Cloudflare has deployed new Web Application Firewall (WAF) protections for two critical vulnerabilities affecting WordPress. The protections address an Unauthenticated Remote Code Execution (RCE) vulnerability in WordPress's REST API and a related SQL Injection vulnerability.The WordPress security t...

Starting today, Cloudflare Inte al DNS is generally available. Cloudflare Inte al DNS provides authoritative and recursive DNS for private networks on the same global network and control plane customers already use for public DNS, Zero Trust, networking, and application services.Inte al DNS — someti...

For 96 years, the World Cup has been a global phenomenon, uniting nations and communities through a shared love of sportsmanship. While its popularity is nothing new, what is novel today is how rare a truly collective global experience has become. In an era defined by microtrends and algorithmic bub...

Today we’re excited to a ounce Cache Response Rules. These are a new rule type that runs after an origin server replies but before Cloudflare caches the content. If you've ever been irked watching something that should easily sail out of cache get dragged back to the origin by a stray Set-Cookie or ...

Border Gateway Protocol (BGP) is the de facto routing protocol of the Inte et. It offers built-in mechanisms to allow entities, represented by Autonomous Systems (ASes), to express how they want to send and receive traffic on the Inte et. One such mechanism is path attributes, which carry essential ...

Debugging privacy-preserving protocols is hard. Oblivious HTTP has several different steps across four different parties, not to mention binary HTTP encoding and details spread across many draft RFCs. We've taken what we've lea ed operating protocols like Oblivious HTTP at the scale of millions of r...

Like most infrastructure, the Inte et's fragility is easy to overlook — as long as it's working. When it fails, its complexity comes into full view. Cloudflare is in a unique position to detect and document the moments when one of the interrelated systems the Inte et depends on breaks down and co ec...

Cloudflare's Authenticated Origin Pulls and Custom Origin Trust Store now support post-quantum authentication.Here we’ll explain how you can configure fully post-quantum secure mutually authenticated TLS co ections to your origin server, dive into the engineering details of how we built it, make a s...

As of June 23, 2026, cdnjs, one of the Inte et's busiest open-source CDNs, is ru ing exclusively on Cloudflare’s Developer Platform. Along the way, cdnjs surfaced limits in the platform, and the platform grew to meet them.cdnjs is a free, open-source content delivery network for JavaScript and CSS l...

Last year, we enabled Media over QUIC (MoQ) on every Cloudflare server and opened the network for anyone to test. It provided a global MoQ endpoint, but not the isolation and access controls needed to run an application.Today, we’re adding those isolation and access controls. The new MoQ provisionin...

On 18 November 2025 at 11:20 UTC (all times in this blog are UTC), Cloudflare's network began experiencing significant failures to deliver core network traffic. This showed up to Inte et users trying to access our customers' sites as an error page indicating a failure within Cloudflare's network. Th...

As the surface area for attacks on the web increases, Cloudflare’s Web Application Firewall (WAF)  provides a myriad of solutions to mitigate these attacks. This is great for our customers, but the cardinality in the workloads of the millions of requests we service means that generating false positi...

There is a theory which states that if ever anyone discovers exactly what the Linux networking stack does and why it does it, it will instantly disappear and be replaced by something even more bizarre and inexplicable.There is another theory which states that Git was created to track how many times ...

On April 10th, 2025 12:10 UTC, a security researcher notified Cloudflare of two vulnerabilities (CVE-2025-4820 and CVE-2025-4821) related to QUIC packet acknowledgement (ACK) handling, through our Public Bug Bounty program. These were DDoS vulnerabilities in the quiche library, and Cloudflare servic...

Linux’s networking capabilities are a crucial part of how Cloudflare serves billions of requests in the face of DDoS attacks. The tools it provides us are invaluable and useful, and a constant stream of contributions from developers worldwide ensures it continually gets more capable and performant.W...

IP addresses have historically been treated as stable identifiers for non-routing purposes such as for geolocation and security operations. Many operational and security mechanisms, such as blocklists, rate-limiting, and anomaly detection, rely on the assumption that a single IP address represents a...

Every interaction on the Inte et—including loading a web page, streaming a video, or making an API call—starts with a co ection. These fundamental logical co ections consist of a stream of packets flowing back and forth between devices.Various aspects of these network co ections have captured the at...

The Inte et is in the midst of one of the most complex transitions in its history: the migration to post-quantum (PQ) cryptography. Making a system safe against quantum attackers isn't just a matter of replacing elliptic curves and RSA with PQ alte atives, such as ML-KEM and ML-DSA. These algorithms...

The way we interact with the Inte et is changing. Not long ago, ordering a pizza meant visiting a website, clicking through menus, and entering your payment details. Soon, you might just ask your phone to order a pizza that matches your preferences. A program on your device or on a remote server, wh...

As bots and agents start cryptographically signing their requests, there is a growing need for website operators to lea public keys as they are setting up their service. I might be able to find the public key material for well-known fetchers and crawlers, but what about the next 1,000 or next 1,000,...