Cloudflare

78 posts

cloudflareJul 14, 20263 min readCurated summary

A broken DNSSEC rollover took down .AL. Now 1.1.1.1 tells you when validation is bypassed

A failed DNSSEC key rollover at Albania’s `.AL` registry caused validating resolvers to return errors for every `.AL` domain. Cloudflare temporarily installed a Negative Trust Anchor (NTA) to restore access, suspending DNSSEC validation while the registry fixed the issue. To make this bypass visible, 1.1.1.1 began returning a new Extended DNS Error (EDE) code alongside affected responses. ## What Happened to `.AL` - Around 14:15 UTC on July 3, the registry published a new DNSKEY and stopped serving the old key. - The root zone’s DS record still referenced the old key (`id=26319`), breaking the DNSSEC chain of trust. - Around 17:00 UTC, the new DNSKEY was also removed, leaving `.AL` with no DNSKEY records. - At approximately 19:15 UTC, the DS record was removed from the root zone, restoring normal resolution but leaving the entire TLD unsigned. - The outage affected government services, banks, media, and any other `.AL` domain accessed through DNSSEC-validating resolvers. ## Why Negative Trust Anchors Were Used - An NTA, defined by RFC 7646, tells recursive resolvers to treat a zone as unsigned and skip DNSSEC validation. - Cloudflare applied an NTA to `.AL` at 17:15 UTC, restoring resolution for 1.1.1.1 users. - The measure was considered acceptable because the failure was public, confirmed, and affected validating resolvers broadly. - Communication with the registry was difficult because its contact addresses were themselves hosted under `.AL`. - The NTA was removed the following day after the DS record had been removed from the root zone. ## The Security Tradeoff - NTAs prevent widespread `SERVFAIL` responses but remove cryptographic protection against DNS spoofing. - Previously, clients could not distinguish an NTA-served response from a fully DNSSEC-validated response. - Public status pages provide disclosure, but applications, monitoring systems, and users cannot reliably discover the bypass from DNS responses alone. ## EDE-Based Transparency - Extended DNS Errors, defined in RFC 8914, let resolvers attach explanatory information to DNS responses. - Cloudflare implemented a proposed EDE code, “Negative Trust Anchor,” developed with Quad9 contributors. - During the incident, `.AL` responses included: - EDE 9: `DNSKEY Missing`, explaining the broken DNSSEC chain. - EDE 33: `Negative Trust Anchor`, explicitly stating that validation had been bypassed. - A query such as `google.al` could therefore return a successful answer while clearly indicating that it was not DNSSEC-validated. Resolvers and applications should use EDE information where possible, while DNS operators should disclose NTAs and remove them promptly once the underlying DNSSEC problem is resolved.

Cloudflare Dns Dnssec Negative Trust Anchor+2

cloudflareJul 10, 20263 min readCurated summary

Improving Smart Tiered Cache for public cloud regions

Cloudflare’s Smart Tiered Cache efficiently routes cache misses through one optimal upper-tier data center, but anycast and regional cloud origins make latency-based selection unreliable. Smart Tiered Cache for Public Cloud Regions addresses this by using a customer-provided cloud region hint to choose geographically appropriate primary and fallback tiers. The result is better cache efficiency, fewer origin requests, and reduced cross-continent “hairpin” traffic. ## Smarter Tiered Cache Topology - Smart Tiered Cache is available on all Cloudflare plans at no additional cost. - It selects a single upper tier based on real-time latency when an origin has a fixed, unicast IP. - Previous enhancements added support for: - **R2**, selecting an upper tier near the bucket’s actual location. - **Load Balancing**, selecting one tier for an entire pool so origins share cache content. - The new feature extends this approach to public cloud origins hosted on AWS, GCP, Azure, and Oracle Cloud. ## Why Anycast Origins Cause Problems - Anycast and regional unicast IPs represent cloud provider front ends rather than one physical origin location. - Multiple Cloudflare data centers may appear equally close to the same IP, preventing reliable selection of one upper tier. - The wrong selection can cause hairpin traffic. For example, an origin in Singapore might be assigned to an upper tier in Chicago, forcing Asian users’ requests across the Pacific and back. - This can add hundreds of milliseconds, increase origin connections, and reduce cache hit ratios. - Cloudflare detects likely anycast origins by comparing probe latencies against the physical limits imposed by the speed of light. - When anycast is detected without additional information, Smart Tiered Cache safely uses multiple upper tiers instead of pinning traffic to one. ## Configuring a Cloud Region Hint - In the dashboard, go to **Caching > Tiered Cache > Origin Configuration**. - Select an origin IP and choose **Set Region Hint**. - Enter a region such as: - `aws:us-east-1` - `gcp:europe-west1` - Hints can be configured individually or applied in bulk. - The same configuration is available through the API and Terraform. - Dashboard hints are currently available only for IPs Cloudflare has identified as anycast. - The initial release supports AWS, GCP, Azure, and Oracle Cloud, with more providers planned. ## How Region-Based Selection Works - Cloudflare periodically downloads each provider’s current IP range files. - These files map cloud regions to their active IP prefixes, allowing Cloudflare to track subnet changes. - Cloudflare matches those prefixes against an upper-tier database updated through latency probing every 15 minutes. - Each matching subnet contributes a weighted vote for its current upper-tier assignment. - The strongest signal determines the region’s primary upper tier. - Primary and fallback tiers are always placed in different Cloudflare points of presence to avoid a single-PoP failure eliminating both options. ## Practical Recommendation For public cloud origins behind anycast or regional unicast IPs, configure the correct cloud region hint through the dashboard, API, or Terraform. This lets Smart Tiered Cache retain a single, nearby primary tier while maintaining a separate fallback, improving cache efficiency and avoiding unnecessary cross-region traffic.

Cloudflare Terraform Tiered Caching Anycast+3

cloudflareJul 7, 20263 min readCurated summary

Cloudflare proudly joins the UK government's Cyber Resilience Pledge

Cloudflare has joined the UK government’s voluntary Cyber Resilience Pledge, supporting its focus on security governance, board accountability, and supply-chain protection. The company argues that these principles align with its existing approach: make security broadly accessible, use network-scale intelligence, apply protections internally, and be transparent about failures. It presents collective action and stronger baseline controls as essential to addressing rising cyberattacks and AI-enabled threats. ## The Cyber Resilience Pledge - The pledge encourages organizations to adopt foundational cybersecurity governance and make resilience a leadership responsibility. - It promotes comprehensive security coverage across supply chains. - Its central principles include: - Democratizing access to security - Leadership accountability - Radical transparency - Cloudflare sees the pledge as validation of principles it has followed for more than a decade. - The company highlights the need to address common weaknesses such as: - Unpatched systems - Weak access controls - Poor vendor oversight ## Rising Cybersecurity Risk - Cloudflare blocked an average of 234 billion cyber threats per day during the first quarter of 2026. - It recently mitigated a DDoS attack peaking at 31.4 Tbps. - By the end of 2025, the UK was the sixth-most targeted location globally for DDoS attacks. - Threat actors increasingly targeted application-layer services in financial services, aviation, and regional government. - UK survey data found that 43% of businesses and 28% of charities experienced a cyber incident in the previous year. - Frontier AI models are making attacks easier to automate, including vulnerability scanning and convincing phishing campaigns. ## Why Cyber Resilience Matters - Resilience is a business requirement because customers expect services to remain available, responsive, and trustworthy. - It extends beyond recovering from incidents to proactively: - Monitoring threat signals - Absorbing disruptions - Adapting systems after failures - Cloudflare views security controls as the foundation that makes resilience possible. ## Cloudflare’s Resilience Architecture ### Security by Default - Cloudflare aims to make baseline protections available to organizations of all sizes. - Examples include: - SSL certificates for encrypted traffic - Unmetered DDoS protection on its free plan - CDN and DNSSEC access - Post-quantum cryptography deployment - Impact programs such as Project Galileo and the Athenian Project - This model is intended to help small businesses, startups, local authorities, and public services participate in the UK’s resilience efforts. ### The Network as a Sensor - Cloudflare peers directly with more than 13,000 networks worldwide. - Attack intelligence gathered in one location can become a protection rule for customers elsewhere within seconds. - This global visibility improves threat detection, scoring, and response across its services. ### Cloudflare as “Customer Zero” - Cloudflare uses its own security products and infrastructure to protect internal systems. - Employees access internal applications through Cloudflare Access and Gateway. - Internal requests require hardware-based MFA, device posture checks, and cryptographically verified identity tokens. - Testing security controls internally helps Cloudflare identify improvements before delivering them to customers. ### Transparency and Incident Response - Cloudflare publishes technical postmortems for security incidents and zero-day vulnerabilities. - It shares indicators of compromise, telemetry, and architectural lessons with the wider security community. - After a major outage, its “Code Orange” initiative focused on building systems that “fail small,” safer configuration tooling, and automated best practices. ## Cloudflare’s Pledge Commitments - The post begins describing the pledge’s requirements around: - Board responsibility and governance - Supply-chain security - Technical standards related to UK Cyber Essentials - The provided text ends before detailing Cloudflare’s specific implementation of these commitments. Organizations should treat cyber resilience as an ongoing governance and engineering responsibility, not an optional product feature. Raising baseline protections, sharing lessons from incidents, and securing supply chains can make the wider Internet safer and more dependable.

Cloudflare Zero Trust Post Quantum Cryptography Cybersecurity+3

cloudflareJul 1, 20263 min readCurated summary

Making AI search smarter

Cloudflare argues that AI-powered search has broken the traditional bargain in which publishers exchanged crawl access for traffic and revenue. AI summaries increasingly answer users’ questions without sending them to source sites, leaving publishers to choose between reduced visibility and uncompensated content use. The company proposes rebuilding this relationship through smarter crawling and payments tied to actual content usage. ## Rebuilding the Bargain - Cloudflare’s responsible AI bot principles emphasize: - Transparency about a bot’s identity and purpose - Respect for site owners’ choices - Good-faith behavior - Blocking unwanted crawlers protects publishers but does not create a sustainable business model. - Cloudflare’s broader goal is to make AI search beneficial to users, AI companies, and content creators. ## Making AI Search Smarter - Cloudflare is launching a research program using signals from its global network, which covers more than 20% of the web. - These signals may identify: - Which pages are fresh or have genuinely changed - Which content attracts human and automated traffic - Which sources are high quality and relevant - Answer engines could use this information to surface better content and avoid repeatedly crawling unchanged pages. - More than 50% of traffic from legitimate crawlers reportedly goes toward re-fetching unchanged pages. - Reducing unnecessary crawls would lower: - AI companies’ compute costs - Publishers’ server load and bandwidth expenses - The program is intended to be neutral, limited to search, and will not share content or train foundation models. - Cloudflare plans to publish results and make the capability broadly available later in the year. ## From Pay Per Crawl to Pay Per Use - Cloudflare’s existing Pay Per Crawl model lets publishers charge AI companies for accessing their content. - Cloudflare says crawling is an imperfect measure of value: - A page may be crawled once but cited in thousands of answers. - It may also be crawled repeatedly without ever being used. - The company is therefore experimenting with Pay Per Use, where compensation reflects how often content contributes to search results or answers. - Early partners include Ceramic.ai and You.com. - Ceramic’s pay-per-query model pays publishers when their content appears in Ceramic search results. - Cloudflare’s network is intended to help AI companies scale these payment systems across millions of participating content owners. Cloudflare’s proposed model combines efficient, change-aware crawling with compensation based on actual content use. If adopted broadly, it could give publishers better control, reduce needless infrastructure costs, and create a more sustainable economic relationship between AI search services and the web.

Cloudflare Bot Management Ai Search Web Crawling+2

cloudflareJul 1, 20263 min readCurated summary

Announcing the Monetization Gateway: charge for any resource behind Cloudflare via x402

Cloudflare is introducing the Monetization Gateway, which will let customers charge for web pages, datasets, APIs, and MCP tools protected by Cloudflare. It combines payment rules, access control, metering, and payment verification at the edge, initially using stablecoins through the x402 protocol. The goal is to make low-cost, usage-based payments practical for AI agents without requiring sellers to build billing infrastructure or onboard every buyer. ## The Web’s Shift Toward Usage-Based Payments - The traditional web monetized human attention through advertising, subscriptions, and e-commerce. - AI agents consume resources without viewing ads or maintaining subscriptions, creating a need for pricing based on actual usage. - Potential models include: - Charging a few cents per search. - Combining a base fee with usage charges, such as per megabyte uploaded. - Charging only when an outcome succeeds, such as a resolved support escalation. - Agents may generate thousands of requests and micropayments, making per-request, per-token, or outcome-based pricing more appropriate than monthly or per-seat plans. - Existing usage billing has generally required API keys, known customers, extensive accounting systems, and costly payment infrastructure. - Stablecoins such as USDC and Open USD can support sub-cent payments with low fees and settlement times under a second. ## Cloudflare’s Role in Usage-Based Billing - Cloudflare can use its position as a proxy between buyers and sellers to combine payment verification with the request path. - Metering, payment exchange, and settlement can occur away from the customer’s origin. - Customers retain control over: - Pricing. - Access rules. - Revenue. - Sellers will not need to onboard each buyer or build a complete billing system; they can define rules that determine when agents must pay. ## How x402 Payments Work - x402 uses HTTP’s `402 Payment Required` status code to add payments directly to ordinary web requests. - The flow is: - A client requests a protected resource. - The server returns a 402 response containing the price, accepted asset, and payment destination. - The client pays and retries the request with proof of payment. - A facilitator verifies the payment. - The server returns the requested resource. - There are no checkout redirects or separate payment APIs. - Payments settle peer-to-peer directly into the seller’s wallet. - x402 is well suited to machine payments because: - It supports very small transactions. - Buyers do not need an account with the seller. - The payment itself acts as the access credential. - Stablecoins offer fast settlement, low fees, and no chargebacks. ## Monetization Gateway Capabilities - Customers will define payment policies through a dedicated rules API using expressions similar to other Cloudflare rules. - The system will apply to traffic such as tokens, APIs, MCP tool calls, and datasets. - Enforcement will run across Cloudflare’s network in more than 330 cities, allowing payment handshakes to occur near buyers while reducing latency and protecting origins. - Planned functionality includes charging for specific REST methods and routes, such as requiring $0.01 for each `GET` or `POST` request to `/api/premium/*`. - The gateway is also intended to support variable pricing for tasks with different costs. Cloudflare’s approach is to make micropayments a native part of HTTP access, enabling businesses to charge agents directly for the resources they consume without constructing their own payment and accounting systems.

Cloudflare AI Agents Model Context Protocol API+4

cloudflareJul 1, 20264 min readCurated summary

Content Independence Day, one year on- building the business model for the agentic Internet

Cloudflare argues that generative AI has rapidly replaced the traditional web model in which publishers traded content access for search referrals. With AI now driving much of online discovery and crawler activity, content is increasingly consumed without users visiting its source. The company says a new market is emerging in which transparency, access controls, scarcity, and licensing can help publishers regain economic value. ## AI’s rapid transformation of the Internet - Generative AI adoption has reached more than 2.5 billion regular users—over 30% of humanity—in roughly 3.5 years, reportedly more than twice the adoption speed of smartphones. - Users now spend only about 15 minutes on the open web for every hour spent searching for information. - Instead of visiting and comparing multiple websites, users increasingly receive consolidated answers directly from AI systems. - More than 50% of Internet traffic is now non-human, marking the arrival of what Cloudflare calls the “agentic Internet.” ## Crawlers are increasingly focused on AI - AI training accounted for 52% of crawler requests in June 2026, up from 22% in spring 2025. - Mixed-use crawlers, combining search, agent activity, and training, represented more than 36% of crawler traffic. - Traditional search crawlers make up a smaller share of activity, even though they remain important for sending visitors to publishers. - Mixed-purpose crawling makes it difficult for site owners to remain visible to AI-driven discovery without also giving away content for training without compensation. ## The traditional web business model is breaking down - Historically, publishers allowed search engines to crawl their content in exchange for visibility and referral traffic. - AI systems now answer questions, conduct research, compare products, and complete tasks without necessarily sending users to original sources. - Content can therefore be crawled, indexed, and monetized by AI companies while the original publisher receives little or no traffic. - News and media organizations experienced the disruption first, but retail, software, IT, finance, and other sectors are also affected. - Some heavily crawled categories have seen human traffic fall by as much as 40% in under a year. - Publishers are preparing for “Google Zero,” in which search referrals provide little meaningful traffic. ## The impact extends across industries - Any organization publishing proprietary information online may need a strategy for AI access and monetization. - The issue affects not only traditional publishers but also businesses whose websites contain valuable product, technical, financial, or industry knowledge. - Cloudflare frames the sustainability of online content as an economic and public-interest concern because the Internet remains a major global information resource. ## Building a market for content Cloudflare says Content Independence Day focused on three goals: - Give site owners transparency and control over how their content is accessed and monetized. - Create scarcity by allowing publishers to restrict or selectively permit AI access. - Establish a marketplace where publishers and AI companies can discover, license, and price content. According to the post, these efforts have helped create the early conditions for a monetized content market. ## Control and data create negotiating power - Cloudflare’s attribution, business intelligence, and enforcement tools let publishers observe AI access at the network level. - These tools provide stronger practical enforcement than voluntary mechanisms such as `robots.txt`. - Publishers can identify: - How often LLMs attempt to access their content - Which competing AI systems are crawling their sites - Which URLs are most in demand - The relationship between crawling and referrals - Restricting or controlling access creates scarcity, which gives publishers leverage in licensing negotiations. - Better operational data reduces information asymmetry and allows content owners to negotiate with evidence rather than guesswork. Ultimately, the post recommends treating online content as an economic asset rather than an unlimited free input. Publishers should measure AI consumption, control access, and pursue licensing arrangements so that the agentic Internet can support content creation instead of undermining it.

Cloudflare AI Large Language Models Generative AI+3

cloudflareJul 1, 20263 min readCurated summary

Your site, your rules: new AI traffic options for all customers

Cloudflare is replacing its broad “Block AI Bots” approach with finer controls based on what automated systems do: Search, Agent, or Training. The goal is to let website owners preserve discoverability and useful automation while blocking uncompensated model training and other unwanted access. These controls will be available to all Cloudflare customers, including Free-tier users. ## Why AI traffic needs more nuance - The traditional crawler exchange—content in return for referrals—has weakened as AI systems increasingly consume content without sending traffic back. - Website owners previously faced a binary choice: - Allow AI access to remain discoverable. - Block automation and protect content at the risk of losing visibility. - This tradeoff particularly harms small sites and can favor established search providers that use the same crawlers for search and training. ## A behavior-based AI taxonomy Cloudflare will classify automated traffic by its purpose rather than simply labeling bots as “AI”: - **Search** - Collects or indexes content to answer future queries. - Builds a database proactively. - Should generally provide referrals or other fair compensation. - **Agent** - Acts in real time on behalf of a person. - Includes chat-fetch bots such as ChatGPT-User and browser-use agents driven by Gemini or Claude. - Visits a site to complete a specific task for a human. - **Training** - Collects content to train or fine-tune a model. - Permanently incorporates data into the model’s underlying architecture. Bots may have multiple classifications. Cloudflare encourages operators to separate Search, Agent, and Training crawlers so site owners can understand and control their access more effectively. ## New controls for AI traffic - Cloudflare is adding separate controls for Search, Agent, and Training traffic. - These options replace the need for a single all-or-nothing AI blocking decision. - The controls will be available to all customers, including those on the Free plan. - Cloudflare will continue tracking other automated behaviors, such as ad verification, feed fetching, and agentic transactions. ## New default rules Starting September 15, 2026: - For new domains, **Training** and **Agent** crawlers will be blocked by default on pages displaying ads. - **Search** crawlers will remain allowed by default because they are more likely to send visitors back. - The policy treats ads as an indication that human attention—and therefore monetizable traffic—is the intended outcome. - Multi-purpose crawlers will be governed by all of their classifications, using the most restrictive applicable rule. - As a result, crawlers such as Googlebot, Applebot, and BingBot may be blocked when customers choose to block Training traffic. - Website owners can opt out of the new defaults through Cloudflare Security settings before September 15. Cloudflare’s recommendation is to manage AI access by behavior: allow Search when referrals matter, permit Agents when real-time user tasks are valuable, and block Training where content reuse is not adequately compensated.

Cloudflare AI Agents Bot Management Web Crawlers+3

cloudflareJun 16, 20263 min readCurated summary

Cloudflare DMARC Management is now generally available

Cloudflare DMARC Management is now generally available as a free service for Cloudflare customers. Its redesigned dashboard helps organizations understand email authentication, investigate sending sources, and safely move from monitoring to full DMARC enforcement. The goal is to reduce spoofing and improve deliverability without requiring consultants or manual XML report analysis. ## Why Email Authentication Matters - **SPF** identifies the servers and services authorized to send mail for a domain. - **DKIM** adds a cryptographic signature so recipients can verify message integrity. - **DMARC** combines SPF and DKIM results and determines whether failed messages should be delivered, quarantined, or rejected. - **BIMI** can display a brand logo in supported inboxes when a domain has a sufficiently strong DMARC policy. - Correctly configured records help block spoofed messages and improve legitimate email delivery. ## DMARC Has Become Essential - Google, Microsoft, and Yahoo have introduced stricter authentication requirements. - Domains with missing or incorrect SPF, DKIM, or DMARC records increasingly face spam placement or outright rejection. - Poor email authentication can lead to brand impersonation, missed communications, and lost revenue. ## The Risks of Reaching Enforcement - DMARC policies typically progress from: - `p=none`: monitor activity without blocking messages - `p=quarantine`: send suspicious messages to spam - `p=reject`: block unauthenticated messages - Tightening the policy too quickly can disrupt legitimate mail from forgotten third-party services. - Moving too slowly leaves the domain vulnerable to spoofing and deliverability problems. - Organizations must analyze aggregate XML reports and identify every legitimate sending source before enforcing stricter policies. ## Deeper Report Visibility and Source Investigation - Reports now show: - Source IP addresses - Sending service names - DMARC, SPF, and DKIM alignment results - Users can open an IP address in Cloudflare’s Investigate tab to view: - Reputation data - Geolocation - ASN information - Known malicious associations - This turns DMARC reports into an investigation tool for distinguishing legitimate infrastructure from unauthorized senders. ## Unified Authentication Record Status - A single view reports the status of DMARC, DKIM, SPF, and BIMI records. - Each record receives a pass, warning, or fail result based on automated analysis. - The dashboard identifies issues such as: - Multiple SPF records - SPF lookup-limit problems - Permissive `+all` settings - Missing SPF mechanisms - Malformed DKIM keys - Missing BIMI records when the domain qualifies for one - Recommendations are presented in plain language with actionable remediation steps. Cloudflare’s recommendation is effectively to use DMARC Management to identify all sending sources, correct authentication records, and gradually move toward `p=reject` with greater confidence and less risk of interrupting legitimate email.

Cloudflare Dns Threat Intelligence Dmarc+4

cloudflareJun 10, 20263 min readCurated summary

Route public traffic to private applications with Cloudflare

Cloudflare is extending its application security, performance, and programmability services to applications hosted on private networks. Its new Application Services for Private Origins allows public traffic to reach private origins through existing connectivity such as IPsec, GRE, Cloudflare Tunnel, CNI, or Cloudflare Mesh—without public IP exposure, inbound firewall rules, or `cloudflared` on the origin. The feature is entering closed beta for eligible Enterprise customers. ## Unifying Public and Private Application Traffic - Private applications—including internal APIs, AI backends, MCP servers, and operational tools—can now use: - WAF - Bot management - Rate limiting - Caching - Traffic acceleration - Rewrites - Workers - Cloudflare treats private IPs as valid origin targets for public hostnames. - The model supports four traffic combinations: - Public users to public applications - Private users to public applications - Public users to private applications, which is shipping now - Private users to private applications, planned for the future ## Reusing Existing Private Connectivity - The feature builds on Cloudflare’s existing private networking layer. - Supported connectivity models include: - Cloudflare Tunnel - Cloudflare One Client - IPsec and GRE tunnels - CNI links - Cloudflare Mesh - Customers can manage routing through Cloudflare’s dashboard and APIs rather than maintaining separate networking stacks. - Workers VPC bindings and Spectrum private-origin routing also use this shared connectivity layer. ## Application Services for Private Origins - Customers can enable **Use private network routing** on a proxied A or AAAA DNS record. - Cloudflare continues applying WAF, rate limiting, caching, bot management, and transform rules at its edge. - Only the final connection differs: Cloudflare sends traffic through the customer’s private network instead of over the public Internet. - Private routing is automatically enabled for: - RFC 1918 IPv4 ranges such as `10.0.0.0/8` - RFC 6598 CGNAT ranges such as `100.64.0.0/10` - RFC 4193 IPv6 unique-local addresses such as `FC00::/7` - Public IPs reachable only through a private network can be configured manually. ## API Configuration - Private routing is represented as an additional DNS record attribute: ```json { "type": "A", "name": "app.example.com", "content": "10.0.0.50", "ttl": 300, "proxied": true, "use_private_routing": true } ``` - Cloudflare’s Origin API returns the `use_private_routing` flag. - When the proxy sees that flag, it passes the request to Cloudflare’s private networking layer, which selects the appropriate private path. ## Beyond HTTP - The same routing approach supports non-HTTP services. - Potential origins include: - TCP databases - UDP logging endpoints - Private APIs accessed by Workers - Spectrum can extend the model to TCP and UDP services, while Workers VPC enables direct access from serverless code. Cloudflare’s recommendation is effectively to use existing private connectivity as the transport layer while centralizing application security, performance, and routing at Cloudflare’s edge. The feature is currently limited to eligible Enterprise customers in closed beta.

Cloudflare Cloudflare Workers Zero Trust Web Application Firewall+3

cloudflareJun 9, 20263 min readCurated summary

Defend against frontier cyber models: Cloudflare's architecture as customer zero

Frontier cyber models primarily change the speed and scale of attacks, not the fundamental stages of intrusion. They can rapidly discover vulnerabilities, generate exploit variations, and adapt around defenses, making architectural resilience more important than patch speed alone. Cloudflare’s approach is to use layered controls, limit the reach of compromised identities, and turn broad network visibility into faster defensive action. ## What Frontier Cyber Models Change - Models such as Mythos can accelerate: - Vulnerability discovery across large codebases and open-source dependencies - Exploit-chain reasoning - Proof-of-concept generation - Reconnaissance and attack variation - Traditional intrusion stages—reconnaissance, initial access, lateral movement, persistence, and exfiltration—remain, but attackers can execute them faster and at greater scale. - Attackers need only one exploitable opening, while defenders must identify and secure all of them. - AI-generated fixes can introduce regressions, meaning faster patch creation does not eliminate testing and review constraints. ## Three Threats Driving the Architecture ### Faster Vulnerability Discovery - Frontier models can search widely used open-source libraries and frameworks at scale. - A library flaw is only exploitable when attacker-controlled input can reach the vulnerable code and surrounding protections are insufficient. - The most concerning risk is the gap between attacker discovery and defender awareness. - Organizations should assume attackers are already using these models against their code if they are not doing so themselves. ### Higher Exploit Volume and Adaptation - Models can generate thousands of exploit variants and conduct reconnaissance at comparable scale. - Signature-based defenses may still block many variants sharing the same underlying pattern. - The greater danger is adaptive behavior: a model can probe a WAF, learn which payloads are blocked, and rewrite attacks until they evade the rule. ### Limiting Impact After Exploitation - No security architecture prevents every compromise. - The critical question is how far an attacker can move using a single identity, route, or credential. - If one compromise provides unrestricted access, the surrounding architecture—not just the original vulnerability—is the fundamental weakness. ## Visibility as a Defensive Advantage - Cloudflare observes roughly one-fifth of global web traffic, providing real-time insight into: - Mutating attack payloads - Emerging patterns - New attacker tooling and campaigns - Cloudforce One converts this network visibility into threat intelligence, tracked adversaries, campaigns, and indicators of compromise. - The key challenge is reducing the delay between discovering a threat and applying an effective mitigation across defensive systems. ## Practical Recommendation Organizations should run frontier models against their own code, strengthen layered detection, and design systems so that a single compromised identity or credential cannot provide unrestricted access. Architecture, containment, and rapid use of threat intelligence are essential complements to patching.

Cloudflare Vulnerability Management Ai Security Web Application Firewall+2

discordJun 9, 20263 min readCurated summary

How We Moved Discord Voice to the Edge

Discord migrated its voice and video infrastructure from roughly 30 hyperscaler regions to Cloudflare’s edge network, which spans more than 300 cities. The move brought measurable gains—over 80% of traffic now runs on Cloudflare, with Frankfurt seeing 34% lower ping and 42% lower packet loss—but the rollout exposed important limitations. Local server proximity alone is not enough; call placement and network peering are equally critical. ## Why Discord Moved Voice to the Edge - Traditional cloud regions left users in places such as Reykjavik, Auckland, Hawaii, and Lagos relatively far from voice servers. - Cloudflare’s 300-plus points of presence offered the possibility of hosting Discord’s software much closer to users. - Unlike typical CDN workloads, Discord needed to route live UDP packets for voice and video calls rather than cache static content. - More than 80% of Discord voice and video traffic now uses Cloudflare, and 70% of regions have improved year over year. ## Iceland: Local Servers Can Hurt Mixed Calls - Discord’s first test took place in Reykjavik, where users previously connected to servers in Rotterdam. - Iceland-only calls improved: - Ping decreased 9%. - Packet loss decreased 11%. - Mixed-region calls became worse: - Ping for non-Iceland participants increased 2.7 times. - Packet loss rose 9%. - Discord assigns one SFU to host an entire call, so all participants send traffic to that server. - A call started by one Icelandic user could therefore force German participants to route packets to Iceland and back. - Discord concluded that new edge locations help only when calls hosted there are primarily local; mixed calls require smarter host-placement logic. ## Rotterdam: Network Peering Was the Bottleneck - Discord next moved Rotterdam traffic to Cloudflare’s Amsterdam PoP. - Most regional ISPs performed normally, but Orange users experienced: - More than one second of latency during peak periods. - A 30% regression in voice freeze ratio. - The issue was not Cloudflare’s Amsterdam infrastructure itself, but the path between Orange and Cloudflare. - Traffic traveled through Telia’s transit backbone, where the Telia–Orange connection was already saturated. - Adding more traffic made the congestion worse. - Discord reverted the migration after about ten days. - Cloudflare pursued direct peering with Orange and added SFUs in Paris and London to provide shorter paths. ## A More Careful Migration Strategy - Discord changed its rollout process from capacity-based scheduling to peering-based analysis. - Before shifting meaningful traffic to a region, the team now checks whether Cloudflare has sufficient peering capacity with major local ISPs. - The migration slowed from a planned large-scale rollout to a region-by-region deployment. - The experience demonstrated that: - A geographically closer PoP does not always produce the best call experience. - SFU host placement matters for calls spanning multiple regions. - Transit routes and ISP peering can be more important than physical distance. Discord’s edge migration is succeeding, but only through incremental deployment, detailed traffic analysis, and improved call-placement decisions. The practical lesson is that low-latency infrastructure depends on the complete network path—not simply on adding servers closer to users.

Cloudflare Edge Computing Webrtc Cdn+3

cloudflareJun 4, 20263 min readCurated summary

VoidZero is joining Cloudflare

VoidZero, the company behind Vite, Vitest, Rolldown, Oxc, and Vite+, is joining Cloudflare, with its entire team moving over. The projects will remain open source, MIT-licensed where applicable, vendor-agnostic, and community-driven. Cloudflare says the acquisition will provide more engineering resources while preserving portability and independent community governance. ## Open Source and Vendor Neutrality - Vite and the other VoidZero projects will continue to be developed in the open. - Applications built with Vite will remain deployable anywhere, not only on Cloudflare. - Evan You and the VoidZero team will continue leading the projects. - Cloudflare plans to invest engineering resources rather than redirect the projects toward its own platform. - Cloudflare is committing $1 million to a Vite ecosystem fund for maintainers and contributors, administered by the Vite core team. ## Vite as a Shared Foundation - Vite underpins a broad range of frameworks and tools, including Vue, SvelteKit, Nuxt, Astro, Solid, Qwik, Angular, React Router, and TanStack Start. - The authors describe Vite as a neutral foundation for the JavaScript ecosystem rather than a framework tied to one provider. - Cloudflare’s earlier investment in Astro is presented as an example of how it intends to support open-source projects while keeping them portable. ## The Environment API and Cloudflare Integration - Cloudflare and Vite began collaborating in 2024 on the Vite Environment API. - The API allows server-side code to run in non-Node.js runtimes during development. - Cloudflare’s Vite plugin runs application code locally inside **workerd**, the same open-source runtime used by Workers in production. - Services such as Durable Objects, D1, KV, R2, Workflows, Workers AI, Agents, Service Bindings, and Workers RPC can therefore be tested locally using the production runtime model. - The approach keeps Vite’s integration generic: other runtimes can implement their own provider-specific plugins without requiring a Cloudflare-specific development server. - Vite reportedly reaches about 129 million weekly downloads, while the Cloudflare Vite plugin approaches 14 million. ## AI-Driven Development - AI agents now use development tools directly, including project scaffolding, dev servers, testing, linting, formatting, error handling, and deployment workflows. - Agent-driven development increases the importance of: - Fast builds and tests - Fast linting and formatting - Structured, actionable errors - Consistent command-line interfaces - VoidZero’s tools—Vitest, Rolldown, Oxc, Oxlint, and Oxfmt—are designed for repeated, automated feedback loops. - Vite+ combines these tools behind a unified CLI and configuration model, reducing complexity for both developers and agents. - Cloudflare is using the tools internally: its dashboard runs on Vite, Oxlint is reducing engineering effort, and the Flue agent framework is adopting Vite and the official Cloudflare plugin. Cloudflare’s stated priority is to preserve the trust and portability that made Vite widely adopted. The practical takeaway is that the acquisition is intended to expand Vite’s resources and runtime integrations without turning it into a Cloudflare-only platform.

Cloudflare Open Source JavaScript Cloudflare Workers+4

cloudflareMay 7, 20263 min readCurated summary

Building For The Future

Cloudflare announced plans to eliminate more than 1,100 jobs as it restructures for an “agentic AI era.” The company says the decision reflects a fundamental redesign of internal processes, teams, and roles—not individual performance or a conventional cost-cutting exercise. Leaders argue that acting decisively now will reduce prolonged uncertainty and create a faster, more innovative organization. ## Restructuring Around Agentic AI - Cloudflare’s internal AI usage has increased by more than 600% in three months. - Employees across engineering, HR, finance, marketing, and other departments run thousands of AI-agent sessions daily. - Because Cloudflare uses AI extensively itself, leadership says the company must redesign how work is organized to capture its benefits. - The restructuring covers internal processes, teams, and roles across the company. ## A Company-Wide Workforce Reduction - More than 1,100 employees globally will leave Cloudflare. - The company emphasizes that departures are not judgments about employees’ talent or performance. - Founders Matthew Prince and Michelle Zatlyn are communicating the decision directly rather than routing notices through managers. - Every employee is receiving an email explaining how the changes affect them. ## Severance and Treatment of Departing Employees - Departing employees will receive the equivalent of their full base salary through the end of 2026. - U.S. healthcare support will continue through the end of 2026. - Equity will continue vesting through August 15. - Employees who had not reached their one-year vesting cliffs will receive prorated vesting through August. - Cloudflare frames these benefits as an effort to treat departing employees with empathy and exceed typical industry standards. ## Why Cloudflare Chose Decisive Action - Leadership argues that smaller, repeated layoffs or a prolonged reorganization would create continuing emotional uncertainty. - Completing the changes at once is intended to provide clarity to departing employees and stability for those who remain. - Cloudflare believes its original cloud-native structure helped it surpass older companies with slower systems and processes. - As the company has grown, it says it must avoid relying on organizational structures that worked in the past. ## Looking Ahead - Cloudflare expects the reshaped organization to operate more quickly and innovate more effectively. - The founders planned to discuss the announcement during the company’s earnings call and an all-hands meeting. - They presented the restructuring as necessary to continue advancing Cloudflare’s mission of building a better Internet. The practical conclusion is that Cloudflare is making a large, one-time organizational reset to align its workforce with AI-driven operations, while offering unusually extensive severance intended to reduce the disruption for affected employees.

Cloudflare AI AI Agents Cloud Computing+1

cloudflareMay 1, 20263 min readCurated summary

Code Orange: Fail Small is complete. The result is a stronger Cloudflare network

Cloudflare’s “Code Orange: Fail Small” initiative rebuilt key parts of its infrastructure to prevent repeats of the November 18 and December 5, 2025 global outages. The work focused on safer configuration rollouts, smaller failure impact, stronger emergency access, and improved incident communication. Cloudflare concludes that the network is now more resilient, though reliability remains an ongoing effort. ## Safer Configuration Changes - Configuration changes affecting customer traffic are now deployed progressively rather than instantly across the network. - Health monitoring can detect problems early and automatically roll back faulty changes. - Cloudflare introduced **Snapstone**, a unified system that: - Packages configuration changes. - Releases them gradually. - Monitors system health in real time. - Automatically rolls back unsafe deployments. - Snapstone supports different configuration types, including data files and global control flags. - New high-risk configuration pipelines have been identified and brought under the health-mediated deployment process. ## Reducing the Impact of Failure - Product teams reviewed failure modes and removed unnecessary runtime dependencies. - Systems now use the last known good configuration where possible, following a **“fail stale”** strategy. - Where stale configuration is unavailable, teams choose between: - **Fail open:** Continue serving traffic with reduced protection or functionality. - **Fail close:** Stop processing when that is safer than continuing. - The Bot Management outage scenario would now be detected during an early rollout stage, affecting only a small amount of traffic before rollback. - Services are increasingly segmented into independent systems serving different customer cohorts. - For example, the Workers runtime deploys first to less-critical segments, such as free customers, before reaching more critical traffic. - This approach limits the blast radius of faulty deployments and adjusts rollout speed based on customer criticality. - Cloudflare plans to extend cohort-based deployment to more systems. ## Revised Break-Glass and Incident Procedures - Cloudflare audited tools needed for visibility, debugging, and emergency production changes. - It created backup authorization paths for **18 key services**, along with emergency scripts and proxies. - These pathways are designed to remain usable if Cloudflare’s own Zero Trust infrastructure is affected by an outage. - More than 200 engineers participated in an organization-wide emergency drill on April 7, 2026. - Repeated exercises are intended to ensure engineers can use emergency access procedures effectively under pressure. - Cloudflare also began improving how technical incident observations are converted into clear customer communications. Cloudflare’s changes make configuration rollouts safer, reduce failure blast radius, and improve emergency response. The practical recommendation is to treat these safeguards as ongoing operational practices rather than a one-time project, continually testing them and extending them to additional systems.

Cloudflare Zero Trust Incident Management Configuration Management+4

metaMay 1, 20262 min readCurated summary

How Meta Is Strengthening End-to-End Encrypted Backups

Meta’s HSM-based Backup Key Vault supports end-to-end encrypted backups for WhatsApp and Messenger by storing recovery codes in tamper-resistant hardware that Meta and third parties cannot access. The geographically distributed vault uses majority-consensus replication for resilience. Meta is strengthening the system with over-the-air fleet-key distribution for Messenger and public evidence of secure HSM fleet deployments. ## Over-the-Air Fleet Key Distribution - Clients verify HSM fleet authenticity using fleet public keys before establishing sessions. - WhatsApp embeds these keys directly in the application. - Messenger can receive keys over the air, allowing Meta to deploy new HSM fleets without requiring an app update. - Keys are delivered in validation bundles: - Signed by Cloudflare - Counter-signed by Meta - Recorded in a Cloudflare audit log - The complete validation process is documented in Meta’s *Security of End-To-End Encrypted Backups* whitepaper. ## Transparent HSM Fleet Deployment - Meta plans to publish evidence of the secure deployment of every new HSM fleet. - Users will be able to verify deployment evidence using the audit procedures in the whitepaper. - Deployments are expected to occur infrequently, generally no more than once every few years. - The transparency initiative is intended to demonstrate that Meta cannot access users’ encrypted backups. The system combines tamper-resistant HSMs, geographic replication, independently verifiable key distribution, and public deployment evidence. Readers seeking implementation details should consult the full whitepaper.

Cloudflare End To End Encryption Hsm Key Distribution+3