Precursor, our new continuous behavioral validation engine for bot management, offers visibility into how humans and bots actually interact across the full user journey. By turning session-level behavior into bot detection signals, it identifies advanced automation with higher precision — while reducing friction for legitimate users.

NIST is advancing nine new post-quantum signature algorithms as potential candidates for future standardization. We take a closer look at all of them, and argue that while they are in the works and show great potential, we should use ML-DSA for now — the best one currently available.

Cloudflare宣布加入英国政府推出的“网络弹性承诺”（Cyber Resilience Pledge），这是一项自愿性框架，旨在鼓励组织在网络安全治理、董事会层面的安全责任以及供应链安全方面做出承诺。该框架要求参与组织建立基础的安全治理结构，确保董事会成员对网络安全负责，并加强供应链中的安全实践。Cloudflare在博客中表示，十多年来，公司一直倡导安全民主化、领导问责制和彻底透明化，这些正是该框架的核心支柱。通过加入该承诺，Cloudflare希望推动整个行业提升网络安全水平，并与其他组织分享最佳实践。该承诺不涉及具体漏洞或攻击活动，而是侧重于安全治理和合规性。Cloudflare的参与被视为对英国政府网络安全倡议的积极支持，有助于增强公共和私营部门之间的合作。该框架面向所有组织开放，不限于特定行业或地区，旨在提高整体网络韧性。

Cloudflare’s new Attribution Business Insights dashboard helps website owners understand crawler behavior, appetite, and potential value, fueling business-level conversations around crawl compensation.

Self-Managed OAuth is now available to all developers on Cloudflare. Here's how we executed a zero-downtime migration of our core OAuth engine to make it happen.

The new post-quantum executive order sets a 2030 migration deadline and establishes a powerful foundation for post-quantum resilience. We look at what it gets right, where it can go further, and our migration playbook for government and industry.

We break down the technical architecture behind our multi-stage vulnerability discovery harness and automated triage loop. Learn how we manage state controls, squash false positives through adversarial review, and route around LLM context limits.

In our post about Project Glasswing, we made the argument that the architecture around a vulnerability matters more than the speed of the patch. Here we walk through what that architecture looks like, the threats it defends against, and how we run it ourselves as Cloudflare's customer zero.

Cloudflare customers can now use Cloudforce One threat intelligence directly within the WAF to block high-risk traffic. By using new cf.intel fields, security teams can automate protection against specific threat actors and targeted industries in real time.

In recent weeks, we pointed Mythos and other security-focused LLMs at live code across critical parts of our infrastructure. We share what we observed, the models’ strengths and weaknesses, and what the work around them needs to look like before any of it can scale.

When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.

Cloudflare IPsec now has generally available support for post-quantum encryption via hybrid ML-KEM. We’ve confirmed interoperability with Cisco and Fortinet.