Releasesby GlyphCloudflare Fundamentals - New 2FA Experience for Login
In an effort to improve overall user security, users without 2FA will be prompted upon login to enroll in email 2FA. This will improve user security posture while minimizing friction. Users without email 2FA enabled will see a prompt to secure their account with additional factors upon logging in.
Also shipped Jan 23, 2026Cloudflare in January 2026 →
- Expanded MCP Server support: The MotherDuck remote MCP Server now supports Warp , PearAI , Trae , Void ...
- Expanded MCP Server support: The MotherDuck remote MCP Server now supports Warp , PearAI , Trae , Void , Positron , Supermaven , Aider , and JetBrains IDEs . Use your favorite AI assistant to answer questions about your data through natural conversation. See the MCP Server documentation to get started.
What's new in Sigma
Admin Use other supported IdPs for Databricks OAuth via OAuth token federation Using OAuth token federation, you can now use other supported identity providers to authenticate to Databricks. Previously, you could only authenticate with Databricks as your identity provider. See Configure Databricks OAuth token federation for more information.
Agent Skills, Data API provisioning, and faster docs release - Jan 23, 2026
Give your AI assistant Neon expertise. Install our Agent Skills to teach your AI coding assistant about Neon best practices, connection methods, ORM setup, and ...
$100M Series B, Architecture View, Focused PR Environments
We raised $100M! [Railway just closed a Series B](https://blog.railway.com/p/series-b), and we couldn't be more excited about what's ahead. We'll get into what that means below. Of course, just because we’re doing a big announcement, doesn’t mean that the shipping stops.
Localization support for POS UI extensions
Starting in POS 10.19, you can now localize your POS UI extensions for international merchants, staff, and customers. You can Translate extension text : Define locale files with translation strings that automatically resolve based on customer and shop locales.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Pages - Increased Pages file limit to 100,000 for paid plans
Paid plans can now have up to 100,000 files per Pages site, increased from the previous limit of 20,000 files. To enable this increased limit, set the environment variable PAGES_WRANGLER_MAJOR_VERSION=4 in your Pages project settings. The Free plan remains at 20,000 files per site. For more details, refer to the Pages limits documentation .
Vectorize indexes now support up to 10 million vectors
You can now store up to 10 million vectors in a single Vectorize index, doubling the previous limit of 5 million vectors. This enables larger-scale semantic search, recommendation systems, and retrieval-augmented generation (RAG) applications without splitting data across multiple indexes.
Cloudflare One, Access - Require Access protection for zones
You can now require Cloudflare Access protection for all hostnames in your account. When enabled, traffic to any hostname that does not have a matching Access application is automatically blocked. This deny-by-default approach prevents accidental exposure of internal resources to the public Internet.
Access - New granular API token permissions for Cloudflare Access
Three new API token permissions are available for Cloudflare Access, giving you finer-grained control when building automations and integrations: Access: Organizations Revoke , Grants the ability to revoke user sessions in a Zero Trust organization.
Rules - New cryptographic functions , encode_base64() and sha256()
Cloudflare Rulesets now includes encode_base64() and sha256() functions, enabling you to generate signed request headers directly in rule expressions. These functions support common patterns like constructing a canonical string from request attributes, computing a SHA256 digest, and Base64-encoding the result.
Workers - New Placement Hints for Workers
You can now configure Workers to run close to infrastructure in legacy cloud regions to minimize latency to existing services and databases. This is most useful when your Worker makes multiple round trips.
WAF Release - 2026-01-26
This week’s release introduces new detections for denial-of-service attempts targeting React CVE-2026-23864 ( https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗ ). Key Findings CVE-2026-23864 ( https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗ ) affects react-server-dom-parcel , react-server-dom-turbopack , and react-server-dom-webpack packages.
AI Search path filtering for website and R2 data sources
AI Search now includes path filtering for both website and R2 data sources. You can now control which content gets indexed by defining include and exclude rules for paths. By controlling what gets indexed, you can improve the relevance and quality of your search results.