Releasesby GlyphWAF - WAF Release - 2025-12-03 - Emergency
The WAF rule deployed yesterday to block unsafe deserialization-based RCE has been updated. The rule description now reads “React – RCE – CVE-2025-55182”, explicitly mapping to the recently disclosed React Server Components vulnerability. Detection logic remains unchanged.
Also shipped Dec 3, 2025Cloudflare in December 2025 →
Introducing Seven New Email Templates for Supabase Auth
Supabase Auth introduced seven new email templates to notify users of security-sensitive account actions.
The new Supabase power for Kiro
The Kiro IDE now provides deep integration with Supabase, assisting developers with database migrations, edge functions, and security policies.
EU Endpoint Now Generally Available
The Deepgram EU endpoint ( api.eu.deepgram.com ) is now generally available for customers requiring data processing within the European Union.
How we built user behavior analysis with multi-modal LLMs (in 5 not-so-easy steps)
PostHog released Session Summaries in beta, a tool that uses multi-modal LLMs to analyze user session recordings and highlight issues automatically.
eAPM General Availability and eBPF Network Metrics Public Preview
Background Our customers are faced with these challenges: The first challenge is the traditional observability gap. Traditional APM tools lack kernel-level network and system metrics. This means that during an incident, it is difficult to pinpoint the root cause between application code issues and network-related issues.
NeMo NVIDIA Neural Modules 2.6.0
Highlights Speech Add Timestamps to streaming ASR PR Add Streaming decoding policies (Wait-K and AlignAtt) for Canary model PR Add NeMo Voice Agent PR Hybrid RNNT-CTC Prompted Parakeet Model support PR [New] MT-Parakeet Streaming Models release Removed the Automodel module. Automodel is available in the repo https://github.com/NVIDIA-NeMo/Automodel .
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Email security - Reclassifications to Submissions
We have updated the terminology “Reclassify” and “Reclassifications” to “Submit” and “Submissions” respectively. This update more accurately reflects the outcome of providing these items to Cloudflare. Submissions are leveraged to tune future variants of campaigns.
Hyperdrive - Connect to remote databases during local development with wrangler dev
You can now connect directly to remote databases and databases requiring TLS with wrangler dev . This lets you run your Worker code locally while connecting to remote databases, without needing to use wrangler dev --remote .
Workers - One-click Access protection for Workers now creates reusable Cloudflare Access policies
Workers applications now use reusable Cloudflare Access policies to reduce duplication and simplify access management across multiple Workers. Previously, enabling Cloudflare Access on a Worker created per-application policies, unique to each application.
WAF Release - 2025-12-02 - Emergency
This week's emergency release introduces a new rule to block a critical RCE vulnerability in widely-used web frameworks through unsafe deserialization patterns. Key Findings New WAF rule deployed for RCE Generic Framework to block malicious POST requests containing unsafe deserialization patterns.
Cloudflare Fundamentals, Terraform - Terraform v5.14.0 now available
Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.14 release.
WAF - Increased WAF payload limit for all plans
Cloudflare WAF now inspects request-payload size of up to 1 MB across all plans to enhance our detection capabilities for React RCE (CVE-2025-55182). Key Findings React payloads commonly have a default maximum size of 1 MB. Cloudflare WAF previously inspected up to 128 KB on Enterprise plans, with even lower limits on other plans.
WAF - Updating the WAF maximum payload values
We are reinstating the maximum request-payload size the Cloudflare WAF inspects, with WAF on Enterprise zones inspecting up to 128 KB. Key Findings On December 5, 2025 , we initially attempted to increase the maximum WAF payload limit to 1 MB across all plans.
WAF Release - 2025-12-01
This week’s release introduces new detections for remote code execution attempts targeting Monsta FTP (CVE-2025-34299), alongside improvements to an existing XSS detection to enhance coverage.