Releasesby GlyphAI Gateway - AI Gateway custom costs support cache tokens
AI Gateway custom costs now support cache-read and cache-write token rates. This lets custom cost metrics reflect negotiated cache pricing across providers. Add per_cache_read_token or per_cache_write_token to the cf-aig-custom-cost header: { "per_token_in" : 0.000001 , "per_token_out" : 0.000002 , "per_cache_read_token" : 0.0000001 ...
Also shipped Sep 9, 2026Cloudflare in September 2026 →
Configurable retention for system tables is in Beta
Account admins can now set an account-wide retention period from 30 to 3,650 days for supported system tables. See Configure system table data retention .
External secrets in Unity Catalog (Beta)
External secrets connect a Unity Catalog schema to AWS Secrets Manager. The secrets appear in Unity Catalog as read-only securable objects that you govern with Unity Catalog privileges. Databricks reads their values from AWS Secrets Manager on demand. See External secrets in Unity Catalog .
Celigo connector (Beta)
The Celigo connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector ingests audit log events, such as create, update, and delete operations on resources, from Celigo (integrator.io) into Databricks. Authentication uses a Celigo integrator.io API token.
Anysphere Organization connector (Beta)
The Anysphere Organization connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector uses the Anysphere (Cursor) Organization Admin API to ingest organization members, groups, and group members into Databricks as daily snapshots.
Anaplan connector (Beta)
The Anaplan connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector ingests audit trail events and user account records from your Anaplan tenant into Databricks. Authentication uses an Anaplan CA certificate and its paired private key. See Anaplan connector .
Openflow gen 1 deployment creation retired
You can no longer create new first generation (gen 1) Openflow deployments (BYOC or Snowflake). All new deployments are second generation (gen 2), created with CREATE OPENFLOW DEPLOYMENT or the Openflow UI. Existing gen 1 deployments continue to work unchanged, and you can still create new gen 1 runtimes on an existing gen 1 deployment.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Cloudflare One Client for macOS (version 2026.8.1290.1)
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM.
Cloudflare One Client for Windows (version 2026.8.1290.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This beta release includes the following changes and improvements: Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM.
Browser Isolation, Cloudflare One - Improved iOS tap-to-type experience for Browser Isolation
Browser Isolation has improved the tap-to-type experience for users on iOS devices. Previously, Browser Isolation displayed a full-screen overlay with the message tap to type when users focused a text field. The prompt now appears inline over the focused text field, reducing disruption when users enter text in isolated sessions.
CASB - New CASB integration for Zoom
Cloudflare CASB now integrates with Zoom . The integration connects through Cloudflare's pre-built OAuth application , no manual app setup in Zoom is required. After an initial scan, CASB continuously scans your Zoom account to surface new findings as your environment changes. Zoom is widely used for meetings, webinars, and collaboration.
Workflows - Default instance retention for new Workflows on Workers Paid is seven days
Workflows created on or after September 10, 2026, on the Workers Paid plan retain completed and errored instance state for seven days by default (previously 30 days). The seven day default helps to reduce storage costs by default. The maximum retention limit remains 30 days. The retention period for existing Workflows is unchanged.
Containers - Use Cloudflare Containers with Codex via the OpenAI Agents API
The OpenAI Agents API gives your application access to Codex through an OpenAI-managed API. OpenAI manages sessions, orchestration, context compaction, and recovery while your application provides tools and uses Cloudflare Containers as the execution environment.
WAF Release - 2026-09-10 - Emergency
This update provides immediate defense against a high-severity, actively exploited zero-day vulnerability targeting Adobe Commerce and Magento Open Source storefronts.
Radar search now includes Internet events
Cloudflare Radar search now includes Internet events and outages alongside existing results. Search event descriptions or related entities, such as locations, ASes, bots, and top-level domains, to find relevant events and open the most relevant Radar view.