Long prompts to GLM-5.3 on Workers AI could return text from other users' requests from 27 Aug to 9 Sep. Cloudflare and SGLang explain the bug and the fix.
At Cloudflare Connect, Mastercard showed an agent paying two merchants nine times on one budget with signed x402 vouchers, and opened developer early access.
Cloudflare previews Clairic on Workers AI: an extraction model that returns typed values with confidence scores and no generated tokens. Open weights promised.
Cloudflare's 15 October post says a July pilot on about 1% of its network fed discovery signals to OpenAI's search crawler. The page count is Cloudflare's.
Ryan Dahl says the whole Deno team is joining Cloudflare to merge celld into workerd. The Deno runtime gets one more year of fixes, Deno Deploy shuts down in six months, and JSR keeps running.
On 11 October 2026 the DNS root is scheduled to sign with KSK-2024, key tag 38696, in place of KSK-2017, tag 20326. Validating resolvers must trust the new key. Most website operators do not need a change.
Cloudflare's 1 October 2026 changelog says workers-oauth-provider v1 can run token issuing and an MCP resource server in separate Workers, with MCP's July 2026 client-metadata flow. npm shows 1.0.0 on 24 September.
Cloudflare's 1 October 2026 post adds ML-KEM and ML-DSA to Workers Web Crypto, off until you set webcrypto_modern_algorithms. ML-KEM-512 is absent. SHA-3 and HPKE are not in this change.
Cloudflare's 1 October 2026 post introduces Workers KV Instant, a private beta that replicates keys through Quicksilver. Reads are $0.20 per million, and a namespace tops out at 1 MB.
Cloudflare's 2 October 2026 post opens Cloudflare Traces in beta: one OpenTelemetry timeline for supported security, cache, routing, Worker, and origin steps, exported over OTLP. New ingest pricing starts 1 December.
Cloudflare's 1 October 2026 post opens a waitlist for a managed Cloudflare OS deployment. Self-hosting remains. The same post says the workspace can now use a GitHub repo and more of Google Workspace.
Cloudflare's 2 October 2026 post adds an OHTTP Gateway in closed beta, as a paid add-on with a waitlist. The older Privacy Gateway relay is renamed OHTTP Relay. The gateway refuses Cloudflare-proxied clients.
Cloudflare's 1 October 2026 post launches K2 in public beta: an ordered event log stored as files in R2, with competing consumers or fan-out. Cloudflare says produce latency is about 1 second at p99.
Cloudflare posted Clef and Clef-flash on 1 October 2026: Apache 2.0 decision models on Workers AI that return a probability for every allowed answer, plus a hands-on fine-tuning offer.
Cloudflare's 1 October 2026 post says the data platform from Birthday Week 2025 is now Basin, and that Pipelines, Catalog, and SQL are generally available on Apache Iceberg in R2.
Cloudflare's 1 October 2026 posts put Artifacts, its Git-speaking versioned filesystem, in open beta. A contest for agent-era Git tools closes 14 October, and usage billing starts 15 October.
The Agents SDK changelog of 2 October 2026 adds PiHarness so a Pi 1.0 agent can keep a turn on a Durable Object. Cloudflare calls the API beta and says Pi Durable is still experimental.
Cloudflare has launched a Web Search API through AI Gateway with Ceramic.ai, Exa and Linkup. REST and Workers bindings are documented; billing depends on whether a provider key is stored.
A generic guide to hosting 10,000 static pages on the Cloudflare Pages and R2 free tiers: file count, builds, bandwidth, requests and what breaks first. Limits as of October 2026.
Sebastiaan Neuteboom’s Cloudflare Blog (Aug 27, 2026) is a Rust-in-prod layout case study on Big Pineapple’s DNS cache: five successive changes, vendor 953→420 B (−56%) and ~100 TB fleet savings.
Threat Signals GA free for every Cloudflare account (blog Sep 29, 2026): 1 RSS feed on free tier, private dataset up to 30 days, Threat Events access. RSS→Browser Run→IOC→Threat Events→WAF as CF describes—no latency/accuracy SLAs; review before block.