Cloudflare Network Firewall has a new managed rule to help mitigate the Linux IPv4 TCP use-after-free vulnerability (CVE-2026-98432 ↗︎): Rule name: Block CVE-2026-98432 traffic Rule ID: 6a4df2bf984946a88c74b07349557e83 The rule is disabled by default. To use it: Go to Networking > Firewall Policies > Managed Rulesets. Enable the rule with action Log first. Review traffic that matches the rule. If…
Private load balancers can now keep each user on the same endpoint. This helps with applications that keep session state on a single server. Cloudflare One Client or Cloudflare WAN siteConnects to 100.112.0.0Private load balancerPicks a healthy endpoint based on your steering policyHealth monitorsSteeringSession affinityPool 1Cloudflare Tunnel10.0.0.1vnet-aPool 2Cloudflare Mesh node10.1.0.1default…
Isolation policies now support a third keyboard option in beta: Allow read-only actions. Previously, the keyboard setting was binary — allow all input or block everything. With Allow read-only actions, you can block data entry while preserving the built-in browser actions your users depend on. In Allow read-only actions mode, users can still find in page, select all, copy, print, and zoom. All oth…
AI Gateway now supports model aliases. A model alias is a pool of models that your application calls by one name, such as custom/support-fast. AI Gateway tries the models in the order you set and falls back to the next one if a request fails, or uses smart routing to choose a model for each request. Because your application only references the alias, you can swap models or change the routing algor…
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
The Configure AI bot policies setting is now named AI Crawler and Agent access policies. Personal agents act on a person's behalf, fetching information or browsing in response to a request. The updated policies let you set actions for the top Personal Agents individually. This gives you control over agent access while allowing visitors to use agents to find answers or compare products using your s…
Account Abuse Protection now shows when a recognized AI assistant makes a login or sign up request, and which account it was acting for. Population overview: See which AI assistants are active across your users and how many accounts use them. Account activity: Every login and sign up event shows whether an AI assistant made the request, and which one. AI assistant filters: filter accounts by numbe…
Cloudflare Radar now includes Zero Wire ↗︎, a hub for investigating critical Internet vulnerabilities and threats. Each briefing separates confirmed facts from open questions, lists remediation steps, and shows what Cloudflare observes about the threat. Briefings Briefings are grouped by urgency. Needs attention covers active incidents, new guidance, or unresolved scope that security teams should…
New AI Gateways now require authentication to prevent unauthorized requests. Once authentication is on, you cannot turn it off through the dashboard or API. When you create a new AI Gateway through the API, authentication is on by default. You can leave out the authentication field or set it to true. If you set it to false, the API returns HTTP 400. When you update an existing gateway, leaving out…
This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative changes based on reports from Security Researchers as part of PHP Capture the Flag (CTF) challenge ↗︎. RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Free Ruleset...bcd…
You can now compare regional activity and errors by HTTP status code on the Metrics page for a R2 bucket in the Cloudflare dashboard. Go to Bucket metrics ↗ Compare regions Use Request Distribution by Region to compare request activity and filter by writes, reads, errors, or rate-limited errors (429). Inspect errors Use Errors by Status Code to compare error counts and trends. To troubleshoot erro…
Browser Run /crawl results now include more detailed diagnostics. Each URL record can include an outcome that identifies the specific processing result, such as success, robots_disallowed, timeout, or page_error. The job-level robots array reports the robots.txt state for up to 50 origins encountered by the crawl. Each entry includes the origin, whether usable rules were available, and the HTTP st…
Agents SDK v0.33.0 upgrades PiHarness to Pi 1.5 ↗︎. The release reduces storage transactions while streaming, improves throughput across many sessions, and reduces memory use when streaming large tool calls. Performance improvements Far fewer storage writes while streaming. Pi stores streamed answers and tool output in batches, within a second of each update, instead of on every update. Over SQLit…
Announcement DateRelease DateRelease BehaviorLegacy Rule IDRule IDDescriptionComments2026-10-122026-11-10LogN/A...5ea9966dBroken Access Control - Directory Traversal (Beta)This rule will be merged into the original rule "Broken Access Control - Directory Traversal" (ID: ...cb14ded8).2026-11-032026-11-10LogN/A...7178209bGeneric Rules - Dangerous File UploadThis is a new detection.
Account Abuse Protection customers in Early Access can now investigate login and sign up activity in a dedicated dashboard under Security > Account Abuse Protection. Population overview: See total login and sign up events, unique accounts, IPs and devices, top countries and ASNs, and leaked credential check results. Filter accounts by signals such as leaked credential events and unique IPs to find…
You can now assign key-value tags to Access service tokens and use those tags to organize credentials or control application access. Each token supports up to five tags, such as environment: production or team: payments. Add or edit tags when you create or update a token in the dashboard or service token API. You can search and filter by tag on the Service Tokens page. Tags also appear in Resource…
Billing postponed to December 1, 2026 AI Search billing has been postponed by one month and now begins on December 1, 2026, instead of November 1, 2026. You will not be charged for AI Search usage before December 1, 2026. Pricing and included usage are unchanged. For rates and included usage, refer to Limits & pricing. Default sync interval is now 24 hours The default sync interval for AI Search i…
Starting November 17, 2026, JavaScript Workers with a compatibility date of 2026-11-17 or later will use the new module registry by default. You will no longer need the new_module_registry flag for these dates. Python Workers keep using the legacy registry. The module registry finds and loads JavaScript modules in your Worker. We announced the new registry in September 2026 ↗︎. It improves compati…
Starting November 17, 2026, Workers with a compatibility date of 2026-11-17 or later will receive client disconnection events through request.signal by default. Use these events to stop unnecessary work when a client leaves. You will no longer need the enable_request_signal compatibility flag for these dates. We introduced this feature in May 2025. You can log cancellations, clean up resources, or…
Flagship bindings now evaluate flags against a local flag store during local development, instead of calling your remote app. You can develop offline and test flag changes without affecting production. This applies to wrangler dev, the Cloudflare Vite plugin, the Vitest integration, and cf dev. The local store starts empty, so evaluations return the default value you pass in code. Add and manage l…
This emergency release adds a new rule to the Cloudflare Managed Ruleset, disabled by default, for a vulnerability in Nuxt Image and IPX. The rule offers partial coverage. Please follow the advisory and patch to the latest version. RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...5b82bffeN/ANuxt Image / IPX - Explicit GIF or Animation Modifier Ex…
This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative changes based on reports from Security Researchers as part of PHP Capture the Flag (CTF) challenge ↗︎. RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...…
Keyless SSL supports TLS 1.3 for ECDSA certificates. When TLS 1.3 is enabled on your zone, visitors connecting to a hostname that serves a Keyless ECDSA certificate negotiate TLS 1.3, and your private keys stay on your own key server. Keyless SSL connections that use RSA certificates continue to negotiate up to TLS 1.2. For details, refer to the Keyless SSL limitations.
Cloudflare WAN traffic can now use a Gateway processing region with Regional Services. HTTPS traffic enters a Cloudflare data center (that may be outside the selected region) via an IPsec or GRE tunnel, or through Direct CNI, and remains encrypted until Gateway forwards it to the selected region for TLS decryption and HTTP inspection. This feature gives organizations control over where their sensi…
Browser Run now runs Chrome 152 by default. Your sessions get current web platform features, rendering fixes, and security patches. You do not need to change your code. This release also includes the following improvements: Updated default User-Agent. The default User-Agent for Quick Actions now reports Chrome 152 instead of Chrome 119. If you allowlist or match the Browser Run User-Agent, update…
Durable Objects can stay active across requests, allowing you to run long-running agents, maintain long-lived WebSocket connections and coordinate state across many clients. This is possible because each Durable Object is globally unique, and this means it must run only one version of your code at a time. Previously, when you deployed a change to your Durable Objects code, that change would be app…
Beginning Wednesday, November 4, 2026, D1 will enforce a maximum query result size of 50 MB. Queries that return a result larger than 50 MB will fail and return the following error: D1 query result exceeded the maximum response size limit of 50 MB The 50 MB limit covers the 99.999th percentile of requests across D1, so most D1 users will not be impacted. Import and export operations via the REST A…
The SCIM population viewer lets you inspect the users and groups provisioned to Cloudflare One by each identity provider. You can check which resources Cloudflare has received without making API requests or opening a support ticket. In Zero Trust > Integrations > Identity providers, select a user or group count in SCIM resources to open the viewer. You can: Search users by username, email, name, o…
The new DNS records experience announced in May is now the default for all users on all plans, including Enterprise. The classic DNS records page has been retired and is no longer available in the Cloudflare dashboard. Changing a record's type When the new experience first launched, it did not support changing the type of an existing DNS record. Based on your feedback, we have since added this, so…
Audit Logs v2 now includes analytics for account-level audit logs in the Cloudflare dashboard. The Actions over time chart separates successful and failed actions for the selected time range. Summary cards show Total actions, Unique actors, Products impacted, and Failure rate. Select a card to investigate action types, authentication methods, top actors, top products, or failed actions. You can ap…