Releasesby IbisSandboxes - Sandbox SDK 0.12.14 updates trusted certificates after the eMudhra compromise
Update2 days agoUnverifiedAdded Oct 24, 2026
The private keys of eight eMudhra intermediate certificate authorities ↗︎ can be recovered, so anyone can forge a certificate for any hostname that chains to them. Sandbox SDK images before 0.12.14 trust these certificates.
Topics: Governance, Developer tools
More Cloudflare developer platform releases
Every Cloudflare developer platform releaseCloudflare One Client for Windows (version 2026.9.1555.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page . This release includes the following highlights: Added automatic endpoint selection for Global Acceleration.
Cloudflare One Client for macOS (version 2026.9.1555.1)
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page . This release includes the following highlights: macOS 15.0 is now the minimum supported version. This release does not run on macOS 14. Added automatic endpoint selection for Global Acceleration.
Agents - Cloudflare MCP servers no longer serve /sse
Cloudflare's product-specific MCP servers now serve only /mcp . A request to /sse returns 410 Gone with the server's /mcp URL, which most MCP clients show in their connection error. If your MCP client is configured with an /sse URL, change it to /mcp , for example https://docs.mcp.cloudflare.com/mcp .
Agents SDK now supports the latest Pi 1.4 release
Agents SDK v0.30.0 runs PiHarness on Pi 1.4 ↗︎ , and makes it recover more reliably from evictions, crashes, and storage errors. Hibernation while Pi's tasks sleep. PiHarness passes Pi's new onWake callback to your harness factory.
Cloudflare Tunnel, Cloudflare Tunnel for SASE - Cloudflare Tunnel supports URL normalization
Starting from version 2026.10.0 , Cloudflare Tunnel can normalize URLs before matching ingress rules. This improves security for tunnels with rules that require Cloudflare Access validation. The URL path sent to your origin stays the same. In three months, starting 2027-01-25, new cloudflared releases will turn on URL normalization by default.
Cloudflare Fundamentals, Cloudflare One, Cloudflare Tunnel for SASE, Cloudflare Tunnel - Granular Tunnel Read And Monitor role is generally available
The Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is now generally available. You can grant a member read access and log streaming for specific Cloudflare Tunnel instances without granting write access or access to every Tunnel in your account.
WAF Release - 2026-10-22 - Emergency - Cloudflare Managed Ruleset
This emergency release updates the names and metadata of seven existing rules in the Cloudflare Managed Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.
WAF Release - 2026-10-22 - Emergency - Cloudflare Free Ruleset
This emergency release updates the names and metadata of seven existing rules in the Cloudflare Free Ruleset to identify CVE-2026-109618 and CVE-2026-109619. Detection logic and rule actions remain unchanged.
Also shipped on Oct 22, 2026
Cloudflare in October 2026Trace and evaluate Cursor agents with Langfuse, powered by ClickHouse
Users can now connect Cursor to Langfuse to trace agent turns and analyze model and tool calls, with ClickHouse providing the underlying analytics infrastructure.
The AI.TRANSLATE function lets you translate text strings between languages
The AI.TRANSLATE function lets you translate text strings between languages. AI.TRANSLATE supports standard Neural Machine Translation (NMT) workloads and Translation LLM (TLLM) capabilities. This function is generally available (GA).
Replit Monitoring Agent: Your very own software engineering team
Replit Monitoring Agent is an autonomous tool that investigates production alerts, identifies causes, applies fixes, and deploys them to production for internal apps.
Microsoft Entra ID connector is available in Beta
The managed Microsoft Entra ID connector is now available in Beta in Databricks Lakeflow Connect. Use the connector to ingest Microsoft Entra ID users, groups, applications, service principals, directory roles, identity configuration, and audit and sign-in logs into Databricks.
You can configure Direct VPC ingress for Cloud Run instances ( Preview )
You can configure Direct VPC ingress for Cloud Run instances ( Preview ). Direct VPC ingress lets Cloud Run instances on a VPC network use their own ephemeral private IP address to communicate with each other and with other resources on the VPC network.
Gemini Enterprise: Single-user quota limits
Gemini Enterprise administrators can configure single-user quota limits on the Usage & Spending > Usage page in the Google Cloud console to prevent an individual user from using all of an edition's shared subscription quota pool.