Releasesby GlyphWAF - WAF Release - 2026-08-25
This release moves four new detections from Log to Block, merges the XSS, HTML Injection - Script Tag - Beta rule into the original rule, and adds a Generic Rules - Remote Code Execution rule in Block mode.
Also shipped Aug 25, 2026Cloudflare in August 2026 →
BigQuery data governance tags are supported in Terraform
BigQuery data governance tags are supported in Terraform. This feature is in Preview .
Multi-value tags (General availability)
With this release, multi-value tags are generally available. You can assign more than one string value to the same tag.
Remote app operations for Snowflake Native Apps (Preview)
Remote app operations are now available in public preview for Snowflake Native Apps. Providers can perform on-demand operations on consumer apps, including running SQL statements ( run_sql ), retrying a failed upgrade ( retry_upgrade ), and disabling/enabling the app ( disable / enable ), all through a new system function SYSTEM$REMOTE_APP_OPERATION .
Remote Development with the Snowflake Extension for Visual Studio Code (Preview)
Remote Development with the Snowflake Extension for Visual Studio Code is now available in public preview.
Stable egress IP addresses on Azure (Preview)
Stable egress IP addresses are now available in preview on Azure. You can generate Snowflake egress IP address ranges (as CIDR addresses) and add them to an external server's allowlist so that Snowflake can make requests to that server.
LTAP Direct Writes accelerates synced table loads (Beta)
LTAP Direct Writes speeds up how synced tables load into Lakebase. When you create a synced table, Lakebase loads a full copy of your Unity Catalog data into your Postgres branch.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Access - Grace periods for service token rotation
Cloudflare Access administrators can now choose a grace period when rotating a service token secret. Both secrets remain valid during the grace period, giving administrators time to update services without interrupting authentication. The dashboard offers grace periods from one hour to 30 days. Administrators can also revoke the previous secret immediately.
Access - Temporarily turn off Access service tokens
Cloudflare Access administrators can now temporarily turn off service tokens without deleting them. A disabled token cannot authenticate, but its configuration remains available so administrators can turn it on again later. Turning off a token also stops any previous secret in an active rotation grace period.
AI Search - Store larger custom metadata values in AI Search
AI Search supports larger custom metadata values within a shared 10 KiB metadata envelope for each vector. The envelope includes AI Search system metadata and JSON overhead, so it is not a per-field limit. The first 64 UTF-8 bytes of each indexed string remain filterable. For details, refer to Metadata attributes .
API Shield - Symmetric key support for JWT validation
API Shield JSON Web Token validation now supports symmetric keys that use the HS256 , HS384 , and HS512 algorithms. You can configure HMAC verification keys in the Cloudflare dashboard or with the Cloudflare API. Cloudflare never stores symmetric credentials in plaintext. API responses do not include the credential.
Cloudflare One, Access - MCP server portals support MCP 2026-07-28 specification
MCP server portals support the stateless MCP 2026-07-28 specification for client and upstream server connections. The portal's /mcp endpoint automatically accepts stateless MCP 2026-07-28 requests and earlier 2025 Streamable HTTP clients.
Durable Objects - Prevent Durable Object alarm retries when using `ctx.abort()`
By default, an alarm interrupted by ctx.abort() retries after the Durable Object resets. Pass { retryAlarm: false } when the alarm should stop instead: src/index.js js import { DurableObject } from "cloudflare:workers" ; export class CleanupTask extends DurableObject { async alarm () { await this .ctx.storage. deleteAll (); this .ctx.
Access service token secrets use a scannable format
Cloudflare Access service token Client Secrets created on or after August 26, 2026, use the format cfast_[40 alphanumeric characters][8-character checksum] . The prefix and checksum make these credentials easier for secret scanning tools to identify with fewer false positives. Existing service token secrets continue to work and do not require rotation.
AI Search - New Workers AI text generation models in AI Search
AI Search now supports six additional Workers AI models for text generation: Model Context window (tokens) @cf/deepseek-ai/deepseek-v4-flash-0731 1,048,576 @cf/deepseek-ai/deepseek-v4-pro-0813 1,048,576 @cf/openai/gpt-oss-120b 128,000 @cf/openai/gpt-oss-20b 128,000 @cf/qwen/qwen3.8-27b 262,144 @cf/moonshotai/kimi-k2.7-code 262,144 These models run on...