MAY 8, 2026
EngBrief
Search⌘K
LatestTopicsSourcesSaved
Eng&Brief

Engineering insights from the world's best tech companies, curated and summarized.

Weekly brief

Browse

TopicsSourcesFavorites

More

SearchRSS Feed
© 2026 EngBriefUpdated every 4 hours
← Sources
blog.cloudflare.com icon
Security

Cloudflare Blog

75 articles on EngBrief

The Cloudflare Blog is one of the most prolific technical blogs in the industry, covering internet security, networking, and edge computing. Posts explore DDoS mitigation, DNS infrastructure, TLS/cryptography, Cloudflare Workers, AI on the edge, HTTP standards, and the global network that serves over 20% of the web.

SecurityNetworkingEdge ComputingCryptographyPerformance
Visit blog →

Latest Articles

Cloudflare10h ago

Building for the future

Cloudflare's leadership, including Matthew Prince and Michelle Zatlyn, announced a significant workforce reduction of over 1,100 employees due to the increased adoption of AI within the company, requiring a reimagining of internal processes and roles. This change is part of Cloudflare's pivot to a high-growth, AI-driven organization, aiming to create value in the "agentic AI era." Cloudflare is providing generous severance packages to departing employees, including full base pay through the end of 2026 and vested equity.

NetworkingSecurity
1 min
Cloudflare17h ago

How Cloudflare responded to the “Copy Fail” Linux vulnerability

Cloudflare's Security and Engineering teams quickly assessed the Linux kernel "Copy Fail" vulnerability upon public disclosure on April 29, 2026. They evaluated the exploit technique, checked exposure across their infrastructure, and validated that their existing behavioral detections could identify the exploit pattern within minutes. As a result, there was no impact to the Cloudflare environment, no customer data was at risk, and no services were disrupted at any point. Cloudflare's established procedures ensure that they have already deployed patches for critical vulnerabilities, in this case, allowing them to respond proactively to the issue.

NetworkingSecurity
1 min
Cloudflare1d ago

When DNSSEC goes wrong: how we responded to the .de TLD outage

Cloudflare's public DNS resolver 1.1.1.1 experienced significant outages due to incorrect DNSSEC signatures published by the Germany's top-level domain (TLD) .de operator DENIC. This led to Cloudflare returning SERVFAIL for .de-related queries, impacting millions of domains. To mitigate the issue, Cloudflare temporarily treated .de as an insecure zone, bypassing DNSSEC validation, although this made .de domains vulnerable to attacks. Cloudflare's "serve stale" feature also kicked in, continuing to serve cached records and reducing the impact of the outage.

NetworkingSecurity
1 min
Cloudflare6d ago

Code Orange: Fail Small is complete. The result is a stronger Cloudflare network

Cloudflare has completed a two-quarter engineering effort called Code Orange: Fail Small, focusing on enhancing infrastructure resiliency, security, and reliability. The initiative has introduced safer configuration changes through Snapstone, a system for gradual rollout and real-time health monitoring, and measures to prevent drift and regressions. Code Orange has also streamlined configuration deployments, strengthened incident management, and established backup authorization pathways to facilitate faster issue resolution.

NetworkingSecurity
1 min
Cloudflare6d ago

Introducing Dynamic Workflows: durable execution that follows the tenant

Here's a 2-3 sentence summary of the article: Cloudflare introduced Dynamic Workflows, a library that enables multi-tenant applications to execute durable workflows without static workflow bindings. This is achieved through a Worker Loader that routes tenant-specific code to the Cloudflare Workflows engine, allowing each tenant to write their own Workflows code that is executed in isolation. The Dynamic Workflows library handles routing the workflow execution to the correct tenant's code, enabling durable and dynamic execution with up to 50,000 concurrent instances and 300 new instances per second per account.

NetworkingSecurity
1 min
Cloudflare7d ago

Post-quantum encryption for Cloudflare IPsec is generally available

Cloudflare has made post-quantum encryption for Cloudflare IPsec generally available, using the hybrid ML-KEM (FIPS 203) algorithm to protect against harvest-now-decrypt-later attacks. This implementation has been tested for interoperability with Cisco and Fortinet branch connectors, allowing customers to secure their wide-area networks with hardware they already have. By adopting a standards-compliant hybrid ML-KEM handshake, Cloudflare aims to promote a secure and post-quantum Internet accessible to everyone.

NetworkingSecurity
1 min
Cloudflare7d ago

Agents can now create Cloudflare accounts, buy domains, and deploy

Cloudflare now allows coding agents to create accounts, buy domains, and deploy applications without human intervention. Agents can perform tasks that previously required human interaction, such as creating a Cloudflare account, starting a paid subscription, and registering a domain. This is made possible by a new protocol co-designed with Stripe, which enables agents to query a catalog of available services, authorize user identities, and securely bill users. The protocol involves three key components: discovery, authorization, and payment. Agents can discover available services by calling a catalog command, which returns a list of services that can be used. The agent can then authorize user identities through OAuth flow, allowing providers to provision accounts or link existing ones. Finally, the platform provides a payment token that providers can use to bill the user, ensuring that agents can't overspend without human oversight.

NetworkingSecurity
1 min
Cloudflare9d ago

Shutdowns, power outages, and conflict: a review of Q1 2026 Internet disruptions

Here's a 3-sentence summary of key technical decisions, problems solved, and outcomes from the blog post: During Q1 2026, government-directed shutdowns caused prolonged Internet blackouts in Uganda and Iran, with Iran remaining offline for a large part of the quarter. Cloudflare's Radar social media posts and traffic graphs observed a near-complete loss of traffic from Iran, suggesting the shutdown was implemented by filtering, with "whitelists" and "white SIM cards" restricting access to approved Internet sites. Cloudflare also tracked disruptions caused by power outages, military action, and physical damage to hyperscaler cloud infrastructure, including Amazon Web Services data centers in the Middle East.

NetworkingSecurity
1 min
Cloudflare15d ago

Making Rust Workers reliable: panic and abort recovery in wasm‑bindgen

Rust Workers on Cloudflare's platform were previously at risk of leaving the runtime in an undefined state upon panic or unexpected abort, bricking instances and affecting subsequent requests. A new version of Rust Workers now provides comprehensive Wasm error recovery, which includes panic and abort handling. The solution involved modifying wasm-bindgen, the core project that generates Rust-to-JavaScript bindings, to introduce panic=unwind support and abort recovery mechanisms. These changes enable the recovery of stateful instances and reduce the risk of persistent failure modes, while also ensuring that the WebAssembly instance remains valid and reusable even after panics and aborts.

NetworkingSecurity
1 min
Cloudflare16d ago

Moving past bots vs. humans

Cloudflare is shifting its focus beyond detecting human vs. bot traffic, towards understanding intent and behavior. They argue that traditional approaches to web protection are insufficient as the lines between humans and bots become increasingly blurred. By introducing AI-powered clients that fetch raw data rather than rendering pages, publishers face challenges in understanding how their content is being used.

NetworkingSecurity
1 min
Cloudflare17d ago

Building the agentic cloud: everything we launched during Agents Week 2026

Here's a 2-3 sentence summary of the engineering blog post: Cloudflare has launched a series of tools and services to enable the agentic cloud, a new model for cloud computing where agents can run in parallel and at scale. The company has introduced compute services like Sandboxes, Dynamic Workers, and Durable Objects to provide lightweight and isolated environments for agents, as well as security features like Cloudflare Mesh and Managed OAuth for Access. Additionally, Cloudflare has released an agent toolbox with primitives like inference, search, memory, and voice to enable capable and productive agents.

NetworkingSecurity
1 min
Cloudflare17d ago

The AI engineering stack we built internally — on the platform we ship

Here's a 3-sentence summary of the article: Cloudflare built an internal AI engineering stack on the same platform used for its external products, integrating AI into its engineering workflow and improving developer velocity. The stack includes a platform layer (AI Gateway, Workers AI, MCP Portal, Code Mode) for secure authentication, routing, and inference, a knowledge layer (Backstage, AGENTS.md) for agent understanding, and an enforcement layer (AI Code Reviewer, Engineering Codex) for quality control at scale. As a result, 93% of Cloudflare's R&D organization uses AI coding tools daily, and the company has seen a significant increase in merge requests, reaching a 4-week rolling average of 8,700/week, nearly double the Q4 baseline.

NetworkingSecurity
1 min
Cloudflare17d ago

Orchestrating AI Code Review at scale

Cloudflare engineers developed a scalable AI code review system that integrates multiple AI agents to review code quality, security, and compliance. The system uses a plugin architecture to support various version control systems, AI providers, and internal standards. It has been successfully run across tens of thousands of merge requests, approving clean code and flagging real bugs with high accuracy. The system consists of a coordinator process that spawns OpenCode sessions for sub-reviewers and provides configuration through a controlled interface. Each sub-reviewer runs in its own OpenCode session, using its own agent prompt and model. The system isolates VCS-specific coupling and uses a composable plugin architecture to support multiple plugins, including GitLab, AI Gateway, codex, and tracing and observability. The implementation allows for high scalability, flexibility, and maintainability, enabling Cloudflare engineers to review code more efficiently and effectively.

NetworkingSecurity
1 min
Cloudflare20d ago

Introducing the Agent Readiness score. Is your site agent-ready?

Cloudflare introduced a tool to check website "agent-readiness" as agents interact with websites. The tool provides scores and feedback on four dimensions: content discoverability, content accessibility, bot access control, and capabilities. For content discoverability, most sites have robots.txt, but few support formats like MCP Server Cards and API Catalogs. For accessibility, few sites offer Markdown for Agents or LLM-friendly representations like llms.txt. The tool helps site owners optimize for agents and can be accessed at isitagentready.com.

NetworkingSecurity
1 min
Cloudflare20d ago

Shared Dictionaries: compression that keeps up with the agentic web

To tackle the growth of web pages and the impact of agents on caching, Cloudflare develops shared dictionaries, a compression technique that leverages cached content. This allows servers to send only the differential changes to clients, reducing the overall transfer size and load time. Early testing has shown significant reductions in transfer size, with a 500KB bundle shrunk to a few kilobytes after a one-line code change. The key benefit of shared dictionaries is the use of delta compression, which compares the new version of a resource against the previously cached version. By sending only the diff, the server compresses against what the client already has, reducing redundant transfers and saving bandwidth and CPU. This strategy is especially effective for versioned JS bundles, CSS files, and framework updates that change incrementally between releases.

NetworkingSecurity
1 min
Cloudflare20d ago

Introducing Flagship: feature flags built for the age of AI

Here is a 2-3 sentence summary of the blog post: Cloudflare introduces Flagship, a feature flag service designed for the age of AI, enabling developers to safely ship AI-generated code to production by decoupling human attention from deployment processes. Flagship evaluation occurs directly within the Cloudflare network, reducing latency and overhead, and is built on the OpenFeature standard for feature flag evaluation across languages and providers. The service aims to provide a streamlined and safe way for developers to utilize AI-generated code in production, while maintaining control and visibility over deployed features.

NetworkingSecurity
1 min
Cloudflare20d ago

Redirects for AI Training enforces canonical content

Cloudflare has launched "Redirects for AI Training" to enforce canonical content for AI training crawlers. This feature automatically redirects verified AI training crawlers to the latest version of a page via HTTP 301 redirects if a non-self-referencing canonical tag is present in the HTML, ensuring they receive accurate information. With this integration, Cloudflare plans to improve the accuracy of AI-generated answers by directing training crawlers to up-to-date content.

NetworkingSecurity
1 min
Cloudflare20d ago

Agents Week: network performance update

Cloudflare's network performance improved significantly, becoming the fastest provider in 60% of the top networks by December 2025, up from 40% in September 2025. This improvement was achieved by optimizing software efficiency, reducing processing time, and leveraging protocols like HTTP/3 to handle connections more efficiently. As a result, Cloudflare was 6ms faster than the next-fastest provider on average throughout December.

NetworkingSecurity
1 min
Cloudflare20d ago

Unweight: how we compressed an LLM 22% without sacrificing quality

Cloudflare's engineering team developed Unweight, a lossless compression system for large language model (LLM) weights, reducing model size by 22% without affecting quality. This is achieved by selectively compressing the exponent byte of BF16 weights, which is highly redundant, using Huffman coding and storing the resulting matrix in fast on-chip shared memory. Unweight's runtime optimizes execution strategies across different batch sizes and weight shapes, minimizing memory traffic and ensuring efficient inference. Unweight's key innovation lies in decompressing weights in fast on-chip memory and feeding the results directly to the tensor cores, avoiding an extra round-trip through slow main memory. This approach enables efficient inference on NVIDIA H100 GPUs, which can run more models in more places, making inference cheaper and faster on Cloudflare's network.

NetworkingSecurity
1 min
Cloudflare20d ago

Agents that remember: introducing Agent Memory

Cloudflare introduces Agent Memory, a managed service that provides persistent memory for AI agents. By storing relevant information and recalling it when needed, Agent Memory enables agents to learn and improve over time, without filling up the context window. This allows developers to build more sophisticated agents that can retain knowledge and make more informed decisions.

NetworkingSecurity
1 min