A new WAF experience
The security landscape is moving fast. We invited users to help us shape a new WAF experience that enables us to evolve WAF to meet their demands and use cases
Cloudflare Zaraz supports CSP
If you have Cloudflare Zaraz enabled on your website, you don’t have to ask yourself twice if you should enable CSP because there’s no harmful collision between CSP & Cloudflare Zaraz
Investigating threats using the Cloudflare Security Center
The data we glean from attacks trains our machine learning models and improves the efficacy of our network and application security products, but historically hasn’t been available to query directly. This week, we’re changing that
Leverage IBM QRadar SIEM to get insights from Cloudflare logs
We’re excited to announce that Cloudflare customers are now able to push their logs directly to QRadar. This direct integration leads to cost savings and faster log delivery for Cloudflare and QRadar SIEM customers
Introducing: Backup Certificates
We are excited to introduce backup certificates to increase reliability of our service for anyone using the Cloudflare platform in the event of key compromises or related issues
Get full observability into your Cloudflare logs with New Relic
Correlating Cloudflare logs across your stack in New Relic One is powerful for monitoring and debugging in order to keep services safe and reliable. We’re excited to have partnered with New Relic to create a direct integration that provides this visibility
Democratizing email security: protecting individuals and businesses of all sizes from phishing and malware attacks
Once the acquisition of Area 1 closes, we plan to give all paid self-serve plans access to their email security technology at no additional charge
Welcome to Security Week 2022!
Welcome to our first innovation week of the year: Security Week! In this post we will be going over Cloudflare’s security products’ history giving you an introduction to all the great announcements we have planned
How Cloudflare verifies the code WhatsApp Web serves to users
Understand how Cloudflare is helping WhatsApp verify the code they’re using for secure messaging hasn’t been tampered with
Stream now supports SRT as a drop-in replacement for RTMP
RTMP is not the protocol to carry us into the future so Cloudflare Stream now supports SRT in wherever you would use RTMP for.
DNSSEC issues take Fiji domains offline
DNSSEC issues with the .fj ccTLD caused problems reaching websites on the island nation
International Women’s Day 2022
Welcome to International Women’s Day 2022! Here at Cloudflare, we are happy to celebrate it with you! Our celebration is not only this blog post, but many events prepared for the month of March: our way of honoring Women’s History Month by showcasing women’s empowerment
Announcing experimental DDR in 1.1.1.1
The majority of DNS queries on the Internet today are unencrypted. This post describes a new protocol, called Discovery of Designated Resolvers (DDR), that allows clients to upgrade from unencrypted DNS to encrypted DNS when only the IP address of a resolver is known.
CVE-2022-26143: A Zero-Day vulnerability for launching UDP amplification DDoS attacks
A zero-day vulnerability in the Mitel MiCollab business phone system has recently been discovered (CVE-2022-26143). This vulnerability, called TP240PhoneHome, which Cloudflare customers are already protected against, can be used to launch UDP amplification attacks
CVE-2022-26143: TP240PhoneHome reflection/amplification DDoS attack vector
A new reflection/amplification distributed denial-of-service (DDoS) vector with a record-breaking potential amplification ratio of 4,294,967,296:1 has been abused by attackers in the wild to launch multiple high-impact DDoS attacks
Steps we've taken around Cloudflare's services in Ukraine, Belarus, and Russia
At Cloudflare, we watched in horror as Russian invaded Ukraine. As of war looked more likely, we monitored the situation, with the goal of keeping our employees, our customers, and our network safe.
Cloudflare, CrowdStrike, and Ping Identity launch the Critical Infrastructure Defense Project
Cloudflare has launched the Critical Infrastructure Defense Project to counter potential cyber retaliation for sanctions resulting from Russia's invasion of Ukraine.
Shields up: free Cloudflare services to improve your cyber readiness
Whether you’re a seasoned professional or a novice website operator, free Cloudflare resources are available. Beyond these resources, there are a few simple steps that you can take to stay protected.
Internet traffic patterns in Ukraine since February 21, 2022
Cloudflare operates in more than 250 cities worldwide where we connect our equipment to the Internet to provide our broad range of services
iCloud Private Relay: What Cloudflare Customers Need to Know
iCloud Private Relay is an Apple service for browsing more privately and securely. Learn how to ensure the best user experience using iCloud Private Relay.
Post-quantumify internal services: Logfwrdr, Tunnel, and gokeyless
A big challenge is coming: to change all internal connections at Cloudflare to use post-quantum cryptography. Read how we are tackling this challenge!
The post-quantum future: challenges and opportunities
The story and path of post-quantum cryptography is clear. But, what are the future challenges? In this blog post, we explore them
HPKE: Standardizing public-key encryption (finally!)
HPKE (RFC 9180) was made to be simple, reusable, and future-proof by building upon knowledge from prior PKE schemes and software implementations. This article provides an overview of this new standard, going back to discuss its motivation, design goals, and development process
Cloudflare re-enforces commitment to security in Germany via BSIG audit
As Cloudflare expands globally, Rebecca Rogers, Manager of Security Validations, discusses an exciting update to Cloudflare’s commitment to customer security for our German customers
Using EasyCrypt and Jasmin for post-quantum verification
This blogpost will touch upon how to practically use Jasmin and EasyCrypt to achieve better security guarantees when verifying KEMs
Building Confidence in Cryptographic Protocols
This blogpost refers to the efforts to use formal/verification/implementation for post-quantum algorithms to achieve better assurance for them. It also touches on our Cloudflare efforts on this
Why we are acquiring Area 1
Earlier today we announced that Cloudflare has agreed to acquire Area 1 Security
Making protocols post-quantum
Post-quantum key exchange and signature algorithms come with different trade-offs that we’re familiar. How do we handle that when updating protocols, is this an opportunity to revisit the status quo?
BGP security and confirmation biases
On February 1, 2022, a configuration error on one of our routers caused a route leak of up to 2,000 Internet prefixes to one of our Internet transit providers. This leak lasted for 32 seconds and at a later time 7 seconds
Deep dive into a post-quantum key encapsulation algorithm
In this blog post, we will look at what Key Encapsulation Mechanisms are and why they matter in a post-quantum world
Deep dive into a post-quantum signature scheme
How can one attest to an identity and prove it belongs to one self? And how can one do it in the face of quantum computers? In this blog post, we examine these questions and explain what post-quantum signatures are
Internet is back in Tonga after 38 days of outage
Tonga, the South Pacific archipelago nation (with 169 islands), was reconnected to the Internet this early morning (UTC) and is back online after successful repairs to the undersea cable that was damaged on Saturday, January 15, 2022, by the January 14, volcanic eruption
The post-quantum state: a taxonomy of challenges
At Cloudflare, we strive to help build a better Internet, which means a quantum-protected one. In this post, we look at the challenges for migrating to post-quantum cryptography and what lies ahead using a taxonomy
The quantum solace and spectre
What is quantum computing and what advances have been made so far on this front? In this blog post, we will answer this question and see how to protect against quantum adversaries
Detecting Magecart-Style attacks with Page Shield
How we’re using content-based analysis to identify Magecart-style attacks
Production ready eBPF, or how we fixed the BSD socket API
We are open sourcing the production tooling we’ve built for the sk_lookup hook we contributed to the Linux kernel, called tubular
Who won Super Bowl LVI? A look at Internet traffic during the big game
By now, everyone knows that the Los Angeles Rams won, but we also want to look at which Super Bowl advertisers were the biggest winners, and how traffic to food delivery services, social media and messaging apps, and sports and betting websites changed throughout the game
Adding a CASB to Cloudflare Zero Trust
Earlier today, Cloudflare announced that we have acquired Vectrix, a cloud-access security broker (CASB) company focused on solving the problem of control and visibility in the SaaS applications and public cloud providers that your team uses
Cloudflare acquires Vectrix to expand Zero Trust SaaS security
We are excited to share that Vectrix has been acquired by Cloudflare! Vectrix helps IT and security teams detect security issues across their SaaS applications
Email Routing is now in open beta, available to everyone
Cloudflare Email Routing transitioned from closed beta to open beta. It’s now available to everyone, including free zones
Slicing and Dicing Instant Logs: Real-time Insights on the Command Line
Today, I am going to introduce you to Instant Logs in your terminal
Need to keep analytics data in the EU? Cloudflare Zaraz can offer a solution
Zaraz offers a way to use tools like Google Analytics, but doing so with an approach that protects the privacy of personal information and keeps it in the EU
How to stop running out of ephemeral ports and start to love long-lived connections
Often programmers have assumptions that turn out, to their surprise, to be invalid. From my experience this happens a lot. Every API, technology or system can be abused beyond its limits and break in a miserable way
Announcing the public launch of Cloudflare's bug bounty program
Today we are launching Cloudflare’s paid public bug bounty program. We believe bug bounties are a vital part of every security team’s toolbox.
Cloudflare Partner Program Now Supports SASE & Zero Trust Managed Services
We’ve been building out the Cloudflare Partner Network for years, working alongside businesses of all sizes and types including our world-wide system integrator partners
Happy Data Privacy Day!
On this Data Privacy Day, we look back at how events in 2021 shaped the privacy world, and we look ahead to what 2022 may have in store
Migrating to Cloudflare Email Routing
With Email Routing, you can effectively start receiving Emails in any of your domains for any number of custom addresses you want and forward the messages to any existing destination mailboxes
Protecting Holocaust educational websites
Cloudflare’s Project Galileo provides free protection to at-risk groups across the world including Holocaust educational and remembrance websites
Incorrect proxying of 24 hostnames on January 24, 2022
On January 24, 2022, as a result of an internal product migration, 24 hostnames (including www.cloudflare.com) that were actively proxied through the Cloudflare global network were mistakenly redirected to the wrong origin
Landscape of API Traffic
More than 50% of all traffic processed by Cloudflare is API-based, and it’s growing twice as fast as traditional web traffic. This growth calls for the development of dedicated security solutions.
Burkina Faso experiencing second major Internet disruption this year
The early hours of Sunday, January 23, 2022, started in Burkina Faso with an Internet outage or shutdown
Internet outage in Yemen amid airstrikes
The early hours of Friday, January 21, 2022, started in Yemen with a country-wide Internet outage
Tomonari Sato: Why I joined Cloudflare and why I’m helping Cloudflare grow in Japan
I’m excited to announce that I recently joined Cloudflare in Japan as Vice-President and Managing Director, to help build and expand our customer, partner base, and presence in Japan
Tonga’s likely lengthy Internet outage
The latest Internet outage, in the South Pacific country of Tonga (with 169 islands), is still ongoing. It started with the large eruption of Hunga Tonga–Hunga Haʻapai, an uninhabited volcanic island of the Tongan archipelago on Friday, January 14, 2022
Cloudflare customers on Free plans can now also get real-time DDoS alerts
We’re excited to announce that customers using our Free plan can now get real-time alerts about HTTP DDoS attacks that were automatically detected and mitigated by Cloudflare
A Workers optimization that reduces your bill
Recently, we made an optimization to the Cloudflare Workers runtime which reduces the amount of time Workers need to spend in memory. We're passing the savings on to you for all your Unbound Workers
Former R&D Engineer Wins Round 2 of Project Jengo, and Cloudflare Wins at the Patent Office
In April 2021, Cloudflare relaunched Project Jengo, Cloudflare’s prior art search contest. Here is the latest case update, along with our second round of winners.
DDoS Attack Trends for Q4 2021
In Q4, we observed a 95% increase in L3/4 DDoS attacks and record-breaking levels of Ransom DDoS attacks. The Manufacturing industry was the most targeted alongside a 5,800% increase in SNMP-based DDoS attacks and massive campaigns against VoIP providers around the world
Cloudflare Innovation Weeks 2021
As we start planning our 2022 Innovation Weeks, we are reflecting back on the highlights from each of these weeks
Miniflare 2.0: fully-local development and testing for Workers
We're thrilled to announce the release of the next major version: a more modular, lightweight and accurate Miniflare 2.0
