Releasesby GlyphWAF - WAF Release - 2025-10-23 - Emergency
This week highlights enhancements to detection signatures improving coverage for vulnerabilities in Adobe Commerce and Magento Open Source, linked to CVE-2025-54236. Key Findings This vulnerability allows unauthenticated attackers to take over customer accounts through the Commerce REST API and, in certain configurations, may lead to remote code execution.
Also shipped Oct 23, 2025Cloudflare in October 2025 →
Tailscale v1.90.1
Note : 1.90.0 was a release candidate intended for testing only. All platforms New: Clients can use configured DNS resolvers for all domains even when the client also uses an exit node using the nameserver settings in the DNS page of the admin console.
Save, reuse, and share dashboard annotation queries
We recently introduced the ability to save queries in Dashboards and Explore , now we’ve extended this functionality to dashboard annotations. With this addition, you can save, reuse, and share annotation queries with others in your organization.
Skew protection now available
We've released skew protection for all plans starting with these frameworks: Astro 5.15.0+ Next.js This feature prevents version mismatch errors when users interact with your site during a deployment. What it fixes When you deploy a new version of your site, users with an open browser tab may still be running the old version.
Linear agent for Slack
Creating issues has never been easier. Mention @Linear in discussions on Slack, and the Linear agent will create issues informed by your conversation's context. Use natural language to specify issue details or simply let the agent infer what's needed. Linear agent for Slack is available now on all plans.
New features in Figma Buzz
Your marketing workflow just got more streamlined, from template to final asset, with these three new features in Figma Buzz.
Updated online store promotion app store requirement
Effective Wednesday, November 5th, 2025, the following requirement for the online store has been revised: Your app must not use theme app extensions or blocks to promote your app, promote related apps, or request reviews.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Workers AI Markdown Conversion: New endpoint to list supported formats
Developers can now programmatically retrieve a list of all file formats supported by the Markdown Conversion utility in Workers AI. You can use the env.AI binding: await env. AI . toMarkdown ().
Workers Preview URL default behavior now matches your workers.dev setting
We have updated the default behavior for Cloudflare Workers Preview URLs . Going forward, if a preview URL setting is not explicitly configured during deployment, its default behavior will automatically match the setting of your workers.dev subdomain .
WAF Release - 2025-10-24 - Emergency
This week’s release introduces a new detection signature that enhances coverage for a critical vulnerability in Windows Server Update Services (WSUS), tracked as CVE-2025-59287. Key Findings The vulnerability allows unauthenticated attackers to potentially achieve remote code execution.
Workers - Automatic resource provisioning for KV, R2, and D1
Previously, if you wanted to develop or deploy a worker with attached resources, you'd have to first manually create the desired resources. Now, if your Wrangler configuration file includes a KV namespace, D1 database, or R2 bucket that does not yet exist on your account, you can develop locally and deploy your application seamlessly, without having to run...
Workers - Build TanStack Start apps with the Cloudflare Vite plugin
The Cloudflare Vite plugin now supports TanStack Start ↗ apps. Get started with new or existing projects. New projects Create a new TanStack Start project that uses the Cloudflare Vite plugin via the create-cloudflare CLI: npm yarn pnpm npm create cloudflare@latest -- my-tanstack-start-app --framework=tanstack-start yarn create cloudflare...
AI Crawl Control - New Robots.txt tab for tracking crawler compliance
AI Crawl Control now includes a Robots.txt tab that provides insights into how AI crawlers interact with your robots.txt files. What's new The Robots.txt tab allows you to: Monitor the health status of robots.txt files across all your hostnames, including HTTP status codes, and identify hostnames that need a robots.txt file.
Gateway - Schedule DNS policies from the UI
Admins can now create scheduled DNS policies directly from the Zero Trust dashboard, without using the API. You can configure policies to be active during specific, recurring times, such as blocking social media during business hours or gaming sites on school nights.
WAF Release - 2025-10-20
This week’s update introduces an enhanced rule that expands detection coverage for a critical vulnerability in Oracle E-Business Suite. It also improves an existing rule to provide more reliable coverage in request processing.