Releasesby GlyphRisk Score - User risk scoring for high risk browsing activity
Cloudflare One's User Risk Scoring now incorporates direct signals from Gateway DNS traffic patterns . This update allows security teams to automatically elevate a user's risk score when they visit high-risk or malicious domains, providing a more holistic view of internal threats.
Also shipped Apr 8, 2026Cloudflare in April 2026 →
Custom OIDC Providers for Supabase Auth
Supabase Auth now supports custom OpenID Connect (OIDC) providers, enabling users to connect identity providers like GitHub Enterprise and regional services to their projects.
Security Update: DoS vulnerability in Next.js and React Server Components
A denial-of-service (DoS) vulnerability (CVE-2026-23869, CVSS 7.5) has been disclosed affecting React Server Components (RSCs), a feature used by Next.js and other React metaframeworks. A malicious payload can cause excessive CPU consumption. Here's what Netlify customers need to know. Impact on Netlify Nominally, this is a server-side DoS vulnerability.
New pricing and packaging
- Changed: New tailnet plan signups are billed based on occupied user seats instead of monthly active users. Existing tailnets on a legacy plan will continue to be billed based on monthly active users. Changed: All plans can have an unlimited number of user devices in a tailnet.
Multiple Custom Domains General Availability
We’re excited to announce that __Multiple Custom Domains (MCD)__ is now __Generally Available__. With Multiple Custom Domains, Enterprise customers can support __multiple branded login experiences from a single Auth0 tenant__.
Dynamic dashboards is now generally available
Dynamic dashboards are now on by default for all Grafana Cloud users and self-managed Grafana instances. Every new and existing dashboard uses the new layout engine, editing experience, and dashboard structure automatically. Your existing dashboards are migrated to the new schema when you open them. No manual steps required.
Manage and use secrets in Grafana Cloud k6
We’re excited to announce the public preview of Secrets Management for Grafana Cloud k6, a new feature that lets you securely store and use sensitive values in your performance tests. If your tests rely on API tokens, credentials, or any other confidential data, you no longer need to hardcode them into your scripts or pass them around manually.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
AI Search - Website Source CSS content selectors for precise content extraction in AI Search
AI Search now supports CSS content selectors for website data sources. You can now define which parts of a crawled page are extracted and indexed by specifying CSS selectors paired with URL glob patterns. Content selectors solve the problem of indexing only relevant content while ignoring navigation, sidebars, footers, and other boilerplate.
AI Search - New Workers AI models for text generation and embedding in AI Search
AI Search now supports four additional Workers AI models across text generation and embedding. Text generation Model Context window (tokens) @cf/zai-org/glm-4.7-flash 131,072 @cf/qwen/qwen3-30b-a3b-fp8 32,000 GLM-4.7-Flash is a lightweight model from Zhipu AI with a 131,072 token context window, suitable for long-document summarization and retrieval tasks.
Security Center - Real-time alerts and daily digests for Threat Events
You can now automate your threat monitoring by setting up custom alerts in your saved views. Instead of manually checking the dashboard for updates, you can subscribe to notifications that trigger whenever new data matches your specific filter sets, like new activity associated to a particular threat actor or spikes in activity within your industry.
CASB - Send CASB posture finding instances with webhooks
You can now use CASB webhooks in Cloudflare One to send posture finding instances to external systems such as chat platforms, ticketing systems, SIEMs, SOAR tools, and custom automation services. This gives security teams a simple way to route CASB posture findings into the tools and workflows they already use for triage and response.
Workers - Relaxed simultaneous connection limiting for Workers
The simultaneous open connections limit has been relaxed. Previously, each Worker invocation was limited to six open connections at a time for the entire lifetime of each connection, including while reading the response body.
Cloudflare One Client for Windows (version 2026.3.851.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page . This release contains minor fixes and improvements. The next stable release for Windows will introduce the new Cloudflare One Client UI, providing a cleaner and more intuitive design as well as easier access to common actions and information.
Email security - User Submission Triage Status Tracking
Cloudflare Email security now supports Triage Status Tracking for User Submissions . This enhancement gives SOC teams a streamlined way to track, manage, and prioritize user-submitted emails directly within the Cloudflare One dashboard.
Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Link aggregation (LACP) support for Cloudflare One Appliance
Cloudflare One Appliance now supports Link Aggregation Control Protocol (LACP), allowing you to bundle up to six physical LAN ports into a single logical interface. Link aggregation increases available bandwidth and eliminates single points of failure on the LAN side of the appliance.