techlist.io
KREN

Cloudflare

78 posts

cloudflare3 min readCurated summary

Durable Objects in Dynamic Workers: Give each AI-generated app its own database

Dynamic Workers make it possible to run AI-generated code securely in lightweight isolates, but disposable execution is not enough for persistent applications. Cloudflare’s Durable Object Facets address this by letting a supervised Durable Object dynamically load an AI-generated Durable Object class with its own SQLite-backed storage. This combines sandboxed, persistent application state with centralized control over provisioning, access, logging, metrics, and billing. ## From Disposable Code to Persistent Apps - Dynamic Workers load code on demand in secure isolates rather than containers. - Isolates start quickly and use little memory, making them suitable for short-lived AI-generated tasks. - Persistent AI-built applications need: - Custom user interfaces - Long-lived state - Secure execution - A remote SQL database could provide storage, but it introduces network latency and additional infrastructure. ## Why Durable Objects Fit - Each Durable Object has: - A globally unique name - One active instance per name - An attached SQLite database stored locally - Local SQLite storage provides extremely low-latency access. - AI-generated applications can therefore use normal Durable Object storage APIs, including key-value and SQL storage. ## Limitations of the Traditional Model - Standard Durable Objects require: - A class extending `DurableObject` - Exporting the class from the Worker - Wrangler configuration to provision storage - A namespace binding for access - This model does not naturally support code loaded dynamically at runtime. - Giving an agent direct control of Durable Object namespaces could also allow uncontrolled object creation and storage use. - A platform needs an intermediary to enforce limits and provide observability, billing, and other operational controls. ## Durable Object Facets - Facets allow a normal, statically configured Durable Object to dynamically instantiate another Durable Object class. - The outer object acts as a supervisor: - Loads the agent’s code as a Dynamic Worker - Selects the exported Durable Object class - Forwards requests or RPC calls - Controls and monitors the application - The dynamically loaded class can directly extend `DurableObject`. - Each facet receives its own SQLite database, separate from the supervisor’s database. - Multiple facets can exist within one Durable Object, each identified by a name and subject to storage limits. ## Example Architecture - An `AppRunner` Durable Object receives incoming requests. - It obtains a facet named `"app"` through `this.ctx.facets.get(...)`. - When the facet starts, the runner: - Loads the Dynamic Worker - Retrieves its exported application class - Instantiates it as the facet - Requests are then forwarded to the dynamically loaded application. - The sample application maintains a request counter using Durable Object storage. Durable Object Facets provide a practical foundation for AI-generated applications that need persistent state without sacrificing isolation or platform governance. They are especially suited to personal or small “vibe-coded” apps, where each application can receive its own storage while the host platform retains control over resource usage and operational policies.

Read original(opens in new tab)
CloudflareDatabase DesignPostgreSQLDurable Objects+3
cloudflare4 min readCurated summary

500 Tbps of capacity: 16 years of scaling our global network

Cloudflare’s network has grown from a single transit provider in 2010 to more than 500 Tbps of provisioned external capacity across 330+ cities. The company argues that this scale is not merely about bandwidth: it enables security decisions, application execution, and routing validation to happen locally on every server. Its distributed architecture can absorb massive attacks automatically while supporting edge computing and emerging Internet protocols. ## From Transit Provider to Global Network - Cloudflare began with nLayer Communications as its first transit provider. - Expansion required city-by-city work: colocation contracts, fiber installation, hardware deployment, and Internet exchange peering. - In 2018, Cloudflare opened 31 cities in 24 days, despite logistical challenges such as customs delays and missing equipment. - The network now spans more than 330 cities and protects over 20% of the web. - The 500 Tbps figure represents provisioned interconnection capacity across transit, private peering, Internet exchanges, and Cloudflare Network Interconnect ports—not peak traffic. ## Turning the Network into a Security Layer - Cloudflare expanded from caching websites to securing employees and enterprise networks. - Its systems establish secure tunnels to private subnets and advertise customer IP space through BGP. - In 2025, Cloudflare mitigated a 31.4 Tbps DDoS attack lasting 35 seconds. - The attack was part of more than 5,000 attacks blocked that day, without paging an engineer. - Distributed automation allows attacks that once required nation-state resources to be handled in seconds. ## Packet-Level DDoS Mitigation - Incoming packets enter an XDP program chain in driver mode immediately after reaching the network interface card. - The `l4drop` eBPF program applies mitigation rules generated by `dosd`, Cloudflare’s denial-of-service daemon. - Each server identifies heavy traffic sources and shares the information across its colocation facility. - Mitigation rules spread globally through Quicksilver, Cloudflare’s distributed key-value store. - Only legitimate traffic reaches Unimog, the Layer 4 load balancer; Magic Transit traffic receives additional stateful inspection through `flowtrackd`. - The 31.4 Tbps attack was stopped at line rate without centralized scrubbing or human intervention. - Sufficient physical port capacity remains essential: software defenses cannot work if the network cannot first absorb the traffic. ## A Developer Platform at the Edge - Because Cloudflare already runs software on every server for packet filtering, it extended the same infrastructure to customer code through Workers. - Workers, KV, and Durable Objects run across Cloudflare’s global footprint rather than in a small number of cloud regions. - Workers Containers, introduced in 2025, support heavier workloads at the edge. - V8 isolates and custom filesystem layers reduce cold-start times. - Applications run on the same servers that discard malicious traffic before it reaches the network stack. ## Securing Routing with RPKI and ASPA - Cloudflare uses IPv6 and RPKI to reduce the risk of BGP hijacks. - It signs Route Origin Authorizations and rejects routes that fail Route Origin Validation, even when misconfigured networks become temporarily unreachable. - ASPA will extend protection by validating the network path, not just the organization authorized to originate a prefix. - The post compares RPKI to checking a destination passport and ASPA to verifying the entire flight manifest. - Cloudflare says 867,000 prefixes now have valid RPKI certificates, compared with nearly none a decade ago. - The company promotes early adoption of routing security standards because delays leave the Internet exposed to hijacks and route leaks. ## AI Agents and Internet Traffic - AI crawlers, training systems, and autonomous agents now generate more than 4% of HTML requests on Cloudflare’s network. - Human-initiated “user action” crawling increased more than 15-fold in 2025. - Unlike browsers, crawlers may retrieve every linked resource at maximum speed, making legitimate activity difficult to distinguish from attacks. - Cloudflare uses verified bot IP ranges, TLS fingerprints, behavioral analysis, and robots.txt signals to classify AI crawlers. - These signals help site owners decide which automated agents to permit. Cloudflare’s central lesson is that a global network must combine abundant capacity with intelligence distributed across every server. Its continued investment in automated mitigation, edge execution, routing security, and traffic classification is intended to make the Internet faster, safer, and more resilient as traffic patterns evolve.

Read original(opens in new tab)
CloudflareDistributed SystemsNetwork SecurityEbpf+4
cloudflare3 min readCurated summary

How we built Organizations to help enterprises manage Cloudflare at scale

Cloudflare’s new Organizations feature helps enterprises centrally manage users, policies, accounts, and analytics across multiple Cloudflare Accounts. It preserves least-privilege access by allowing teams to remain separated while giving designated organization administrators broader oversight. Initially available in public beta for enterprise customers, Organizations is designed to reduce administrative complexity without granting unauthorized access. ## Why Enterprises Use Multiple Accounts - Separate accounts help teams manage their own resources and limit permissions. - Fine-grained RBAC can still be cumbersome when administrators must enumerate individual resources. - Central administrators currently need access to every account for reporting and policy management. - This setup is fragile because account-level administrators can remove those central administrators. ## Organization Structure and Account Management - Organizations add a management layer above individual Cloudflare Accounts. - The core feature is a flat list of accounts onboarded into the organization. - An account can be added only by someone who is a Super Administrator for that account. - Organizations are built on Cloudflare’s existing Tenant system, originally developed for partners. ## Organization Super Administrators - Org Super Administrators have Super Administrator permissions across every account in the organization. - They do not need memberships in child accounts and do not appear in account-level user interfaces. - The new role is the first of several planned organization-level roles. - Cloudflare consolidated legacy authorization paths into domain-scoped roles. - The permissions overhaul added approximately 133,000 lines of code and removed 32,000. - Permission checks for enumeration endpoints such as `/accounts` and `/zones` became 27% faster, especially for users with access to thousands of accounts. ## Organization-Wide Analytics - Org Super Administrators can view aggregated HTTP traffic analytics. - The dashboard combines data across all accounts and zones in the organization. - Cloudflare plans to add analytics for additional products over time. ## Shared Configurations - Organizations allow centrally managed policy sets to be shared across accounts. - Initial examples include WAF and Gateway policies. - Authorized users in the source account can update shared policies for the broader enterprise. - Security analysts can therefore manage enterprise-wide WAF rules without becoming organization or account administrators everywhere. ## Roadmap and Availability - The beta initially targets enterprise customers. - Cloudflare plans to expand access to pay-as-you-go and other customers, followed by the partner ecosystem. - Planned capabilities include: - Organization-level audit logs - Billing reports - More analytics dashboards - Additional organization user roles - Self-service account creation ## Security-First Rollout - Cloudflare will not automatically create organizations through account backfilling. - A self-service invitation process ensures that no user gains access without approval from a relevant Super Administrator. - The first eligible Super Administrator to claim the company’s organization can add other accounts where they also hold Super Administrator access. - If another employee has already claimed the organization, administrators must coordinate invitations or account-level approval. - Cloudflare Support will not configure organizations on customers’ behalf. Enterprise customers can claim an organization from the Cloudflare Dashboard’s Organizations tab at no additional cost. Companies should coordinate internally with their Super Administrators to ensure all relevant accounts are added securely.

Read original(opens in new tab)
CloudflareDatabase DesignWeb Application FirewallAnalytics+4
cloudflare2 min readCurated summary

Our ongoing commitment to privacy for the 1.1.1.1 public DNS resolver

Cloudflare reports that an independent Big Four accounting firm has confirmed its 1.1.1.1 public DNS resolver continues to meet its privacy commitments. The review was conducted because Cloudflare’s DNS infrastructure has expanded and become more complex since the previous examination in 2020. Cloudflare says it aims to make privacy the default and encourages other public DNS providers to undergo similar independent reviews. ## Renewed Independent Privacy Examination - Cloudflare launched 1.1.1.1 in 2018 as a fast, privacy-focused DNS resolver. - A first independent review took place in 2020. - After major changes to its technology stack and DNS platform, Cloudflare commissioned the same accounting firm to conduct another examination. - The latest review examined evidence collected after the 2024 calendar year and took several months to complete. - The resulting report is available through Cloudflare’s compliance resources. ## Confirmed Privacy Commitments The examination confirmed that: - Cloudflare does not sell or share public resolver users’ personal data with third parties. - Resolver data is not used to target users with advertisements. - Cloudflare retains or uses the requested DNS information, rather than information identifying the person making the request. - Source IP addresses are anonymized and deleted within 25 hours. - DNS query information is not combined with other Cloudflare or third-party data in a way that could identify individual users. ## Limited Network Troubleshooting Data - Cloudflare may use randomly sampled network packets for troubleshooting and attack mitigation. - These samples represent no more than 0.05% of total traffic. - The samples can include the querying IP address, but are used solely for operational security and network reliability purposes. ## Scope of the Latest Review - Unlike the broader 2020 examination, the latest review focused exclusively on privacy commitments. - The earlier review also covered how Cloudflare handled anonymized transaction and debug logs, known as “Public Resolver Logs.” - Cloudflare says the use of those logs has evolved, including supporting services such as Cloudflare Radar. - The company maintains that these changes do not affect personal information or user privacy. Cloudflare’s practical position is that 1.1.1.1 users should not have to trust privacy promises alone: independent examinations should verify them. It recommends reviewing the published accountant’s report and continues to present 1.1.1.1 as a privacy-first DNS option.

Read original(opens in new tab)
CloudflareNetwork SecurityDnsData Protection+1
cloudflare3 min readCurated summary

Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers

Programmable Flow Protection lets Magic Transit Enterprise customers define custom DDoS mitigation logic for proprietary UDP protocols. Customers write eBPF programs that identify valid and malicious packets, then deploy them across Cloudflare’s global network to pass, drop, or challenge traffic. Currently in beta for an additional cost, the system addresses the limitations of generic blocking and rate limiting. ## Custom Protection for Proprietary UDP - Existing Cloudflare protections understand established protocols such as TCP, DNS, NTP, RDP, and SIP. - Proprietary UDP protocols are harder to protect because Cloudflare cannot interpret their application-level payloads. - Customers can now define what constitutes “good” and “bad” traffic using their own protocol knowledge. - Programs can drop or challenge invalid packets before they reach the customer’s origin. ## Why Generic UDP Mitigation Falls Short - UDP is connectionless and optimized for speed, making it useful for gaming, VoIP, and streaming. - When traffic does not match a known protocol, mitigation typically falls back to: - Blocking a destination IP and port - Applying a generic rate limit - These approaches cannot distinguish legitimate packets from attack traffic, potentially causing lag or connection loss for real users. - Fixed rate limits may also be inappropriate: - A network expecting 1 Gbps may need stricter limits. - A network expecting 25 Gbps may require more permissive thresholds. ## How Programmable Flow Protection Works - Customers upload custom eBPF programs that run on every packet destined for their network. - Programs execute in userspace rather than kernel space, providing isolation and flexibility across different customers and use cases. - Execution occurs after Cloudflare’s existing DDoS protections, preserving baseline security coverage. - Like kernel-based XDP eBPF programs, these programs: - Compile to BPF bytecode - Pass safety and termination verification - Run inside a lightweight, isolated virtual machine - Cloudflare provides specialized helpers for: - Maintaining client state between packet executions - Performing cryptographic validation - Sending challenge packets to clients ## Example: Protecting a Proprietary Game Protocol - A gaming provider running on UDP port 207 could inspect its proprietary application header. - If the header contains a protocol-specific token, the customer’s eBPF program can: - Parse the packet - Extract part of the token, such as its final byte - Pass packets with the expected value - Drop packets that fail validation - This allows legitimate players’ traffic through even when attacks use randomized source addresses, ports, and payloads. Programmable Flow Protection is best suited to Magic Transit customers whose custom UDP protocols cannot be protected effectively by standard protocol-aware controls. By combining customer-specific packet logic with Cloudflare’s global network and stateful challenge mechanisms, it enables more precise mitigation than blanket blocking or generic rate limiting.

Read original(opens in new tab)
CloudflareNetwork SecurityEbpfTcp+4
cloudflare2 min readCurated summary

How we use Abstract Syntax Trees (ASTs) to turn Workflows code into visual diagrams

Cloudflare uses Abstract Syntax Trees (ASTs) to turn code-based Workflows into visual diagrams. Because Workflows execute dynamically—supporting parallel promises, awaits, loops, and conditionals—the system analyzes code structure and relationships to infer execution order. The resulting diagrams help developers understand workflow shape, especially as coding agents generate more application code. ## Why Code-Based Workflows Are Difficult to Visualize - Unlike declarative workflow builders, Cloudflare Workflows are ordinary code. - Workflows may contain: - `Promise` and `await` relationships - `Promise.all` for parallel execution - Loops and conditionals - Steps nested inside functions or classes - The runtime discovers and executes steps as it encounters them, rather than following a predefined sequence. - Unawaited steps can execute in parallel, while `await` establishes blocking dependencies. ## How Workflow Execution Works - A supervisor Durable Object, called the engine, starts for each workflow instance. - The engine dispatches execution to the user Worker. - When the Worker encounters `step.do`, control returns to the engine. - The engine executes the step, persists its result or error, and invokes the Worker again. - Since the engine does not inherently retain the complete intended order of steps, diagram generation must reconstruct those relationships from the source code. ## Parsing and Building the Workflow Graph - Cloudflare fetches the bundled Worker script at deployment time. - A parser converts the script into an Abstract Syntax Tree. - An internal service: - Identifies `WorkflowEntrypoints` - Finds calls to workflow steps - Builds and traverses an intermediate graph - Produces the final diagram through Cloudflare’s API - AST analysis tracks promises and `await` expressions to determine: - Which steps depend on one another - Which steps block execution - Which steps can run concurrently ## Handling Bundled and Minified JavaScript - Workers are generally bundled with tools such as esbuild and may be minified. - Minified output can obscure the original TypeScript structure and vary between bundlers. - The diagram system therefore has to recognize workflow patterns in dense, transformed JavaScript. - For example, several agent steps—such as summary, correctness, and clarity agents—may be created without awaiting them, indicating parallel execution. - The generated graph makes that concurrency visible even when the deployed code is difficult to read. Cloudflare’s AST-based approach provides a practical way to visualize dynamic, code-defined workflows. Developers can inspect how steps connect, branch, and execute in parallel directly from the dashboard, though the beta diagrams will continue to improve as more workflow patterns are supported.

Read original(opens in new tab)
CloudflareTypeScriptJavaScriptWorkers+4
cloudflare3 min readCurated summary

Powering the agents: Workers AI now runs large models, starting with Kimi K2.5

Cloudflare is expanding Workers AI beyond smaller models by adding Moonshot AI’s Kimi K2.5, a frontier open-source model designed for agentic workloads. With a 256k context window, tool calling, vision, and structured outputs, Kimi can power an agent’s full lifecycle directly on Cloudflare’s platform. Cloudflare argues that its price-performance makes open-source models essential as personal and enterprise agents dramatically increase inference demand. ## Kimi K2.5’s Price-Performance Advantage - Cloudflare uses Kimi internally for: - Agentic coding through OpenCode - Automated code review via the Bonk public code review agent - Security analysis of Cloudflare codebases - A security-review agent processes more than 7 billion tokens daily and has found over 15 confirmed issues in one codebase. - Compared with a mid-tier proprietary model, switching to Kimi reduced the estimated cost of this workload by 77%, from roughly $2.4 million annually. - As employees increasingly run multiple agents continuously, inference costs become a major barrier to scaling. - Cloudflare positions open-source, frontier-quality models as a more economical alternative to proprietary systems. ## Serving Large Models on Workers AI - Supporting Kimi required upgrades to Workers AI’s inference stack, which historically focused on smaller models. - Cloudflare uses its proprietary Infire inference engine and custom kernels to improve: - Model performance - GPU utilization - Throughput - The platform applies advanced serving strategies such as: - Data, tensor, and expert parallelization - Disaggregated prefill, separating input processing from generation across machines - Workers AI handles these infrastructure optimizations so developers do not need specialized machine learning, DevOps, or reliability engineering expertise. ## Prefix Caching for Agent Workloads - Agents frequently resend large prompts containing: - System instructions - Tool definitions - MCP server tools - Conversation history - Entire codebases - Prefix caching avoids reprocessing unchanged input tokens during multi-turn interactions. - This reduces prefill work, improving: - Time to First Token (TTFT) - Tokens Per Second (TPS) - Overall inference cost - Workers AI now exposes cached tokens as a usage metric and charges less for them than regular input tokens. - Cloudflare has also introduced techniques to improve cache hit rates. ## Session Affinity - Workers AI provides an `x-session-affinity` header to route requests from the same session or agent to the same model instance. - Keeping requests on the same instance increases prefix-cache reuse. - Higher cache hit rates lead to faster responses, greater throughput, and lower costs. - Clients should provide a unique session or agent identifier with the header. Cloudflare’s recommendation is to use Workers AI when building agents that need frontier-level reasoning without the cost and operational burden of proprietary models or self-hosted infrastructure.

Read original(opens in new tab)
CloudflareDatabase DesignLarge Language ModelsKubernetes+4
cloudflare2 min readCurated summary

Introducing Custom Regions for precision data control

Cloudflare is expanding Regional Services with three new managed regions—Turkey, the UAE, and IRAP—and introducing Custom Regions. The feature lets customers define exactly where TLS termination and Layer 7 processing occur while still using Cloudflare’s global network for traffic ingestion and DDoS protection. This combines local data-sovereignty control with globally distributed security and performance. ## Global Security with Local Compliance - Traffic enters through the nearest Cloudflare data center, where Cloudflare applies global-scale Layer 3 and Layer 4 DDoS protection. - Before decryption, request metadata is inspected and traffic is routed over Cloudflare’s private backbone to a data center inside the customer’s designated region. - TLS termination and Layer 7 services—including WAF, Bot Management, and Workers—run only within that region. - After processing, traffic is re-encrypted and sent securely to the origin. - This design localizes data inspection without forcing customers to sacrifice Cloudflare’s global attack-mitigation capacity. ## Expanded Cloudflare Managed Regions - Regional Services originally supported the EU, UK, and U.S. - Cloudflare now offers 35 predefined regions. - Newly added options include: - Turkey - United Arab Emirates - IRAP, supporting Australian compliance - ISMAP, supporting Japanese compliance ## Custom Regions - Customers can define their own geographical boundaries instead of selecting only Cloudflare-managed regions. - Custom Regions support: - Individual countries - Arbitrary combinations of countries - Regions that exclude specified countries - Early-access use cases include: - Keeping AI prompts and responses within selected countries - Running country-specific promotions - Meeting government contractual requirements - Aligning regions with corporate structures such as EMEA, MENA, or APAC - Example definitions include North America, everywhere except North America, or countries where Fahrenheit is commonly used. ## How Region Enforcement Works - A region represents a set of Cloudflare data centers. - Managed regions use Cloudflare-defined membership. - Custom Regions use expressions, commonly based on the data center’s ISO country code: - `country_code == "TR"` selects Turkey. - `country_code in ["DE", "FR", "NL"]` selects Germany, France, and the Netherlands. - Negated expressions can exclude specific countries. - The same Regional Services architecture applies regardless of who defines the boundary; Custom Regions simply give the customer control over the membership rules. Custom Regions are best suited to organizations with precise sovereignty, compliance, performance, or organizational requirements. They provide fine-grained control over where sensitive traffic is decrypted and processed while preserving Cloudflare’s global network protections.

Read original(opens in new tab)
CloudflareWeb Application FirewallAi InferenceDdos Mitigation+4
cloudflare3 min readCurated summary

Standing up for the open Internet- why we appealed Italy’s Piracy Shield fine

Cloudflare argues that Italy’s “Piracy Shield” undermines the open Internet by allowing private media companies to order broad website and IP-address blocks without judicial oversight, transparency, or due process. After refusing to register with the system, Cloudflare was fined €14 million by Italy’s communications regulator, AGCOM, and appealed the penalty on March 8. The company is also challenging Piracy Shield’s legality under EU law. ### What Piracy Shield Does - Piracy Shield requires registered service providers to block websites and IP addresses within 30 minutes of a submission. - Blocking decisions are made through an electronic portal by an unidentified group of private Italian media companies. - The system provides: - No judicial oversight. - Little or no transparency about who requested a block or why. - No opportunity for website owners to challenge blocks beforehand. - No effective redress for wrongful blocking. - Cloudflare says the system’s design favors major rightsholders, including Italy’s Serie A soccer league. - The system was reportedly donated to the government by SP Tech, an arm of a law firm representing major beneficiaries. ### Problems with IP Blocking - Shared IP addresses can host thousands of unrelated websites, making accidental overblocking unavoidable. - Piracy Shield has caused outages affecting: - Ukrainian government, education, and research websites. - European small businesses and NGOs supporting women and children. - Google Drive, which was inaccessible to many Italian users for more than 12 hours. - A September 2025 University of Twente study found that legitimate sites were routinely blocked for months. - Despite these failures, AGCOM expanded the scheme to global DNS providers and VPNs, services closely linked to privacy and free expression. ### Cloudflare’s Legal Challenge - Cloudflare warned AGCOM in 2024 that Piracy Shield threatened the Internet’s technical architecture and proposed alternative approaches. - It later challenged AGCOM’s attempt to force Cloudflare to register with the system in Italian administrative courts. - Cloudflare and the CCIA also complained to the European Commission, arguing that Piracy Shield conflicts with the EU Digital Services Act. - The DSA requires content restrictions to be proportionate and governed by meaningful procedural safeguards. - The European Commission criticized Piracy Shield’s lack of oversight in a June 2025 letter. - In December 2025, an Italian administrative court ordered AGCOM to provide Cloudflare with records supporting its blocking orders, though Cloudflare says it has not yet received them. ### The €14 Million Fine - AGCOM issued the fine on December 29, 2025, shortly after being ordered to disclose Piracy Shield records. - Cloudflare argues that the penalty’s timing and calculation raise serious concerns. - The article ends while beginning to discuss Italian legal limits on fines and the alleged flaws in AGCOM’s calculation. Cloudflare’s position is that copyright enforcement cannot justify an opaque, privately operated blocking system with no effective safeguards. It recommends defending the legal and technical principles of an open Internet rather than expanding Piracy Shield.

Read original(opens in new tab)
CloudflarePiracy ShieldDigital Services ActIp Address Blocking+3
cloudflare4 min readCurated summary

From legacy architecture to Cloudflare One

Moving from fragmented VPNs to Cloudflare One is presented as a gradual modernization effort rather than a risky “big bang” cutover. Cloudflare and CDW recommend a tiered, application-aware migration that combines Zero Trust controls with careful dependency analysis and staged deployment. The central conclusion is that legacy applications can gain modern security protections without immediate code rewrites or major downtime. ## Reducing Big-Bang Migration Risk - Large organizations may need to transition hundreds or thousands of applications and users from legacy VPNs. - A single firewall error, dependency failure, or session timeout can disrupt essential services. - These risks often prevent organizations from adopting Zero Trust despite vulnerable, aging infrastructure. - CDW applies lessons from failed deployments to create a risk-aware migration roadmap. - Applications are categorized by complexity, with simpler systems migrated first and legacy systems handled later under tighter controls. - A public-sector migration of 500 applications caused widespread disruption because more than 4,000 applications had not been prioritized or tiered. ## Treating Migration as Application Modernization - Traditional migrations often treat networks as basic connectivity infrastructure and overlook application ecosystems. - CDW analyzes: - Backend databases and APIs - Identity and authentication dependencies - Hidden service-to-service calls - Legacy session behavior - Security requirements are incorporated into the architecture from the beginning rather than added after connectivity is restored. - The migration becomes an application modernization program instead of a simple VPN replacement. ## Protecting Legacy Applications with Cloudflare Access - Cloudflare Access replaces broad network-level VPN access with request-by-request Zero Trust authorization. - Each request can be evaluated using: - User identity - Device posture - Hardware-based MFA - Other contextual signals - This limits lateral movement and reduces the attack surface. - Legacy applications can be “wrapped” with modern security controls without rewriting their code. - Cloudflare Tunnel provides: - An outbound-only connection - SSO and MFA integration - No public IP exposure for the application - Access policies can require endpoint MFA and a device health check before traffic reaches the server. - This approach allows organizations to modernize security incrementally while legacy applications continue operating. ## Pre-Migration Audit ### Architectural and Identity Assessment - Identify whether applications use a federated identity provider such as Okta or legacy local directories. - Map database, API, and backend dependencies. - Verify that hidden API calls and service-token-based Tunnel connections will continue functioning after migration. - Assess whether applying least-privilege controls could break application behavior. ### Establishing a Strategy and Implementation Firebreak - Create separate groups for: - Security strategy and standards - Deployment and operational implementation - This separation prevents deployment speed from overriding requirements designed to limit lateral movement. ### Testing Persistent Sessions - Identify applications that depend on persistent sessions, particularly for users switching between cellular towers. - Cloudflare’s edge architecture and Dynamic Path MTU Discovery (PMTUD) help maintain sessions even when client IP addresses change. - This assessment can identify opportunities to replace rigid legacy hardware with a modern single-pass architecture. ### Categorizing Applications and Setting Timelines - **Tier 0: Modern SaaS applications** - Native SAML/OIDC support - Cloudflare can act as a clientless identity-provider proxy - Estimated effort: 1–3 hours per application - **Tier 1: Internal web applications** - Support identity headers and modern web protocols - Use a clientless reverse proxy with Cloudflare Tunnel - Estimated effort: 3–6 hours per application - **Tier 2: Non-web client-server applications** - Require specific port/protocol support or thick-client configurations - Use both Cloudflare One Client and Cloudflare Tunnel - Estimated effort: 4–8 hours per application A phased migration built around application dependencies, identity readiness, session behavior, and technical complexity offers a safer path to Cloudflare One. Organizations should begin with an audit and pilot, secure legacy applications using Access and Tunnel, and expand tier by tier rather than attempting a single cutover.

Read original(opens in new tab)
CloudflareDatabase DesignZero TrustSase+4
cloudflare2 min readCurated summary

Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humans

Cloudflare’s new Account Abuse Protection suite targets fraud from both bots and humans, focusing on whether activity is authentic rather than merely automated. It combines leaked-credential detection and account-takeover signals with new tools for identifying risky signups and suspicious identities. The capabilities are in Early Access for Bot Management Enterprise customers at no additional cost temporarily. ## Leaked Credentials and Account Takeover - Cloudflare reports that 41% of network logins use leaked credentials, with password reuse allowing old breaches to compromise valuable accounts. - Its leaked credential check compares hashed passwords against known breach data without storing or accessing plaintext passwords. - More than 60% of login-page traffic during the 2024 Black Friday analysis was automated, enabling attackers to test stolen credentials at scale. - Account takeover (ATO) detections identify customer-specific suspicious login behavior and expose attempted attacks in the Security analytics dashboard. - These detections caught an average of 6.9 billion suspicious login attempts per day across Cloudflare’s network during the referenced week. ## Fraud Requires More Than Bot Detection - Modern abuse combines automation, human fraud farms, device and location spoofing, and synthetic identities. - Attackers may use valid credentials, operate at human speed, or employ AI agents, making simple bot classification insufficient. - Common customer problems include fake users exploiting free trials, attackers logging in with correct passwords, and human-paced account draining. - Effective protection must evaluate intent, identity, and authenticity alongside automation. ## Detecting Suspicious Account Creation - Disposable email addresses allow attackers to create large numbers of accounts for promotions or other abuse without maintaining real email infrastructure. - Cloudflare’s disposable email check provides a binary signal that customers can use in security rules. - Organizations can block disposable addresses outright or challenge users who register with them. - Cloudflare also introduces email-risk assessment based on suspicious email patterns and infrastructure, helping identify potentially fraudulent signups. ## Privacy-Preserving User Identification - Hashed User IDs are per-domain identifiers created by cryptographically hashing usernames. - They help customers correlate suspicious activity and mitigate fraudulent traffic without exposing users’ original identifiers. - The feature is intended to identify risky account behavior while preserving end-user privacy. Cloudflare recommends enabling leaked-credential checks and using the new signup, identity, and behavioral signals together. This layered approach is better suited to fraud campaigns that blend valid credentials, human activity, and automated tools.

Read original(opens in new tab)
CloudflareBot ManagementFraud PreventionDatabase Security+4
cloudflare3 min readCurated summary

Slashing agent token costs by 98% with RFC 9457-compliant error responses

Cloudflare argues that HTML error pages are poorly suited to AI agents, wasting tokens while offering little actionable guidance. It now provides RFC 9457-compliant Markdown and JSON responses for Cloudflare-generated errors, including instructions on whether to retry, wait, stop, or escalate. The structured formats reduce payload size and token usage by more than 98% compared with HTML. ## Problems with HTML Error Pages - Cloudflare errors often result from customer policies or edge conditions, including: - DNS or host configuration problems - WAF, geographic, ASN, or bot restrictions - Rate limits - Traditional responses contain large amounts of HTML, CSS, and human-oriented text. - Agents may struggle to identify: - What went wrong - Whether retrying is appropriate - How long to wait - Whether human intervention is required - Custom Error Rules are configuration-dependent and therefore cannot provide a consistent contract across websites. ## RFC 9457 Structured Responses - Cloudflare now supports structured responses for all 1xxx-class errors. - Clients can request: - `Accept: text/markdown` - `Accept: application/json` - `Accept: application/problem+json` - Markdown responses include: - YAML frontmatter with machine-readable fields - “What happened” and “What you should do” guidance - JSON responses expose the same information as a flat object. - Support for Cloudflare-generated 4xx and 5xx errors is planned next. ## Machine-Readable Error Guidance Responses include stable fields such as: - `error_code`, `error_name`, and `error_category` for classification - `retryable` and `retry_after` for automated backoff - `owner_action_required` to indicate when the agent should stop or escalate - `ray_id`, `timestamp`, and `zone` for debugging and support This allows agents to implement durable control flow without scraping HTML or interpreting changing prose. ## Compatibility with RFC 9457 Cloudflare’s JSON format follows the standard Problem Details structure: - `type`: Documentation URL for the error - `status`: Actual HTTP status code - `title`: Short problem description - `detail`: Explanation of the specific occurrence - `instance`: Identifier for the individual error, corresponding to the Ray ID Cloudflare-specific operational fields are included as RFC 9457 extension members. Clients that do not recognize those fields can safely ignore them. ## Example: Rate Limiting A Cloudflare 1015 response identifies the request as rate-limited and includes: - HTTP status `429` - Error code `1015` - Category `rate_limit` - A description stating that the website owner’s configuration caused the limit - A Ray ID and timestamp - Retry-related guidance for implementing backoff The change is automatic across Cloudflare’s network. Browsers continue receiving HTML, while agents receive structured instructions when they explicitly request Markdown or JSON.

Read original(opens in new tab)
CloudflareMarkdownJsonRate Limiting+3
cloudflare3 min readCurated summary

AI Security for Apps is now generally available

Cloudflare’s AI Security for Apps is now generally available to help organizations discover, detect, and mitigate threats targeting AI-powered applications. The service protects AI endpoints through Cloudflare’s reverse proxy and integrates AI-specific signals with existing WAF controls. New GA features include free endpoint discovery for all customers, custom topic detection, and custom prompt extraction capabilities. ## Why AI Applications Create a New Attack Surface - Traditional applications follow predictable workflows, while AI applications accept natural-language input and produce probabilistic outputs. - Attackers can exploit models through: - Prompt injection - Sensitive information disclosure - PII exposure - Toxic or off-policy content - Unbounded resource consumption - Risks become more serious when AI agents can call tools to issue refunds, change accounts, apply discounts, or access customer data. - Organizations may struggle to maintain consistent safeguards as teams rapidly adopt new models and providers. ## AI Endpoint Discovery - AI Security for Apps automatically identifies LLM-powered endpoints across web properties, regardless of hosting location or model provider. - Discovery analyzes endpoint behavior rather than relying only on paths such as `/chat/completions`, since AI may also power search, valuation, and recommendation features. - Discovered endpoints appear under **Security → Web Assets** with the `cf-llm` label. - Discovery is now free for Cloudflare Free, Pro, and Business customers: - Free-plan discovery begins when users open the Discovery page. - Paid plans receive recurring background discovery. - Sufficient valid traffic is required to confidently identify AI-powered endpoints. ## Always-On AI Threat Detection - Prompts sent to discovered AI endpoints are evaluated by multiple detection modules. - Built-in protections cover: - Prompt injection - PII exposure and extraction - Sensitive or toxic topics - Detection results are attached as metadata and can be used in custom WAF rules. - Cloudflare intends to use its global network data to identify emerging attack patterns across millions of sites. ## Custom Topics and Prompt Extraction - Custom topics allow organizations to define their own sensitive categories, such as securities, patient data, or competitor products. - Each prompt and response receives a relevance score that can be logged, blocked, or handled through custom policies. - Custom prompt extraction identifies where prompts are located in request bodies, supporting formats such as: - `$.messages[*].content` - `$.requests[*].params.messages[*].content` - `$.property_description` - Standard formats from providers including OpenAI, Anthropic, Google Gemini, Mistral, Cohere, xAI, and DeepSeek are supported. - Unknown payload formats use a default-secure approach that scans the full request body, which may create false positives. - Cloudflare plans to support user-defined JSONPath expressions and automated prompt learning to improve accuracy. ## WAF-Based Mitigation - Organizations can block, log, or customize responses to detected threats using the existing Cloudflare WAF rule builder. - AI-specific signals can be combined with broader request data, including IP reputation, browser fingerprints, bot activity, and attack history. - This lets security teams distinguish isolated suspicious prompts from attacks associated with broader malicious behavior. ## Expanding Partnerships - IBM has selected Cloudflare to provide AI security for its cloud customers. - Cloudflare and Wiz are partnering to provide mutual customers with a unified view of AI security posture. - The service is being extended through Cloudflare’s broader security ecosystem. Organizations adopting AI agents should first inventory their AI endpoints, then apply detection and WAF policies tailored to their data, users, and business risks. Cloudflare’s unified approach is designed to provide a practical fail-safe as AI deployments expand.

Read original(opens in new tab)
CloudflareDatabase DesignLarge Language ModelsAi Security+4
cloudflare3 min readCurated summary

Investigating multi-vector attacks in Log Explorer

Cloudflare Log Explorer provides a unified view for investigating multi-vector attacks across application, network, identity, and endpoint activity. By correlating 14 new datasets from Cloudflare Application Services and Cloudflare One, analysts can connect reconnaissance, credential abuse, DDoS activity, lateral movement, and data-exposure risks. This broader visibility helps reduce Mean Time to Detect and supports faster, more complete forensic investigations. ## Unified Telemetry Across the Stack - Cloudflare describes logs as a “flight recorder” for digital infrastructure, capturing requests, attacks, configuration changes, and performance issues before traffic reaches origin servers. - Log Explorer centralizes telemetry in one interface, allowing analysts to correlate events across: - Application-layer HTTP traffic - Firewall and DDoS activity - DNS queries - Zero Trust access and network sessions - Endpoint, browser, email, and device events ## Zone-Scoped Logs These datasets focus on public websites, edge security, and application performance. - **HTTP Requests:** Reconstruct sessions, exploit attempts, and bot activity. - **Firewall Events:** Show blocked or challenged requests and the rules, IP reputations, or filters involved. - **DNS Logs:** Help detect cache poisoning, domain hijacking, and reconnaissance. - **NEL Reports:** Separate Layer 7 attacks from legitimate client connectivity problems. - **Spectrum Events:** Reveal Layer 4 anomalies and brute-force attempts against services such as SSH or RDP. - **Page Shield and Zaraz Events:** Track unauthorized JavaScript, outbound connections, third-party tools, and privacy-related behavior. ## Account-Scoped Logs Account-level datasets cover internal security, administration, identity, and network operations. - **Access Requests and Zero Trust Network Sessions:** Show who accessed protected applications and how long sessions lasted. - **Audit Logs:** Identify unauthorized Cloudflare configuration changes. - **CASB Findings:** Detect SaaS misconfigurations and potential data exposure. - **Gateway DNS, HTTP, and Network Logs:** Reveal malware callbacks, shadow IT, malicious downloads, unauthorized ports, and lateral movement. - **Magic IDS and Network Analytics:** Detect known exploit signatures, unusual traffic spikes, and volumetric attacks. - **Browser Isolation and Device Posture Logs:** Track risky user actions and whether connecting devices meet security requirements. - **Email Security Alerts:** Trace phishing and other email-based entry points. - **WARP and IPSec Logs:** Identify tampering with security connectivity and monitor encrypted tunnel health. - **DEX telemetry:** Help distinguish security incidents from ordinary application or device-performance problems. - **Sinkhole HTTP Logs:** Confirm attempts by internal devices to contact known botnet infrastructure. ## Investigating Attacks Across Multiple Stages - Public-facing telemetry can reveal how attackers probe websites, while account and Gateway logs show subsequent internal activity. - Analysts can correlate compromised credentials with the applications, devices, and network resources accessed by an attacker. - Magic IDS and Network Analytics extend investigations beyond HTTP to detect network-layer attacks and east-west movement. - Combining these sources gives investigators a timeline spanning initial reconnaissance, exploitation, internal access, and possible command-and-control activity. ## Detecting Reconnaissance - Query `http_requests` for repeated `401`, `403`, or `404` responses from a single IP address. - Look for requests targeting sensitive paths such as: - `/.env` - `/.git` - `/wp-admin` - Use `magic_ids_detections` to identify network-layer scanning. - Suspicious patterns include: - One source IP triggering multiple unique detections - Probes across many destination ports - Activity occurring within a short time window - Magic IDS signatures can identify techniques such as Nmap scans and SYN stealth scans. Log Explorer is most valuable when teams correlate its datasets rather than examining each log source in isolation. Combining application, identity, DNS, network, and endpoint telemetry provides the context needed to identify sophisticated attacks quickly and reconstruct their full scope.

Read original(opens in new tab)
CloudflareZero TrustNetwork SecurityHttp Requests+4
cloudflare3 min readCurated summary

Building a security overview dashboard for actionable insights

Cloudflare’s revamped Security Overview dashboard is designed to turn overwhelming security data into prioritized, actionable work. It combines ranked Security Action Items, security-tool status, and deep links into Security Analytics so teams can identify and investigate risks without switching between tools. Behind it is a checker-based system that processes more than 10 million insights daily through scheduled scans and real-time event handlers. ## From Visibility to Action - Security Action Items focus analysts on what needs to be fixed now rather than displaying every available event. - Issues are ranked by severity: - **Critical:** Immediate risks that could be exploited. - **Moderate:** Issues requiring attention to maintain security posture. - **Low:** Hardening recommendations and best-practice improvements. - Analysts can filter items by insight type, including suspicious activity and insecure configuration. ## Closing Configuration Gaps - The Detection Tools module shows whether Cloudflare protections are actively operating. - It highlights issues such as: - Security tools running in “Log Only” mode instead of blocking threats. - Shadow API discovery being disabled or unavailable. - This shifts the focus from whether a security feature exists to whether it is correctly configured and protecting traffic. ## Connected Investigation Workflows - Suspicious Activity cards appear both on the Security Overview and Security Analytics pages. - Selecting a card deep-links into Analytics with relevant filters already applied. - This removes repetitive navigation and filter recreation, helping teams investigate incidents faster. ## Checker-Based Insight Generation - Cloudflare generates and refreshes more than 10 million actionable insights each day. - Specialized microservices called **checkers** handle different areas, such as DNS, SSL certificates, and AI bot configurations. - Checkers can scale independently and operate through: - **Scheduled checks** for comprehensive configuration inspections. - **Real-time listeners** that respond immediately to control-plane events. ## Scheduled Checks and Insight Lifecycles - A scheduler distributes inspection tasks across checkers, such as scanning all DNS records for a zone. - A checker: - Receives a task. - Collects relevant assets and configurations. - Applies specialized validation rules. - Creates an insight when a configuration fails its required threshold. - Updates the insight timestamp if the issue persists. - Removes the insight once the issue is fixed. ## Real-Time Ruleset Handlers - Event handlers listen continuously for configuration changes. - For example, when a WAF ruleset is changed, a handler can immediately detect that it is enabled only in “Log Only” mode. - The handler determines that attacks are being recorded but not blocked, registers an insight, and displays it on the dashboard. - Once the configuration is secured, the insight is cleared automatically. The dashboard’s main benefit is its combination of prioritization, configuration awareness, and immediate investigation paths. By pairing scheduled validation with real-time detection, it helps security teams move from passive monitoring to faster, more proactive remediation.

Read original(opens in new tab)
CloudflareDatabase DesignMicroservicesSecurity Dashboard+3