Releasesby GlyphR2 - R2 bandwidth usage metrics
New R2 product-level Metrics page in the Cloudflare dashboard shows bandwidth usage. You can view usage across all buckets or per bucket. Go to R2 Metrics ↗ Bandwidth throughput is split by object upload and download. The GraphQL Analytics API exposes the same bandwidth usage metrics that power the dashboard for your queries and analytics.
Also shipped Sep 24, 2026Cloudflare in September 2026 →
DCM Projects capability updates
This release updates the availability of several DCM Projects capabilities. The following capabilities are now generally available: The following capabilities are now available in preview:
Alpha Changelog - 9/23/26
Hi everyone, here are the latest round of changes on alpha.midjourney.com . Many of these came directly from your feedback in #alpha-ideas-and-bugs . Please keep it coming! STYLE PREVIEWS We're experimenting with fast models in the interface.
New project activity feed
As part of our ongoing work to simplify the Netlify dashboard, we’ve added an activity feed to the project overview page. It’s available on all plans and adapts to how your project is set up.
Retool CLI
Live on cloud • Team • Business • Enterprise Public beta 4.62 Edge • Team • Business • Enterprise Public beta 4.34.4 Stable • Team • Business • Enterprise Public beta The Retool CLI is now available in public beta.
Buildkite Cache is now in public preview
Buildkite Cache is now available in public preview. It saves and restores files and directories across pipeline jobs and builds. Use it for package manager download caches, compiled dependencies, and other regenerable data to avoid repeating work.
Service principal Genie usage is billed at standard pricing
Genie usage by service principals is now billed at standard Genie pay-as-you-go pricing. Service principals are excluded from the free monthly usage allowance that applies to individual users. See Manage budgets and cost controls for Genie and Monitor and understand your Genie cost .
More from Cloudflare developer platformEvery Cloudflare developer platform release →
1.1.1.1 - RFC 8509 root key trust anchor sentinel support
1.1.1.1 now supports RFC 8509 ↗ root key trust anchor sentinels. They let you check whether the responding resolver trusts a DNSSEC root key ahead of a key rollover. To check for KSK-2024 (key tag 38696), query DNSSEC-signed names in dnstest.dev : # On a sentinel-aware resolver that trusts KSK-2024: # Returns NOERROR with an A answer.
Access, Cloudflare One - MCP server portals are now generally available
MCP server portals are now generally available to all Cloudflare customers. A portal gives users one endpoint for approved Model Context Protocol (MCP) servers. Cloudflare Access logs tool, prompt, and resource activity.
Workflows, Workers - Declare Workflows in the `exports` configuration
You can now declare the Workflows a Worker defines in the exports field of your Wrangler configuration file. Previously, a Worker could only define a Workflow through a workflows binding, even when the Worker never called the Workflow itself.
Browser Run, Queues - Subscribe to Browser Run crawl events
Browser Run crawl jobs can publish lifecycle events to Cloudflare Queues . Subscribe to started, updated, and finished events to track progress or trigger downstream processing without polling.
Cloudflare Network Firewall, Magic Transit, Cloudflare WAN - Managed Rulesets supported in Unified Routing
Cloudflare Advanced Network Firewall Managed Rulesets are now supported for accounts using Unified Routing mode. For the full list of feature availability, refer to Check feature availability before upgrading .
Email Service - Suppress recipients for one sending domain
Email Sending suppressions now have a scope : account : The suppression applies to every sending domain and subdomain in your account. This is the default. sending_domain : The suppression applies to one sending domain only. A suppression for mail.myappexample.com does not block mail from myappexample.com .
WAF Release - 2026-09-25 - Emergency
This update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits. Key Findings CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress.
Workers tracing , new getActiveSpan(), recordException(), startSpan(), and setAttributes() APIs
Custom spans in Workers now support more of the OpenTelemetry span API, so you can instrument more of your code and record errors directly on your spans. tracing.startSpan(name) creates a span without making it the active span, and returns it. Other spans do not nest under it. Call span.end() when the operation is complete.