Sandbox SDK 1.0 is available. Your own Durable Object class now controls each sandbox container directly, through the Durable Object container API on this.ctx.container . With 1.0, your class can: Choose the image and instance size each time it starts a sandbox.
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting.
The Cloudflare CLI , cf , is now in beta. cf is one command-line interface for the public Cloudflare API and for Workers projects. Use it to manage zones, DNS, storage, and security settings, and to create, develop, and deploy Workers, without switching between tools.
A Worker can now call the Workflows it declares in the exports field of its Wrangler configuration through ctx.exports . You no longer need a workflows binding to call a Workflow from the Worker that defines it.
Browser Run crawl jobs can publish lifecycle events to Cloudflare Queues . Subscribe to started, updated, and finished events to track progress or trigger downstream processing without polling.
MCP server portals are now generally available to all Cloudflare customers. A portal gives users one endpoint for approved Model Context Protocol (MCP) servers. Cloudflare Access logs tool, prompt, and resource activity.
You can now view account-level analytics for your Images transformation usage. Go to Images & Stream > Transformations > Analytics to view sampled estimates of image transformation request traffic, including: Requests by source, split between URL-based transformations and Images binding transformations Top zones, transformation configurations, and origin...
Announcement Date Release Date Release Behavior Legacy Rule ID Rule ID Description Comments 2026-09-22 2026-09-29 Log N/A ...cb14ded8 Broken Access Control - Directory Traversal This is a new detection.
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting.
Starting in 2027, Cloudflare will deprecate 32-bit Windows and Intel-based macOS builds of cloudflared . After the deprecation takes effect, Cloudflare will no longer publish new cloudflared releases for either architecture. Windows 10, the last Windows release to support 32-bit systems, reached end of support in October 2025.
We're expanding how customers create accounts across Cloudflare, making it easier to self-serve account creation in the dashboard, automate standalone account creation with user-owned API tokens or OAuth access tokens, and create Free accounts directly within Enterprise Organizations.
R2 Data Catalog now provides table-level maintenance visibility and manual compaction queueing in the Cloudflare dashboard. These updates make it easier to understand when maintenance is eligible to run, inspect completed operations, and request maintenance without leaving the table view.
This release introduces new threat detections to enhance protection against command injection attempts, Server-Side Request Forgery (SSRF) targeting cloud metadata, and information disclosure within version control history.
AI Gateway can now require credentials for third-party provider requests. Credentials must accompany the request or be stored on the gateway. This setting prevents fallback to Unified Billing with Cloudflare-managed credentials. Turn on Require provider credentials in your gateway settings.
AI Search can index R2 objects without filename extensions when they include supported Content-Type metadata. This supports object keys that do not include file extensions while preserving file-type validation during indexing. For supported file types and Content-Type requirements, refer to R2 data sources .
The OpenAI Agents API gives your application access to Codex through an OpenAI-managed API. OpenAI manages sessions, orchestration, context compaction, and recovery while your application provides tools and uses Cloudflare Containers as the execution environment.
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM.
This release enhances detection logic for existing rules targeting Next.js remote code execution (RCE) vulnerabilities by consolidating active beta rules into baseline signatures.
Application Profiles add a positive-security layer to Cloudflare WAF. Instead of looking only for requests that resemble known attacks, Application Profiles learn what valid requests to your application look like and identify traffic that deviates from the expected structure.
R2 Data Access Logs are now generally available. Turn on logging for a bucket to record object read, write, list, multipart upload, and delete operations with response status codes below 400 .
The Rulesets API now supports Origin Range Requests in Cache Rules. This setting lets Cloudflare fetch large files from your origin in cache-aligned byte ranges. Cloudflare may expand a client range and issue several single-range origin requests. Set origin_range_requests.mode to on , off , or default for any traffic matched by a Cache Rule.
Beginning September 1, 2026, D1 queries on the Workers Free plan will fail when an account exceeds the daily row read or row write limits . Queries via the Workers Binding API and the REST API will return errors until the limit resets at midnight UTC. Stored data is not affected. You will receive email alerts when the daily limit is reached.
Releasesby Glyph