How bug bounty sharpens one researcher’s security skills
As Cybersecurity Awareness Month continues, the GitHub Bug Bounty team spotlights @r31n, diving into their research approach, favorite bug classes, and advice for aspiring hackers.
Localizing compliance at scale: achieving South Korea’s ISMS certification
Cloudflare has achieved South Korea's ISMS certification following an audit across 80 controls. Learn how we localized user consent flows, adapted social sign-up paths at the edge, and validated our global security program.
Single-tenant Titus: VM-level isolation on a multi-tenant container platform
Death to long-lived static credentials
Introducing full transaction detection for Cloudflare WAF
Cloudflare's web application firewall can now correlate an HTTP request with its response. Full transaction detection helps every customer find successful exploits, data exposure, and risky misconfigurations that request-only inspection can miss.
Cloudflare deploys protections against php2shell vulnerability
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.
How Commerce.com and Cloudflare are getting storefronts ready for AI agents
Almost 100,000 Commerce.com domains now give AI agents real shopping tools through WebMCP on Cloudflare. Here's how we turned it on across every store at once, while keeping each merchant in control.
The bridge to agent-scale Git infrastructure
We moved a copy of 99.99999% of GitHub's repositories to Azure. Here's how per-reference quorums will bring over the rest, and how object storage lets reads scale independently.
Introducing tsrs: a Port of TypeScript to Rust
Cloudflare is collaborating on tsrs, a Rust port of TypeScript that is up to 8x faster and uses 70% less memory.
8 eMudhra certificates are compromised. Here's what you need to know
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next.
PostgreSQL Just Got a GPU: Introducing CYBERTEC PGEE GPU
This blog talks about the launch of PGEE GPU. Read about how the usage of PostgreSQL can get faster with using PGEE GPU.
How 3 Java Champions are using GitHub Copilot for increased productivity
Three Java Champions share how they use GitHub Copilot to solve problems, accelerate development, and keep humans responsible for the results.
The Future of CSS ✨
Every year, browser vendors collaborate via the Interop project to synchronize their efforts on new HTML/CSS/JS features. This year, there’s a ton of super exciting features being considered! In this blog post, we’ll explore the CSS of the future, to get a glimpse of what we’ll soon be able to do.
Embracing Playful Imperfection With The CSS `random()` Function
Design systems thrive on consistency, so where does randomness fit in? Through playful demos of organic typography, bouncing letters, and splayed cards, Brecht De Ruyte shows how the new CSS `random()` function brings a little imperfection to the web without JavaScript libraries or preprocessor loops that generate hundreds of lines of static CSS.
Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams don't have, so the sign-in decision has to move in front of the vulnerable code.
Cutting our inference bill by 68% by being obsessive about optimization
When our AI code reviewer's cost per run doubled, we dug into the token usage to find out why. Learn how we used prompt caching and intelligent model routing to slash our inference bill by 68% while speeding up reviews.
Introducing Clairic, a new System One class of extraction models
Clairic is a new model from Cloudflare that is a System One extraction modeI, capable of extracting, computing, estimating, and forecasting data from unstructured inputs.
How to continue a GitHub Copilot app session in VS Code
Learn how to move an agent session from the GitHub Copilot app into VS Code without losing the conversation, code changes, or working context.
GenRecs Tokenization: Transforming Ads Recommendation at Meta with Stable Model Vocabulary
Generative Recommenders (GenRecs) represent a paradigm shift from scoring every ad to reasoning about ad content and user preferences together in order to predict the best outcome for advertisers. Leveraging the world knowledge built into LLMs makes ad matching more intelligent and precise, compounding gains for advertisers. GenRecs Tokenization is the foundational data representation that [...] R
The Thin Orchestrator: How We Made Our AI Agents More Reliable by Giving the Router Less to Do
Sometimes, giving an AI agent all of the knowledge it needs is the wrong approach. At Meta, we’ve seen notable improvements in efficiency and accuracy by keeping the orchestration layer of our data pipeline agents deliberately thin: It routes work and enforces reliability checks, while specialized agents do the domain reasoning. We’re sharing our own [...] Read More... The post The Thin Orchestrat
Inside Prometheus: Meta’s Journey to a Gigawatt-Scale Supercluster
With the recent release of the Muse family of foundational models, we want to take you inside the infrastructure that has made it all possible. The first phase of Prometheus, our gigawatt-scale supercluster, is already complete and we’re working toward scaling it to comprise ~1 million GPUs. Prometheus also features technologies like closed-loop liquid cooling [...] Read More... The post Inside Pr
Making every harness durable
Notes on the complex roots of unity
One of the most wonderful aspects of math is how deep we can get by studying seemingly trivial questions. Consider the roots of unity, where "unity" simply means the number 1. Basics: roots of unity for real numbers Studying the roots of unity usually begins in middle school: what is …
Continuous accountability for Verified bots
Identity alone doesn't guarantee a bot will behave responsibly. We are introducing a system to continuously evaluate whether Verified bots honor site preferences, like robots.txt and HTTP 429s, ensuring they remain accountable over time.