Internal DNS is now in open beta. Who can use it? Internal DNS is bundled as a part of Cloudflare Gateway and is now available to every Enterprise customer with one of the following subscriptions: Cloudflare Zero Trust Enterprise Cloudflare Gateway Enterprise To learn more and get started, refer to the Internal DNS documentation .
This week's release introduces new detections for a critical authentication bypass vulnerability in Fortinet products (CVE-2025-59718), alongside three new generic detection rules designed to identify and block HTTP Parameter Pollution attempts.
Four new fields are now available on request.cf.tlsClientAuth in Workers for requests that include a mutual TLS (mTLS) client certificate. These fields encode the client certificate and its intermediate chain in RFC 9440 ↗ format , the same standard format used by the Client-Cert and Client-Cert-Chain HTTP headers , so your Worker can forward them directly...
MCP server portals support Code Mode MCP server patterns , a technique that reduces context window usage by replacing individual tool definitions with a single code execution tool. Code Mode is turned on by default on all portals. To turn it off, edit the portal in Access controls > AI controls and turn off Code Mode under Basic information .
HTTP Archive (HAR) files are used by engineering and support teams to capture and share web traffic logs for troubleshooting. However, these files routinely contain highly sensitive data , including session cookies, authorization headers, and other credentials , that can pose a significant risk if uploaded to third-party services without being reviewed or...
Dynamic Workers are now in open beta ↗ for all paid Workers users. You can now have a Worker spin up other Workers, called Dynamic Workers, at runtime to execute code on-demand in a secure, sandboxed environment. Dynamic Workers start in milliseconds, making them well suited for fast, secure code execution at scale.
AI Search now supports public endpoints, UI snippets, and MCP, making it easy to add search to your website or connect AI agents. Public endpoints allow you to expose AI Search capabilities without requiring API authentication. To enable public endpoints: Go to AI Search in the Cloudflare dashboard.
Cloudflare Access supports managed OAuth, which allows non-browser clients , such as CLIs, AI agents, SDKs, and scripts , to authenticate with Access-protected applications using a standard OAuth 2.0 authorization code flow.
Service Key authentication for the Cloudflare API is deprecated. Service Keys will stop working on September 30, 2026. API Tokens replace Service Keys with fine-grained permissions, expiration, and revocation. What you need to do Replace any use of the X-Auth-User-Service-Key header with an API Token scoped to the permissions your integration requires.
Cloudflare dashboard SCIM provisioning now supports Authentik ↗ as an identity provider, joining Okta and Microsoft Entra ID as explicitly supported providers. Customers can now sync users and group information from Authentik to Cloudflare, apply Permission Policies to those groups, and manage the lifecycle of users & groups directly from your Authentik...
AI Gateway now supports the cf-aig-collect-log-payload header, which controls whether request and response bodies are stored in logs. By default, this header is set to true and payloads are stored alongside metadata.
You can now set topK up to 50 when a Vectorize query returns values or full metadata. This raises the previous limit of 20 for queries that use returnValues: true or returnMetadata: "all" . Use the higher limit when you need more matches in a single query response without dropping values or metadata.
When your Worker accesses a Durable Object via idFromName() or getByName() , the same name is now available on ctx.id.name inside the object , no need to pass it through method arguments or persist it in storage. This brings the runtime behavior in line with the Workers runtime types .
Cloudflare-generated 1xxx error responses now include a standard Retry-After HTTP header when the error is retryable. Agents and HTTP clients can read the recommended wait time from response headers alone , no body parsing required.
Cloudflare-generated 1xxx errors now return structured JSON when clients send Accept: application/json or Accept: application/problem+json . JSON responses follow RFC 9457 (Problem Details for HTTP APIs) ↗ , so any HTTP client that understands Problem Details can parse the base members without Cloudflare-specific code.
Audit Logs v2 is now generally available to all Cloudflare customers. Audit Logs v2 provides a unified and standardized system for tracking and recording all user and system actions across Cloudflare products.
Introducing Cloudflare's Web and API Vulnerability Scanner (Open Beta) Cloudflare is launching the Open Beta of the Web and API Vulnerability Scanner ↗ for all API Shield customers. This new, stateful Dynamic Application Security Testing (DAST) platform helps teams proactively find logic flaws in their APIs.
Radar ships several new features that improve the flexibility and usability of the platform, as well as visibility into what is happening on the Internet. Region filtering All location-aware pages now support filtering by region, including continents, geographic subregions ( Middle East ↗ , Eastern Asia ↗ , etc.), political regions ( EU ↗ , African Union ↗...
The Gateway Authorization Proxy and PAC file hosting are now in open beta for all plan types. Previously, proxy endpoints relied on static source IP addresses to authorize traffic, providing no user-level identity in logs or policies.
Sandboxes now support real-time filesystem watching via sandbox.watch() . The method returns a Server-Sent Events ↗ stream backed by native inotify, so your Worker receives create , modify , delete , and move events as they happen inside the container. sandbox.watch(path, options) Pass a directory path and optional filters.
The latest release of the Agents SDK ↗ rewrites observability from scratch with diagnostics_channel , adds keepAlive() to prevent Durable Object eviction during long-running work, and introduces waitForMcpConnections so MCP tools are always available when onChatMessage runs.
You can now configure clipboard controls for browser-based RDP with Cloudflare Access. Clipboard controls allow administrators to restrict whether users can copy or paste text between their local machine and the remote Windows server.
Releasesby Glyph