Background Coding Agents: Context Engineering (Honk, Part 2)
This is part 2 in our series about Spotify's journey with background coding agents (internal codename: “Honk”) and the future of large-scale software maintenance. See also , , and .
1,500+ PRs Later: Spotify’s Journey with Our Background Coding Agent (Honk, Part 1)
This is part 1 in our series about Spotify's journey with background coding agents (internal codename: “Honk”) and the future of large-scale software maintenance. See also , , and .
Shuffle: Making Random Feel More Human
Shuffle has always been one of Spotify’s most-used features, and also one of the most misunderstood. For years, listeners have debated whether Shuffle is “truly random,” often noticing patterns or repeated tracks that didn’t feel random enough.
BGP zombies and excessive path hunting
A BGP “zombie” is essentially a route that has become stuck in the Default-Free Zone (DFZ) of the Internet, potentially due to a missed or lost prefix withdrawal. We’ll walk through some situations where BGP zombies are more likely to rise from the dead and wreak havoc.
Go and enhance your calm- demolishing an HTTP:2 interop problem
HTTP/2 implementations often respond to suspected attacks by closing the connection with an ENHANCE_YOUR_CALM error code. Learn how a common pattern of using Go's HTTP/2 client can lead to unintended errors and the solution to avoiding them.
A Glimpse of PostgreSQL Conference Europe 2025
This blog describes the experience of PostgreSQL conference Europe, 2025, held in RIGA, Latvia. Read and learn more about the conference.
Fading Light And Falling Leaves (November 2025 Wallpapers Edition) — Smashing Magazine
The new month is just around the corner, and that means: It’s time for some new desktop wallpapers! All of them are designed by the community for the community and can be downloaded for free. Enjoy!
BotID Deep Analysis catches a sophisticated bot network in real-time
BotID Deep Analysis is a sophisticated, invisible bot detection product. This article is about how BotID Deep Analysis adapted to a novel attack in real time, and successfully classified sessions that would have slipped through other services.
Anonymous credentials- rate-limiting bots and agents without compromising privacy
As AI agents change how the Internet is used, they create a challenge for security. We explore how Anonymous Credentials can rate limit agent traffic and block abuse without tracking users or compromising their privacy.
Beyond IP lists- a registry format for bots and agents
We propose an open registry format for Web Bot Auth to move beyond IP-based identity. This allows any origin to discover and verify cryptographic keys for bots, fostering a decentralized and more trustworthy ecosystem.
Policy, privacy and post-quantum: anonymous credentials for everyone
The world is adopting anonymous credentials for digital privacy, but these systems are vulnerable to quantum computers. This post explores the cryptographic challenges and promising research paths toward building new, quantum-resistant credentials from the ground up.
Introducing Figma Weave: The next generation of AI-native creation at Figma
Figma has acquired Weavy, a platform that brings generative AI and professional editing tools into the open canvas.
Measuring what matters: How offline evaluation of GitHub MCP Server works
Take a look inside our automated pipeline for rapid, rigorous evaluation for the GitHub MCP Server.
So long, and thanks for all the fish- how to escape the Linux networking stack
Many products at Cloudflare aren’t possible without pushing the limits of network hardware and software to deliver improved performance, increased efficiency, or novel capabilities such as soft-unicast, our method for sharing IP subnets across data centers. Happily, most people do not need to know the intricacies of how your operating system handles network and Internet access in general. Yes, eve
Measuring characteristics of TCP connections at Internet scale
Researchers and practitioners have been studying connections almost as long as the Internet that supports them. Today, Cloudflare’s global network receives millions of connections per second. We explore various characteristics of TCP connections, including lifetimes, sizes, and more.
One IP address, many users: Detecting CGNAT to reduce collateral effects
IPv4 scarcity drives widespread use of Carrier-Grade Network Address Translation, a practice in ISPs and mobile networks that places many users behind each IP address, along with their collected activity and volumes of traffic. We introduce the method we’ve developed to detect large-scale IP sharing globally and mitigate the issues that result.
Helping protect the 2025 Moldova elections
Cloudflare mitigated a 12-hour DDoS attack against Moldova's Central Election Commission, blocking over 898 million malicious requests that peaked at 324,333 requests per second. This defense kept critical election infrastructure online and accessible for citizens during a critical parliamentary vote.
Defending QUIC from acknowledgement-based DDoS attacks
We identified and patched two DDoS vulnerabilities in our QUIC implementation related to packet acknowledgements. Cloudflare customers were not affected. We examine the "Optimistic ACK" attack vector and our solution, which dynamically skips packet numbers to validate client behavior.
Getting Creative With Small Screens
On mobile, people can lose their sense of context and can’t easily tell where a section begins or ends. Good small-screen design can help orient them using a variety of techniques.
PostgreSQL Training
Get ahead in PostgreSQL and GIS: On-Site, Online or in your Office. You decide what is best for you and your Team.
Vercel achieves TISAX AL2 compliance to serve automotive partners
Vercel has achieved TISAX Assessment Level 2 security standard to align with automotive and manufacturing industries
Announcing Workers automatic tracing -- now in open beta
Cloudflare Workers' support for automatic tracing is now in open beta! Export traces to any OpenTelemetry-compatible provider for deeper application observability -- no code changes required
State of the post-quantum Internet in 2025
Today over half of human-initiated traffic with Cloudflare is protected against harvest-now/decrypt-later with post-quantum encryption. What once was a cool science project, is the new security baseline for the Internet. We’re not done yet: in this blog post we’ll take measure where we are, what we expect for the coming years, and what you can do today.
Keeping the Internet fast and secure- introducing Merkle Tree Certificates
Cloudflare is launching an experiment with Chrome to evaluate fast, scalable, and quantum-ready Merkle Tree Certificates, all without degrading performance or changing WebPKI trust relationships.
Online outages: Q3 2025 Internet disruption summary
In Q3 2025, global Internet disruptions were caused by everything from government shutdowns to stray bullets and earthquakes. This report analyzes the traffic data behind these outages to show their real-world impact on connectivity.
A framework for measuring Internet resilience
We present a data-driven framework to quantify cross-layer Internet resilience. We also share a list of measurements with which to quantify facets of Internet resilience for geographical areas.
The Future of CYBERTEC and PostgreSQL
This blog describes what we can expect from CYBERTEC in future. Dive in and hear it for the CEO himself, and know about his thoughts.
Schema 2025: Design systems for a new era
As AI accelerates product development, design systems keep the bar for craft and quality high. Here’s everything we announced at Schema to help teams design for the AI era.
Agentic AI and Security
Agentic AI systems present unique security challenges. The fundamental security weakness of LLMs is that there is no rigorous way to separate instructions from data, so anything they read is potentially an instruction. This leads to the “Lethal Trifecta”: sensitive data, untrusted content, and external communication - the risk that the LLM will read hidden instructions that leak sensitive data to
Introducing Agent HQ: Any agent, any way you work
At Universe 2025, GitHub’s next evolution introduces a single, unified workflow for developers to be able to orchestrate any agent, any time, anywhere.
Octoverse: A new developer joins GitHub every second as AI leads TypeScript to #1
In this year’s Octoverse, we uncover how AI, agents, and typed languages are driving the biggest shifts in software development in more than a decade.
Announcing the 2025 GitHub Partner Award winners 🎉
GitHub celebrates its 2025 Partner Award winners, honoring global, regional, and technology partners for driving innovation, collaboration, and impact across the developer ecosystem.
Springs and Bounces in Native CSS
The “linear()” timing function is a game-changer; it allows us to model physics-based motion right in vanilla CSS! That said, there are some limitations and quirks to be aware of. I’ve been experimenting with this API for a while now, and in this post, I’ll share all of the tips and tricks I’ve learned for using it effectively. ✨
Bun runtime on Vercel Functions
Vercel Functions now supports the Bun runtime, giving developers faster performance options and greater flexibility for optimizing JavaScript workloads.
Data at Cloudflare scale- some insights on measurement for 1,111 interns
While large cloud providers hold vast troves of passive network data, analyzing them is complicated. The scale, noise, and absence of definitive ground truth all create major hurdles. Yet by carefully quantifying these constraints and finding alternative forms of evidence, meaningful insights can still emerge.
Internet measurement, resilience, and transparency: blog takeover from Cloudflare Research and friends
Coinciding with the ACM’s Internet Measurement Conference, the Cloudflare Research team is publishing a series of posts this week to share their research on building a more measurable, resilient, and transparent Internet. These posts will cover foundational concepts in Internet measurement, Internet resilience, cryptography, and networking.
Making the Internet observable- the evolution of Cloudflare Radar
Cloudflare Radar has evolved significantly since its 2020 launch, offering deeper insights into Internet security, routing, and traffic with new tools and data that help anyone understand what's happening online.
From .com to .anything- introducing Top-Level Domain (TLD) insights on Cloudflare Radar
Cloudflare Radar has launched a new Top-Level Domain (TLD) page, providing insights into TLD popularity, traffic, and security. The top-ranking TLD may come as a surprise.
JavaScript For Everyone: Iterators — Smashing Magazine
Here is a lesson on Iterators. Iterables implement the iterable iteration interface, and iterators implement the iterator iteration interface. Sounds confusing? Mat breaks it all down in the article.
How Cloudflare’s client-side security made the npm supply chain attack a non-event
A recent npm supply chain attack compromised 18 popular packages. This post explains how Cloudflare’s graph-based machine learning model, which analyzes 3.5 billion scripts daily, was built to detect and block exactly this kind of threat automatically.
Securing agentic commerce: helping AI Agents transact with Visa and Mastercard
Cloudflare is partnering with Visa and Mastercard to help secure the future of agentic commerce.
How to find, install, and manage MCP servers with the GitHub MCP Registry
Learn how to bring structure and security to your AI ecosystem with the GitHub MCP Registry, the single source of truth for managing and governing MCP servers.
With Mobius Labs' Aana models, we're bringing deeper multimodal understanding to Dropbox Dash
Dropbox welcomes Mobius Labs to advance Dash’s multimodal AI, integrating Aana’s efficient architecture to enhance photo and video understanding at Dropbox scale.
Half-Quadratic Quantization of large machine learning models
Learn how Half-Quadratic Quantization (HQQ) makes it easy to compress large AI models without sacrificing accuracy—no calibration data required.
Three new features to help build brand momentum with Figma Buzz
With marketing templates that are now connected to your design system, plugins that pull in your favorite apps, and video trimming, we're giving designers and marketers new tools in Figma Buzz.
The road to better completions: Building a faster, smarter GitHub Copilot with a new custom model
Find out about the latest custom models powering the completions experience in GitHub Copilot.
Scaling Privacy Infrastructure for GenAI Product Innovation
How does Meta empower its product teams to harness GenAI’s power responsibly? In this post, we delve into how Meta addresses the challenges of safeguarding data in the GenAI era by scaling its Privacy Aware Infrastructure (PAI), with a particular focus on Meta’s AI glasses as an example GenAI use case. We’ll describe in detail […]
Advancing Our Chef Infrastructure: Safety Without Disruption
Last year, I wrote a blog post titled Advancing Our Chef Infrastructure, where we explored the evolution of our Chef infrastructure over the years. We talked about the shift from a single Chef stack to a multi-stack model, and the challenges that came with it – from updating how we handle cookbook uploads to navigating…
Zero-config backends on Vercel AI Cloud
Build, scale, and orchestrate AI backends on Vercel. Deploy Python or Node frameworks with zero config and optimized compute for agents and workflows.
AI agents and services on the Vercel Marketplace
Agents and Tools are available in the Vercel Marketplace, enabling AI-powered workflows in your projects with native integrations, unified billing, and built-in observability.
Built-in durability: Introducing Workflow Development Kit
The Workflow Development Kit (WDK) makes async workflows in TypeScript reliable, durable, fault-tolerant, and portable across any cloud.
The Today I Learned @CYBERTEC microblog collection has moved!
Included below are links to our PostgreSQL-related tips and tricks: For all other developer tips related to CSS, Javascript, Docker
How we reduced the size of our JavaScript bundles by 33%
From karaoke terminals to AI résumés: The winners of GitHub’s For the Love of Code challenge
This summer, we invited devs to participate in our hackathon for joyful, ridiculous, and wildly creative projects. Here are the winners of For the Love of Code!
Top security researcher shares their bug bounty process
For this year’s Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to put the spotlight on a talented security researcher—André Storfjord Kristiansen!
Ambient Animations In Web Design: Practical Applications (Part 2) — Smashing Magazine
Motion can be tricky: too much distracts, too little feels flat. Ambient animations sit in the middle. They’re subtle, slow-moving details that add atmosphere without stealing the show. In part two of his series, web design pioneer Andy Clarke shows how ambient animations can add personality to any website design.
A deep dive into BPF LPM trie performance and optimization
This post explores the performance of BPF LPM tries, a critical data structure used for IP matching. It delves into the trie algorithm, presents benchmark data, and explains how the current kernel implementation’s design choices lead to performance bottlenecks.
Benefits of a DESCending index
The DESC clause in CREATE INDEX is rarely needed. I'll show use cases for descending indexes, including storage efficiency and performance.
Design systems: From the basics to big things ahead
To prepare for Schema 2025, we combed through Shortcut archives to pull together our design systems greatest hits.
How to update community health files with AI
Have you ever thought about using AI to update community health files for your repositories? This blog shares actionable next steps for doing just that, including a starter kit with a checklist and tutorials on how to create three useful files.
