Cloudflare releases
Every Cloudflare update, newest first: Workers, WAF, AI Gateway, DNS and security releases.
November 2026
- Funding
Cloudflare launches Vite Ecosystem Fund, distributing first $301,300 to open source projects
Cloudflare is distributing the first $301,300 of the Vite Ecosystem Fund to open source projects and maintainers. Recipients were selected by a panel of Vite stack core team members, including maintainers not employed by Cloudflare.
- Update
Cloudflare adds visibility and control tools for personal AI agents accessing websites
Cloudflare published a blog post announcing new features that give site owners visibility into personal AI agent traffic and tools to set access terms for those agents. The post states that personal agents blur the line between automated and human web traffic.
October 2026
- Launch
Cloudflare makes services for private origins generally available
Cloudflare announced that its services for private origins are now generally available. Public traffic to private origins can be routed through WAF, bot management, caching, and Workers, and the feature is available to all customers with Cloudflare One connectivity.
- News
Cloudflare reports cross-request KV cache exposure in GLM-5.3 on Workers AI and describes remediation with SGLang
Cloudflare published a post describing a configuration mismatch in the GLM-5.3 model on Workers AI that triggered an SGLang bug, which exposed KV cache pages across requests. The post also describes the steps Cloudflare took to address the issue.
- Update
Cloudflare WAF adds full transaction detection that correlates requests with responses
Cloudflare announced full transaction detection for its web application firewall, which can now correlate an HTTP request with its response. The feature is intended to identify successful exploits, data exposure, and risky misconfigurations that request-only inspection can miss.
- News
Cloudflare deploys default WAF protections for newly disclosed PHP vulnerabilities (php2shell)
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities, before public disclosure. The rules use request and response signals to block exploit attempts and prevent exposed data from reaching attackers.
- Launch
Commerce.com and Cloudflare enable WebMCP shopping tools for AI agents across almost 100,000 storefronts
Cloudflare's blog reports that almost 100,000 Commerce.com domains now expose shopping tools to AI agents through WebMCP on Cloudflare. The post describes how the feature was enabled across all stores at once while letting each merchant keep control.
- News
Cloudflare reports eight eMudhra intermediate certificates use weak keys and outlines its mitigation response
Cloudflare published a blog post stating that eight eMudhra intermediate certificates were found to use weak keys. The post says Cloudflare is deploying mitigations and releasing client updates, and describes the impact and recommended next steps for customers and developers.
- Launch
Cloudflare introduces tsrs, a Rust port of TypeScript
Cloudflare announced tsrs, a port of the TypeScript compiler to Rust, in collaboration with others. The announcement states it is up to 8x faster and uses 70% less memory than TypeScript.
- Model release
Cloudflare introduces Clairic, a System One class extraction model
Cloudflare announced Clairic, a new model it describes as a System One class extraction model. According to the announcement, it can extract, compute, estimate, and forecast data from unstructured inputs.
- Update
Cloudflare introduces continuous accountability evaluation for Verified bots
Cloudflare announced a system to continuously evaluate whether Verified bots honor site preferences such as robots.txt and HTTP 429 responses. The stated goal is to keep Verified bots accountable over time, beyond their initial identity verification.
- Update
Cloudflare adds programmable Workers integration to Gateway and Data Loss Prevention
Cloudflare announced that its Gateway secure web gateway and Data Loss Prevention (DLP) products now inherit programmability from Cloudflare Workers through integration with the Cloudflare Developer platform. The source is a Cloudflare blog post and gives no further technical detail in the excerpt provided.
- Update
Cloudflare makes Hyperdrive MySQL generally available after fixing a caching bug
Cloudflare published a post describing a MySQL protocol bug in Hyperdrive's query result caching, found while adding MySQL support, which produced a 0.001% rate error. The post states that Hyperdrive MySQL is now generally available.
- Update
Cloudflare Logpush adds Transformers for filtering, redacting, and reshaping logs before export
Cloudflare announced that Logpush now supports Transformers, which let teams filter, redact, and reshape log streams using SQL before export. Transformers are powered by Apache DataFusion and Apache Arrow and apply changes to log data before it reaches the destination.
September 2026
- Update
Cloudflare rebuilds Containers for agent sandboxes, with 6x faster starts
Cloudflare rebuilt Containers for agent workloads on September 30, 2026. Agents can now choose the sandbox image and instance type at runtime, and the median cold start dropped from 4.05 seconds to 648 milliseconds in ComputeSDK's benchmark. Filesystem snapshots for saving and restoring a workspace are in public beta, and Durable Objects now control containers directly through ctx.container. The old Container and Sandbox classes are supported until December 31, 2026.
- Launch
Cloudflare opens a beta for charging AI agents per request
Cloudflare opened Monetization Gateway in closed beta on September 30, 2026. Site and API owners set per-request prices, and agents pay inline using the HTTP 402 Payment Required status, settled in USDC on Base. The beta is limited to US sellers and buyers, with Ceramic.ai, Stocktwits and API2PDF already using it in production.
- Launch
Cloudflare AI Gateway adds an Auto Router that picks the cheapest capable model
Cloudflare added an Auto Router to AI Gateway on September 30, 2026, in public beta and free during the beta. Setting the model to cloudflare/auto sends each request through an edge classifier that scores it across 14 task categories and routes it to the cheapest model it expects to handle it. Cloudflare reports savings of up to 30% against sending everything to a frontier model.
- Launch
Cloudflare launches cf, an agent-first CLI for its whole API
Cloudflare released cf in open beta on September 28, 2026, a command-line tool covering more than 3,000 API operations against Wrangler's roughly 280 commands. It defaults to JSON output, adds natural-language command search, and uses a typed cloudflare.config.ts with a Vite-based dev environment. Cloudflare says agents made 48% of Wrangler usage, and it will keep Wrangler maintained for 18 months after the beta.
July 2026
- Launch
Cloudflare Internal DNS reaches general availability
Cloudflare's Internal DNS is now generally available, providing authoritative and recursive DNS for private networks directly on Cloudflare's platform, alongside its existing public DNS and Zero Trust products.
- Launch
Cloudflare launches Precursor to detect agentic browser automation
Cloudflare introduced Precursor, a behavioral validation engine that analyzes continuous client-side interaction signals to distinguish AI-agent-driven browser sessions from human traffic, aimed at sites facing increasing agentic bot activity.