Releasesby GlyphDNS - Shadowed record warnings are now available for all zones
Cloudflare now displays warnings for shadowed records in all zones. A record is shadowed when a subdomain delegation gives authority for its name, or a name below it, to another set of nameservers. The record remains present, but your zone is not authoritative for it thus Cloudflare will not respond with it to matching DNS queries.
Also shipped Sep 14, 2026Cloudflare in September 2026 →
Metadata for BigQuery Graph is automatically ingested and searchable in Knowledge Catalog
Metadata for BigQuery Graph is automatically ingested and searchable in Knowledge Catalog . This feature is available in preview .
BigQuery supports WHERE clauses inside aggregate function calls in preview
Aggregate function calls can now include a WHERE clause that filters their input with a boolean expression, simplifying conditional aggregation in SQL.
Multimodal AI_SUMMARIZE for automatic theme summarization (Public Preview)
Snowflake Cortex AI_SUMMARIZE is now available in public preview, enabling customers to summarize text and multimodal content, including images and documents, directly in Snowflake.
Zero-copy support for all table formats in interactive warehouses (General availability)
Support for all table formats in interactive warehouses is now generally available and is no longer in Preview .
Genie visualizations in Slack replies (Public Preview)
When a Genie response includes a chart, the visualization now appears as an image in the Slack reply. If you installed the Databricks Genie app for Slack previously, reinstall it to enable this. See Visualizations .
Metadata for BigQuery Graph is now automatically ingested and searchable in Knowledge Catalog
Metadata for BigQuery Graph is now automatically ingested and searchable in Knowledge Catalog. This feature is available in preview . For more information, see Knowledge Catalog overview .
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Access - Require fresh authentication for SAML identity providers
Cloudflare Access can now request fresh authentication from a SAML identity provider for every login. Turn on Require reauthentication in the Cloudflare dashboard, or set force_authn to true through the API. Access will then set ForceAuthn to true in signed and unsigned SAML authentication requests.
AI Gateway - Prevent Unified Billing fallback for BYOK third-party providers
AI Gateway can now require credentials for third-party provider requests. Credentials must accompany the request or be stored on the gateway. This setting prevents fallback to Unified Billing with Cloudflare-managed credentials. Turn on Require provider credentials in your gateway settings.
Browser Run - Control which hostnames Browser Run sessions can access
Browser Run now supports guardrails , which limit a browser session's HTTP and HTTPS requests to permitted hostnames. Use guardrails when you need to: Keep a browser workflow limited to a specific website and its subdomains. Load only known third-party APIs, scripts, images, and fonts.
Data Loss Prevention - Discover where sensitive data goes before you create a Data Loss Prevention policy
Passive Detection for Cloudflare Data Loss Prevention (DLP) lets you learn from your Gateway traffic before deciding what to log or block. Discover the sensitive data types in sampled traffic, explore their destinations, and use the findings to build policies around your organization's needs.
Workflows, Workers - Stream Workflow instance events in your Worker or via the API with .subscribe()
You can now stream Workflow instance events via WorkflowInstance.subscribe() and the GET /subscribe API endpoint. Workers and HTTP clients can react to workflow and step events, including attempts, sleeps, waits, and rollbacks, without polling for instance status. A subscription first streams the entire event history of the Workflow instance.
Cloudflare One, Access - Access for Infrastructure now supports tagged targets and tag-based target criteria
Access for Infrastructure now integrates with Resource Tagging . You can attach key-value tags to infrastructure targets and use them in access policies. You can manage tags on targets inline when you create or edit a target or through the central Resource Tagging API . Cloudflare keeps tags in sync across both methods.
WAF Release - 2026-09-15
This release introduces new threat detections to enhance protection against command injection attempts, Server-Side Request Forgery (SSRF) targeting cloud metadata, and information disclosure within version control history.
Workers - Grant teammates and agents access to specific Workers
You can now grant access to specific Workers and choose from four roles to control the level of access you give teammates, agents, and CI/CD workflows. Choose from four roles to control the level of access: Metadata Read-Only : View settings, metrics, logs, and traces without access to Worker code or the ability to make changes.