Building a serverless, post-quantum Matrix homeserver
2026-01-27
As a proof of concept, we built a Matrix homeserver to Cloudflare Workers — delivering encrypted messaging at the edge with automatic post-quantum cryptography....
Continue reading »
How we mitigated a vulnerability in Cloudflare’s ACME validation logic
2026-01-19
A vulnerability was recently identified in Cloudflare’s automation of certificate validation. Here we explain the vulnerability and outline the steps we’ve taken to mitigate it. ...
Astro is joining Cloudflare
2026-01-16
The Astro Technology Company team — the creators of the Astro web framework — is joining Cloudflare. We’re doubling down on making Astro the best framework for content-driven websites, today and in the years to come....
The 2025 Cloudflare Radar Year in Review: The rise of AI, post-quantum, and record-breaking DDoS attacks
2025-12-15
We present our 6th annual review of Internet trends and patterns observed across the globe, revealing the disruptions, advances and metrics that defined 2025. ...
How Workers VPC Services connects to your regional private networks from anywhere in the world
2025-11-05
Workers VPC Services enter open beta today. We look under the hood to see how Workers VPC connects your globally-deployed Workers to your regional private networks by using Cloudflare's global network, while abstracting cross-cloud networking complexity....
MORE POSTS
October 29, 2025 1:00 PM
One IP address, many users: detecting CGNAT to reduce collateral effects
IPv4 scarcity drives widespread use of Carrier-Grade Network Address Translation, a practice in ISPs and mobile networks that places many users behind each IP address, along with their collected activity and volumes of traffic. We introduce the method we’ve developed to detect la...
- By
October 29, 2025 1:00 PM
Defending QUIC from acknowledgement-based DDoS attacks
We identified and patched two DDoS vulnerabilities in our QUIC implementation related to packet acknowledgements. Cloudflare customers were not affected. We examine the "Optimistic ACK" attack vector and our solution, which dynamically skips packet numbers to validate client beha...
- By
October 28, 2025 1:00 PM
Keeping the Internet fast and secure: introducing Merkle Tree Certificates
Cloudflare is launching an experiment with Chrome to evaluate fast, scalable, and quantum-ready Merkle Tree Certificates, all without degrading performance or changing WebPKI trust relationships....
- By
October 16, 2025 2:00 PM
Improving the trustworthiness of Javascript on the Web
There's no way to audit a site’s client-side code as it changes, making it hard to trust sites that use cryptography. We preview a specification we co-authored that adds auditability to the web....
- By
September 29, 2025 2:00 PM
15 years of helping build a better Internet: a look back at Birthday Week 2025
Rust-powered core systems, post-quantum upgrades, developer access for students, PlanetScale integration, open-source partnerships, and our biggest internship program ever — 1,111 interns in 2026....
- By
September 25, 2025 2:00 PM
Safe in the sandbox: security hardening for Cloudflare Workers
We are further hardening Cloudflare Workers with the latest software and hardware features. We use defense-in-depth, including V8 sandboxes and the CPU's memory protection keys to keep your data safe....
- By
September 24, 2025 2:00 PM
Automatically Secure: how we upgraded 6,000,000 domains by default to get ready for the Quantum Future
After a year since we started enabling Automatic SSL/TLS, we want to talk about these results, why they matter, and how we’re preparing for the next leap in Internet security....
- By
September 19, 2025 1:44 PM
You don’t need quantum hardware for post-quantum security
Post-quantum cryptography protects against quantum threats using today’s hardware. Quantum tech like QKD may sound appealing, but it isn’t necessary or sufficient to secure organizations....
- By
September 04, 2025 5:30 PM
Addressing the unauthorized issuance of multiple TLS certificates for 1.1.1.1
Unauthorized TLS certificates were issued for 1.1.1.1 by a Certification Authority without permission from Cloudflare. These rogue certificates have now been revoked....
- By
August 29, 2025 2:05 PM
Automating threat analysis and response with Cloudy
Cloudy now supercharges analytics investigations and Cloudforce One threat intelligence! Get instant insights from threat events and APIs on APTs, DDoS, cybercrime & more - powered by Workers AI....
- By
August 28, 2025 2:00 PM
The age of agents: cryptographically recognizing agent traffic
Cloudflare now lets websites and bot creators use Web Bot Auth to segment agents from verified bots, making it easier for customers to allow or disallow the many types of user and partner directed....
- By
August 26, 2025 2:00 PM
Block unsafe prompts targeting your LLM endpoints with Firewall for AI
Cloudflare's AI security suite now includes unsafe content moderation, integrated into the Application Security Suite via Firewall for AI. ...
- By
August 25, 2025 2:05 PM
Unmasking the Unseen: Your Guide to Taming Shadow AI with Cloudflare One
Don't let "Shadow AI" silently leak your data to unsanctioned AI. This new threat requires a new defense. Learn how to gain visibility and control without sacrificing innovation....
- By
August 18, 2025 2:00 PM
Announcing the Cloudflare Browser Developer Program
Announcing the Browser Developer Program: Cloudflare’s new collaborative program to help shape Cloudflare challenges that work seamlessly with your browser. Join us today!...
- By
August 14, 2025 10:03 PM
MadeYouReset: An HTTP/2 vulnerability thwarted by Rapid Reset mitigations
A new HTTP/2 denial-of-service (DoS) vulnerability called MadeYouReset was recently disclosed by security researchers. Cloudflare HTTP DDoS mitigation, already protects from MadeYouReset....
- By