Releasesby GlyphWAF - WAF Release - 2026-09-08
This release enhances detection logic for existing rules targeting Next.js remote code execution (RCE) vulnerabilities by consolidating active beta rules into baseline signatures.
Also shipped Sep 8, 2026Cloudflare in September 2026 →
Conversational analytics now supports predictive modeling questions using the AI.PREDICT function
Conversational analytics now supports predictive modeling questions using the AI.PREDICT function . This feature is in Preview .
Add and drop hybrid table constraints online (General availability)
With this release, you can add and drop UNIQUE and FOREIGN KEY constraints on an existing hybrid table by using alter table . Previously, you had to define these constraints when you created the table, so adding a foreign key to a table that was already serving a workload meant recreating and reloading the table.
Shadow traffic for gateways (Preview)
With this preview release, you can use a shadow traffic gateway to send all production requests to a primary service endpoint while mirroring a percentage of those requests to one or more shadow endpoints. Responses from shadow endpoints aren't returned to clients.
The partner-powered AI features setting will be removed
On November 1, 2026, Databricks will remove the account- and workspace-level toggle for partner-powered AI features. Each workspace will keep its current setting value: if the setting is enabled, it stays enabled, and if it's disabled, it stays disabled. Removing the toggle doesn't change any setting values.
Incremental ingestion for Salesforce formula fields in Lakeflow Connect will soon be generally available
Incremental ingestion for Salesforce formula fields in Lakeflow Connect will soon be generally available. Today, Lakeflow Connect ingests formula fields by taking a full snapshot on each pipeline run by default. When incremental formula field ingestion is generally available, full snapshots will no longer be the default.
ABAC DENY policies are in Beta
ABAC DENY policies are in Beta in Unity Catalog. DENY policies can be used to explicitly deny the MANAGE ACCESS CONTROL privilege to prevent specified principals, including object owners, from performing access-management operations. They always take precedence over any grant. For details, see ABAC DENY policies (Beta) .
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Radar search now includes Internet events
Cloudflare Radar search now includes Internet events and outages alongside existing results. Search event descriptions or related entities, such as locations, ASes, bots, and top-level domains, to find relevant events and open the most relevant Radar view.
Workers - Miniflare v5 prepares local development for the cf CLI
Miniflare v5 prepares Cloudflare local development tooling for the upcoming cf CLI. Miniflare powers local Workers development behind wrangler dev , the Cloudflare Vite plugin, and @cloudflare/vitest-plugin . Most projects should use those tools instead of depending on Miniflare directly, and Miniflare v5 will not require any action.
Workers - Python 3.14 for Python Workers
Python workers now use Python 3.14 by default. This change applies to all new Python workers using compatibility date 2026-09-08 or later. Internally, this change updates the Pyodide runtime to 314.0.6.
Cloudflare One Client for macOS (version 2026.8.1290.1)
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM.
Cloudflare One Client for Windows (version 2026.8.1290.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM.
AI Gateway custom costs support cache tokens
AI Gateway custom costs now support cache-read and cache-write token rates. This lets custom cost metrics reflect negotiated cache pricing across providers. Add per_cache_read_token or per_cache_write_token to the cf-aig-custom-cost header: { "per_token_in" : 0.000001 , "per_token_out" : 0.000002 , "per_cache_read_token" : 0.0000001 ...
Browser Isolation, Cloudflare One - Improved iOS tap-to-type experience for Browser Isolation
Browser Isolation has improved the tap-to-type experience for users on iOS devices. Previously, Browser Isolation displayed a full-screen overlay with the message tap to type when users focused a text field. The prompt now appears inline over the focused text field, reducing disruption when users enter text in isolated sessions.
CASB - New CASB integration for Zoom
Cloudflare CASB now integrates with Zoom . The integration connects through Cloudflare's pre-built OAuth application , no manual app setup in Zoom is required. After an initial scan, CASB continuously scans your Zoom account to surface new findings as your environment changes. Zoom is widely used for meetings, webinars, and collaboration.