomware. - 3.6 times more likely to suffer a data breach. ## Combining Discovery with Cloudflare Protection - RiskRecon identifies security gaps, while Cloudflare provides controls to address them. - Discovered assets can be routed through Cloudflare’s proxy without changing the underlying application or website. - In a sample covering approximately 388,000 organizations and 18 million systems, Cloudflare-proxied systems showed: - 53% fewer software vulnerabilities. - 58% fewer SSL/TLS issues. - 98% fewer instances of malicious behavior. ## Finding Shadow Domains and Unprotected Hosts - Cloudflare Security Insights already detects issues for domains that are proxied through Cloudflare, including DNS errors, weak encryption, and inactive WAF rules. - The Mastercard integration will extend visibility to domains and hosts that Cloudflare does not yet know about or protect. - RiskRecon continuously profiles organizations’ Internet footprints and identifies associated domains, hosts, and software stacks. - Assets will receive criticality ratings: - **High:** Sensitive-data systems, authenticated applications, databases, or remote-access services. - **Medium:** Brochure sites adjacent to high-criticality systems. - **Low:** Brochure sites with no proximity to critical systems. ## Turning Findings into Remediation - Security Insights is designed to recommend concrete fixes rather than only report vulnerabilities. - Suggested actions may include: - Enabling the Cloudflare proxy for discovered zones and hosts. - Activating WAF, DDoS, and bot protection. - Enforcing stronger TLS settings. - Applying controls such as API Shield or specific WAF rules. - Future plans include risk scoring and AI-assisted diagnosis that correlates findings with traffic and recommends targeted configurations. ## Availability - The planned integration is expected to enter preview in the third quarter of 2026 for Information Security practitioners on pay-as-you-go and Enterprise accounts. The partnership’s practical goal is to help organizations discover assets they did not know existed, prioritize the most dangerous exposures, and protect them through Cloudflare before attackers exploit them.

Read original(opens in new tab)

CloudflareWeb Application FirewallMastercardRemote Access+4