June 2025 Summaries

Cloudflare is celebrating Micro-, Small, and Medium-sized Enterprises Day by highlighting its support for startups and small businesses using its platform to build, scale, and deploy serverless applications directly on its global network. The company has put an emphasis on supporting startup and small business communities through free developer tools and programs such as Cloudflare for Startups, Workers Launchpad, and the Dev Alliance. These efforts aim to provide entrepreneurs with the necessary resources to turn their ideas into real-world impact. Cloudflare proudly supports over hundreds of thousands of small businesses using its services, including SaaS startups, health and wellness providers, and global service providers. The company is also working with civil society partners in the Asia-Pacific region to help provide security training for new businesses. To address the pressing concern of security for small businesses, Cloudflare is releasing a brand new Cloudflare Small Business Security Guide, providing step-by-step instructions on how to better understand cyber security services and protect their business and customers from common cyberattacks. With its robust security services available free of charge, Cloudflare aims to help build a better Internet and its identity as a company.

Throttling of internet traffic in Russia, affecting Cloudflare users, has been reported since June 9, 2025, with ISPs such as Rostelecom and Megafon implementing throttling mechanisms including packet injection and blocking. The throttling limits the amount of content served to 16 KB, rendering many websites barely usable. This action is consistent with Russia's efforts to isolate its internet within its borders and reduce reliance on Western technology. Cloudflare has not received formal communication from Russian government entities about the motivation for this action, but external reports corroborate their analysis. The impact is seen across connections initiated from inside Russia, even when reaching Cloudflare servers outside of Russia, with some service providers also affected by throttling or other disruptive actions.

The development of scalable video conferencing applications often begins with WebRTC's peer-to-peer setup, but scalability challenges necessitate the use of Selective Forwarding Units (SFUs) to manage data transmission and bandwidth efficiently. Cloudflare's Orange Meets, an open-source video chat application, integrates SFUs and emphasizes privacy through end-to-end encryption (E2EE), implemented using Messaging Layer Security (MLS), a standardized protocol for secure group communication. Unlike traditional methods, Orange Meets' E2EE design considers the ephemeral nature of video calls and uses a designated committer algorithm to manage group membership securely, verified with TLA+ for protocol correctness. The system also addresses potential security concerns, such as monster-in-the-middle attacks, by incorporating safety numbers for cryptographic state verification and exploring future enhancements like Web Application Manifest Consistency for preventing malicious JavaScript. This innovative approach allows for secure, scalable video conferencing without extensive server modifications, showcasing Cloudflare's commitment to privacy and open-source development.

Cloudflare's blog post explores the integration of OpenAI's Agents SDK and Cloudflare's Agents SDK to create a powerful environment for developing intelligent agents. While OpenAI's SDK equips agents with cognition, planning, and tool orchestration capabilities, it requires developers to provide their own runtime and state management. Cloudflare's SDK, however, offers a robust execution layer that abstracts infrastructure details, allowing agents to run persistently and scalably across a global network. The post discusses architectural patterns like multi-agent systems, human-in-the-loop interactions, and addressable agents, showcasing how agents can be composed into modular, intelligent systems capable of real-time coordination and long-term memory retention. By leveraging Cloudflare's Durable Objects, developers can build agents with persistent identity and state, facilitating multi-turn interactions and complex workflows. The blog emphasizes the potential of combining these SDKs to create distributed and intelligent AI agents, inviting developers to explore the capabilities further through Cloudflare's resources and community.

Cloudflare has introduced Cloudflare Containers, now available in beta for users on paid plans, allowing developers to run various applications alongside Workers and enhancing the capabilities of Cloudflare’s Developer Platform. These containers enable media processing, backend services in any language, and CLI tools, integrating seamlessly with Workers for a straightforward workflow. Developers can easily configure and deploy containers globally without managing multiple configurations, using tools like wrangler for deployment and observability features for monitoring performance and resource usage. The platform supports scalable, on-demand container instances, which start quickly to ensure minimal user waiting time. Pricing is transparent, based on usage, with provisions for scaling to zero, and future enhancements include higher limits, autoscaling, and improved communication between containers and Workers. Cloudflare aims to expand these features, integrating further with its Developer Platform to offer more functionality, such as easier access to other Cloudflare services like R2 and Hyperdrive.

The United States National Institute of Standards and Technology (NIST) has been instrumental in promoting Zero Trust Architecture (ZTA) through its publications, particularly with the release of SP 1800-35, which outlines practical steps and best practices for implementing ZTA. This publication focuses on Enhanced Identity Governance (EIG) approaches, detailing a reference architecture that involves key components such as Policy Enforcement Points (PEP), Policy Engines (PE), and Policy Decision Points (PDP). Cloudflare's Zero Trust platform is highlighted as a compatible solution that integrates with other vendors to support this architecture, offering features like FedRAMP compliance and post-quantum cryptography readiness. The platform provides robust security through its global network, enabling secure access to resources, whether on-premises or in the cloud, while facilitating the adoption of Zero Trust principles. Cloudflare's approach ensures that access requests adhere to stringent security policies, thereby enhancing compliance and reducing risks in line with NIST's guidelines.

In mid-May 2025, Cloudflare autonomously blocked a record-breaking Distributed Denial of Service (DDoS) attack that peaked at 7.3 terabits per second (Tbps), surpassing previous records by 12%. This attack targeted a hosting provider customer using Cloudflare's Magic Transit to protect their IP network. The massive attack, delivering 37.4 terabytes in just 45 seconds, utilized a multivector approach primarily consisting of UDP floods, with minor contributions from other reflection and amplification attack types. Originating from over 122,145 source IP addresses across 161 countries, the attack predominantly came from Brazil and Vietnam. Cloudflare's global network, leveraging its autonomous detection and mitigation systems, managed to block the attack across 477 data centers worldwide without human intervention. The company's advanced techniques, such as real-time fingerprinting and the distribution of threat intelligence, underscore its commitment to improving Internet security and offering free unmetered DDoS protection.

Cloudflare has introduced a seamless deployment option for remote Model Context Protocol (MCP) servers, which aligns with the latest MCP standards, facilitating companies like Atlassian, Linear, and PayPal to enhance AI-powered service integrations. The initiative includes open-sourcing two tools: "use-mcp," a React library designed to simplify the connection to remote MCP servers while handling transport, authentication, and session management, and "AI Playground," a chat interface platform leveraging large language models and supporting the latest MCP standards. "Use-mcp" enables developers to effortlessly build and deploy MCP clients by abstracting complexities such as connection management, authentication, and tool discovery. The AI Playground, built on Workers AI, serves as a customizable platform to test MCP server connections and capabilities, offering debugging and monitoring features to ensure seamless integration and interaction with remote MCP servers. By contributing these tools to the MCP ecosystem, Cloudflare aims to foster community collaboration, enabling developers to innovate and enhance the MCP landscape.

Cloudflare has announced the General Availability of Cloudflare Log Explorer, a product designed to offer enhanced observability and forensics capabilities directly within the Cloudflare dashboard. Leveraging Cloudflare's global network, Log Explorer provides security teams and developers with real-time threat detection and application performance optimization without the need for third-party analytics tools, thereby reducing costs and complexity. It enables faster detection and triage of security incidents with direct access to Cloudflare-native logs, offering accelerated investigations through comprehensive context. Users can create custom dashboards using a natural language interface to monitor specific metrics, such as Remote Code Execution attacks, and utilize Log Search for in-depth inquiries with data type-aware filters and a custom SQL interface. Log Explorer supports collaborative investigations with saved queries, and upcoming features like custom alerting and flexible retention will further enhance its utility. Built on Cloudflare R2 storage and utilizing Apache Parquet and Delta Lake technology, Log Explorer efficiently manages log storage at scale, overcoming challenges related to data fragmentation and improving query performance by optimizing file compaction based on log timestamps.

Cloudflare's Project Galileo initiative is celebrating its 11th anniversary in June 2025, marking a decade of providing free cybersecurity protection to vulnerable organizations working in the public interest around the world. The project supports independent media and human rights groups, community activists, and others often targeted for their essential work in human rights, civil society, and democracy building. In recent years, there has been a growing trend in DDoS attacks against these organizations, with Cloudflare blocking 108.9 billion cyber threats between May 1, 2024, to March 31, 2025, representing an average of nearly 325.2 million cyber attacks per day over the 11-month period. The organization has onboarded new partners in Asia and expanded its commitment to digital rights in the region. Cloudflare is also providing training and workshops to help local civil society organizations in Taiwan manage their website infrastructure and address vulnerabilities such as DDoS attacks. The project aims to support more than 34 local civil society organizations in Taiwan by providing training and workshops to help them manage their website infrastructure, address vulnerabilities such as DDoS attacks, and conduct ongoing research to tackle the security challenges these communities face.

The Cloudflare team suffered a significant service outage on June 12, 2025, affecting multiple critical services including Workers KV, WARP, Access, Gateway, Images, Stream, and others. The outage was caused by a failure in the underlying storage infrastructure used by Workers KV, which is a critical dependency for many Cloudflare products. The incident lasted for approximately 2 hours and 28 minutes, globally impacting all Cloudflare customers using affected services. The team had to rely on third-party cloud providers, which experienced an outage, directly impacting the availability of their KV service. As a result, various services such as Access, Gateway, WARP, and others were impacted, with some experiencing significant errors or failures. Despite being a failure on Cloudflare's part, the company acknowledged that the proximate cause was a third-party vendor failure. The outage did not result in data loss, but users experienced disruptions to various services including logins, authentication, and proxy functionality. The incident highlighted the importance of designing and building services with resilience in mind, as well as the need for careful dependency management. Cloudflare is taking steps to improve the resiliency of affected services, including accelerating existing planned work on improving Workers KV's redundancy and implementing new tooling to mitigate future incidents.

The addition of the FinalizationRegistry API in Cloudflare Workers allows developers to request a callback when a JavaScript object is garbage-collected, which can be useful for managing external resources like memory allocated by WebAssembly. However, using it directly is not recommended due to its non-deterministic nature and potential risks. Instead, developers should use explicit resource management features like the `using` syntax and deterministic cleanup logic to manage critical resources safely and reliably. The Explicit Resource Management proposal provides a more predictable way to handle resources needing manual cleanup, and its adoption is expected to become widespread in the JavaScript ecosystem. While FinalizationRegistry may not be obsolete, it remains a valuable fallback for specific use cases where explicit disposal isn't practical. By using both ERM and FinalizationRegistry together, developers can create a more reliable foundation for managing memory across the JavaScript and WebAssembly boundary.

This guide demonstrates how to build an AI agent chat experience with a multiplayer human-in-the-loop workflow using Knock and the Cloudflare Agents SDK. The workflow involves sending approval messages to users via multiple channels, deferring tool calls, and resuming them when approvals are received. The guide showcases how Knock's workflow builder and notification engine can be used to create sophisticated cross-channel messaging for agents, while the Durable Object abstraction provides a globally addressable agent process that's easy to yield and resume back to. The serverless nature of the underlying Durable Object allows for horizontal scaling to support a large number of users with no effort.