Birthday Week 2026 ran from Monday, September 28, through Friday, October 2, with 46 announcements spread across five themed days. Each day covered a different area: open source, application security and the post-quantum transition, economic models for the agentic Internet, the Developer Platform, and usability and performance work.
The week's framing follows the 2026 Founders' Letter, in which Matthew and Michelle describe this year as bringing some of the most consequential changes in the Internet's history. Automated traffic surpassed human activity for the first time, and agent-driven recommendations now influence consumer choices strongly enough that a new approach is needed to leave room for new businesses to succeed. Interns contributed directly to several launches, including EmDash, post-quantum visibility, CryptoLabe, and Protected Quick Tunnels.
Application security and the post-quantum transition
Tuesday, September 29, centered on how technological progress is changing application security. Cloudflare announced its intention to become a certificate authority, detailed how it is preparing foundational Internet cryptography for the post-quantum era, and described how it is adapting application security to counter AI-driven attacks.
What | In a sentence… |
Twelve years after launching Universal SSL, Cloudflare announced its intention to become a public certificate authority (CA) and add resilience to free, automated certificate issuance. | |
Building a post-quantum certificate authority with Merkle Tree Certificates | Our planned CA will issue free Merkle Tree Certificates designed to make post-quantum authentication practical without imposing large certificate and handshake costs. |
CryptoLabe uses AI to find and classify cryptography across our codebase as Cloudflare works toward completing its post-quantum migration by 2029. | |
Cloudflare helped develop an IETF extension that authenticates the full IKEv2 transcript and prevents attackers from downgrading post-quantum IPsec tunnels. | |
Is your domain using post-quantum encryption? Now you can see for yourself | HTTP Analytics, Log Explorer, and Logpush now show whether requests negotiated post-quantum key exchange, giving customers evidence they can inspect and report. |
Enforce positive security with Cloudflare Application Profiles | Application Profiles learns the expected structure of HTTP requests so customers can identify deviations and enforce what valid application traffic should look like. |
We tested our own WAF with frontier AI models. Here's what we found | An adaptive AI red-team system found WAF detection gaps across six attack categories, helping us improve normalization and managed rules for customers. |
Threat Signals turns open-source reporting into structured indicators and connects the context to WAF rules, while the Threat Events Platform expands to every account. | |
Our application-security framework connects discovery, governance, runtime protection, investigation, and response in a continuous learning loop. |
Other days of the week
Monday, September 28, covered the commitment to open source: a new CLI released together with the pipeline used to generate it, plus SDKs and docs, aimed at supporting agents and developers using Cloudflare and the projects they depend on.
What | In a sentence… |
Introducing cf: the agentic CLI for the entire Cloudflare API | The new cf CLI mirrors the Cloudflare API, uses JSON-first output and typed configuration, and gives people and agents one consistent command-line interface. |
Introducing Forge: the open source pipeline for generating SDKs, CLIs, docs, and more | Forge is a pluggable, open-source pipeline that runs in CI to generate SDKs, CLIs, documentation, and other interfaces directly from API definitions. |
Introducing EmDash - the spiritual successor to WordPress that solves plugin security | EmDash is an open-source, Astro-based serverless CMS that runs plugins in isolated Worker sandboxes with explicitly approved capabilities. |
Since joining Cloudflare, VoidZero has delivered more than 80 releases across the Vite ecosystem, and its previously commercial Void platform will become fully open source. | |
Next.js applications, powered by Vite: introducing Vinext 1.0 | Vinext 1.0 turns an AI-built experiment into a production-ready, portable way to run Next.js applications on Vite. |
Kitesurf, our Workers-based browser for agents, adds WebMCP support, faster DOM operations, broader web compatibility, and terminal-based rendering. | |
How fast is the web? Explore billions of real-user measurements with BEACON | BEACON makes billions of anonymized real-user performance measurements from 10,000 major websites available as a public BigQuery dataset. |
Supporting native Rust in Workers with the new Emscripten target for wasm-bindgen | Experimental Emscripten target support lets developers bring more native Rust libraries and applications, including progress toward Tokio support, to Workers. |
Introducing The Cold Start: pitch your startup live at Cloudflare Connect | The Cold Start gives five early-stage companies the opportunity to pitch live at Cloudflare Connect and compete for resources to help them grow. |
Wednesday, September 30, addressed the agent economy with Pay Per Use and the beta release of the Monetization Gateway, both intended to support a model in which creators monetize their content and services.
What | In a sentence… |
AI agent requests have grown rapidly, and our strategy helps creators see agents, set terms for access, and get paid when agents use their work. | |
Containers now has faster startup, flexible image and instance selection, new scheduling controls, and filesystem snapshots for persistent agent workspaces. | |
Monetization Gateway beta: charge AI agents for consumption with HTTP 402 | Monetization Gateway lets sellers put a price on resources behind Cloudflare and collect agent payments using HTTP 402 and x402. |
Pay Per Use gives enrolled publishers usage reports, billing, and payouts when verified AI buyers use their content. | |
A new domain-search experience and expanded Registrar APIs make it easier for both people and agents to search, register, transfer, and manage domains. | |
AI Gateway User Insights identifies tasks, model fit, and overuse, so teams can understand where a smaller or less expensive model may work. | |
Issues groups Workers errors and sends the relevant stack traces, logs, and traces to coding agents or any webhook for faster investigation. | |
Auto Router classifies each request at the edge and sends it to a suitable model, reducing cost while preserving response quality. | |
Initiatives including Project Galileo, the Athenian Project, and Cloudflare for Campaigns have now delivered more than $100 million in donated services. |
Thursday, October 1, expanded the developer stack: Cloudflare Basin, the data analytics platform, reached general availability; K2, a durable serverless event stream, launched; and a new contest was announced inviting developers to build a Git platform designed for agentic development.
What | In a sentence… |
Introducing Cloudflare Basin: an open, serverless data platform, now generally available | Basin is now generally available, giving developers a serverless platform built on Apache Iceberg and R2 for ingesting, managing, and querying large datasets. |
Workers adds opt-in native Web Crypto support for ML-KEM and ML-DSA, giving developers post-quantum primitives without bundling their own implementations. | |
AI Search reaches general availability with visual search, OCR for scanned PDFs, larger files, and support for any chat model. | |
Artifacts enters open beta and a new competition invites developers to build a Git platform designed for the era of AI agents. | |
K2 provides durable, ordered event streams on R2, separating producers and consumers without the operational overhead of managing broker clusters. | |
Cloudflare OS: your company's agent workspace, managed for you | Cloudflare OS provides an agent workspace connected to an organization’s data and systems, with a waitlist open for fully managed deployments. |
Workers KV Instant delivers sub-two-millisecond p99 reads and fast global replication across more than 300 locations using the familiar Workers KV API. | |
We are expanding local open-source model choice and model-agnostic security tools, so nations can pursue AI sovereignty without isolation. | |
Introducing Clef: our open-source decision models, and new RL fine-tuning platform | Clef and Clef-flash are open-source decision models for fast classification and agent workflows, accompanied by a platform for reinforcement-learning fine-tuning. |
Friday, October 2, closed the week with updates to Cloudflare Observability, the addition of Cloudflare Traces, network performance improvements, and an announcement on support for civil society organizations.
What | In a sentence… |
Eight updates bring logs, traces, analytics, alerts, dashboards, querying, and telemetry export into one observability platform with simpler pricing. | |
Introducing Cloudflare Traces: follow requests through our entire platform | Cloudflare Traces provides request-level visibility across security rules, transformations, cache, Workers, services, and origins without requiring an agent or SDK. |
Updates on our pledge to make Cloudflare features accessible to everyone | One year after our pledge, Logpush, multi-account governance, higher platform limits, and other capabilities are available to more customers across plans. |
A self-serve OHTTP Gateway enters closed beta, while Privacy Gateway becomes Cloudflare OHTTP Relay to distinguish the two roles. | |
Follow the thread: a new dashboard to investigate account abuse | Account Abuse Protection uses stateful analysis and privacy-preserving Hashed User IDs to help teams investigate credential stuffing and fake-account creation. |
Protected Quick Tunnels: simple accountless authentication for your next dev project | Quick Tunnels now support email authentication, letting developers share a local application with selected people or domains without requiring Cloudflare accounts. |
Building for good: How civil society organizations are automating on Cloudflare | Civil society organizations are using Cloudflare’s developer platform to automate and scale work that protects human rights and the public interest. |
Using an expanded real-user measurement methodology, Cloudflare now ranks as the fastest provider across 74% of the top 1,000 networks. | |
AI Gateway’s Web Search API brings current web context from multiple providers into model calls through REST APIs, Workers bindings, or customer-managed keys. | |
Streamline: custom video pipelines with Cloudflare Stream and Workers | Streamline is an open-source example for building continuous video pipelines by combining Workers, Durable Objects, and a containerized media engine. |
Common threads
Across this week's announcements, the recurring theme was that the Internet should keep opening up more opportunities for people to create, contribute, and succeed.
In practice, that means open tools developers can shape, security that keeps pace with new threats, a fairer exchange between agents and the people whose work they use, and infrastructure designed for the agentic Internet. Cloudflare notes that 16 years of work with developers, creators, researchers, customers, partners, and open-source communities — including their feedback and challenges — have shaped the company, and that this collaboration matters more than ever.
