1. Introducing full transaction detection for Cloudflare WAF Today, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules. Full transaction detections evaluate each 10/21 22:10 ♡
2. Cloudflare deploys protections against php2shell vulnerability Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell . The vulnerabilities affect 10/21 21:56 ♡
3. How Commerce.com and Cloudflare are getting storefronts ready for AI agents AI can write code and pass the bar exam, but it still struggles to buy a pair of shoes online. That’s because websites were built for humans, not agents. Most agents that shop for 10/21 21:00 ♡
4. 8 eMudhra certificates are compromised. Here's what you need to know On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certifica 10/21 06:20 ♡
5. Introducing tsrs: A port of TypeScript to Rust Cloudflare and VoidZero are now working with Max Schwenk of Owner.com on tsrs , a Rust port of the TypeScript compiler. We are doing this work in close collaboration with the TypeS 10/20 21:00 ♡
6. Cutting our inference bill by 68% by being obsessive about optimization When we previously blogged about our AI code reviewer in April , an average review cost a palatable $1.19. By the end of August, that figure had shot up to about $2.46. We hadn 10/20 03:12 ♡
7. Introducing Clairic, a new System One class of extraction models Today, we're announcing a preview of a new class of System One-style models: extraction models. Our first one, Clairic, is available hosted on Workers AI as @cf/cloudflare/cla 10/20 01:48 ♡
8. Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access a 10/19 21:00 ♡
9. Continuous accountability for Verified bots A driver’s license tells you who someone is and that they passed a driving test, not whether they’ll drive responsibly in the future. The same is true for bots: verifying who opera 10/16 21:00 ♡
10. A fully programmable secure web gateway Every secure web gateway on the market works the same way: traffic matches a condition. A terminal action fires. Allow, Block, Isolate, Log. This model has been the foundation of n 10/16 01:11 ♡
