January 2026 Summaries

Vertical Microfrontends (VMFE) offer a new architectural approach allowing independent teams to completely own and manage specific paths within a web application, such as marketing, documentation, or dashboards, using Cloudflare Workers. This model supports various frameworks and CI/CD pipelines, enabling teams to work autonomously and deploy at their own pace while maintaining a cohesive user experience. Unlike horizontal microfrontends, which distribute parts of a single page across different services, vertical microfrontends divide an application by URL path, empowering teams with full control over their domain’s functionality. This ensures isolated code bases for different sections, preventing regressions caused by changes from other teams, and allows for seamless user transitions between independently managed sections using techniques like CSS View Transitions. The approach helps overcome challenges related to shared code bases and diverse framework requirements, offering users a unified experience despite underlying technical diversities.

The UK's Competition and Markets Authority (CMA) has initiated a consultation on proposed conduct requirements for Google, aiming to address issues of choice and transparency faced by publishers regarding Google's use of their content in generative AI services. These consultations are the first of their kind under the UK's Digital Markets, Competition and Consumers Act 2024, which allows the CMA to designate companies with Strategic Market Status (SMS) and impose conduct requirements to enhance competition. Google, holding a significant market share in search and AI applications, has been designated with SMS, enabling the CMA to propose rules that would give publishers control over the use of their content for AI purposes and ensure proper attribution. However, concerns remain that the proposed rules do not adequately empower publishers to manage their content independently, and suggestions have been made to separate Google's crawlers to prevent the misuse of publisher content. Cloudflare and other stakeholders advocate for stronger measures to ensure fair competition in the AI market and protect the interests of content creators, emphasizing the need for the CMA to enforce solutions that offer genuine control and promote a balanced digital ecosystem.

Moltbot, now renamed OpenClaw, is an open-source AI assistant that can be run on personal hardware or through Cloudflare's infrastructure using a middleware called Moltworker. This setup leverages Cloudflare's enhanced Node.js compatibility, Sandbox SDK for secure isolated code execution, and Browser Rendering for web automation, with persistent storage provided by R2 and security measures through Zero Trust Access. Moltworker acts as a gateway, facilitating integration with AI providers via AI Gateway, which offers centralized control and billing. By running on Cloudflare's Developer Platform, Moltbot benefits from scalable and secure services, enabling complex AI applications to be executed efficiently. The initiative serves as a demonstration of Cloudflare's capabilities, with the implementation open-sourced on GitHub for public deployment and collaboration.

Matrix, a leading decentralized and end-to-end encrypted communication protocol, is traditionally challenging to operate due to its demanding infrastructure requirements. This text explores a proof-of-concept for running a Matrix homeserver on Cloudflare Workers, a serverless architecture that eliminates the heavy operational burden and costs associated with traditional deployments. By porting the Matrix protocol's core logic to Cloudflare Workers, developers can benefit from simplified deployment, reduced costs, lower latency, and enhanced security, including post-quantum cryptography for TLS connections. The architecture leverages Cloudflare's D1 for data persistence, KV for ephemeral state, R2 for media storage, and Durable Objects for real-time coordination, ensuring strong consistency and atomicity, crucial for Matrix's state resolution. This serverless approach not only scales automatically with demand but also provides comprehensive end-to-end encryption, supporting the entire Matrix E2EE stack and OAuth 2.0 for authentication. The project demonstrates the feasibility of running complex decentralized protocols on a cloud-based infrastructure, offering a model for future applications to achieve sovereignty without the infrastructure burden.

In 2025, over 180 Internet disruptions were observed globally due to various causes such as government-ordered shutdowns, cable cuts, power outages, extreme weather, and military conflicts. Key events included a government-directed shutdown in Tanzania during protests, multiple cable cuts affecting connectivity in Haiti, Pakistan, and Cameroon, and power outages impacting Internet services in the Dominican Republic, Kenya, and Ukraine. Severe weather events, such as Hurricane Melissa in Jamaica and Cyclone Senyar in Sri Lanka and Indonesia, caused significant infrastructure damage and Internet disruptions. Technical issues at Internet providers like Smartfren in Indonesia, Vodafone UK, and Fastweb in Italy also contributed to connectivity problems. Additionally, hyperscaler cloud platforms, including Amazon Web Services and Microsoft Azure, experienced service disruptions affecting users worldwide. Cloudflare reported two incidents related to software and database changes, underscoring the importance of real-time data and transparency in addressing such challenges. The Cloudflare Radar Outage Center continues to monitor and provide insights into these disruptions, emphasizing the need for ongoing vigilance in maintaining global Internet connectivity.

On January 22, 2026, Cloudflare experienced a route leak incident stemming from an automated routing policy configuration error at their Miami data center, resulting in unintended BGP prefix leaks that affected both Cloudflare customers and external parties. The incident, lasting 25 minutes, caused congestion on Cloudflare's infrastructure and elevated latency due to IPv6 traffic being incorrectly routed through Miami, with some traffic discarded by firewall filters. The misconfiguration was attributed to a permissive policy change that inadvertently allowed internal routes to be advertised externally, violating the principles of BGP routing as defined in RFC7908. Cloudflare has acknowledged the mistake, apologized to those impacted, and outlined steps for improvements, including patching the routing policy failure, implementing BGP community-based safeguards, and integrating automatic policy evaluations into their CI/CD pipelines. They aim to enhance routing security further by validating equipment against RFC9234 and promoting the adoption of RPKI ASPA to prevent future route leaks.

On October 13, 2025, security researchers from FearsOff identified a vulnerability in Cloudflare's ACME validation logic, which affected some Web Application Firewall (WAF) features on specific ACME-related paths. This vulnerability, reported through Cloudflare's bug bounty program, involved the processing of requests for the ACME HTTP-01 challenge, potentially allowing requests to proceed to the customer origin without proper WAF processing. Cloudflare promptly patched the vulnerability and confirmed no malicious exploitation had occurred, ensuring customers needed no further action. The ACME protocol automates SSL/TLS certificate management by validating domain ownership through a challenge-response process, which Cloudflare manages by disabling certain security features when serving valid tokens to avoid interference with certificate authority validations. In response to the vulnerability, Cloudflare implemented a code change to ensure that security features are only disabled when requests match a valid ACME HTTP-01 challenge token for a hostname. Cloudflare expressed gratitude for the responsible disclosure by researchers and emphasized its commitment to security and transparency, encouraging ongoing community participation in vulnerability reporting to enhance platform security.

Astro Technology Company, known for its web framework Astro, has joined forces with Cloudflare to enhance its capabilities in building fast, content-driven websites. Astro, favored by major brands like Porsche and IKEA, as well as platforms like Webflow Cloud and Wix Vibe, will continue as an open-source project under Cloudflare's stewardship, maintaining its MIT license and open governance structure. Astro's success is attributed to its focus on content-driven, server-first, fast, user-friendly, and developer-focused designs, supported by its unique Islands Architecture that allows for efficient static HTML rendering while integrating client-side frameworks as needed. The upcoming Astro 6, currently in public beta, features a redesigned development server powered by Vite, enabling seamless local and production environments, and introduces stable Live Content Collections for real-time data updates. Cloudflare's acquisition aims to further Astro's growth and innovation while leveraging the strong open-source community and the Astro Ecosystem Fund to support ongoing contributions and development.

Cloudflare has announced the acquisition of Human Native, a UK-based AI data marketplace, to advance the transformation of multimedia content into structured, searchable data. This partnership aims to enhance AI development by offering high-quality, fully licensed data, moving away from unregulated data scraping. Human Native has helped clients, such as a UK video AI company, to achieve better results by using their curated data. The acquisition aligns with Cloudflare's vision to allow content creators more control over how their content is accessed and used by AI systems. With initiatives like AI Crawl Control and Pay Per Crawl, Cloudflare aims to empower content owners to decide how their content is utilized. The collaboration also focuses on developing new economic models for the Internet, including machine-to-machine transactions, through the creation of the x402 Foundation in partnership with Coinbase. The integration of Human Native's expertise is expected to accelerate the development of new tools and models, ensuring that the Internet remains open, fair, and sustainable in the era of AI.

On January 8, 2026, a routine update to the 1.1.1.1 DNS service aimed at reducing memory usage inadvertently caused widespread DNS resolution failures due to a change in the order of CNAME records in DNS responses. This incident highlighted a longstanding ambiguity in DNS protocol specifications, particularly regarding the sequence in which CNAME records should appear relative to other records, an issue rooted in the language of RFC 1034 from 1987. While most modern software is unaffected by the order of DNS records, some implementations, such as Linux's glibc and certain Cisco switches, rely on CNAMEs preceding other records, leading to failures when this order was altered. The incident prompted a reversion of the change and inspired a proposal for a new Internet-Draft aimed at clarifying DNS behavior, which, if accepted, would lead to a formal RFC to eliminate such ambiguities in the future.

In late December 2025, widespread protests erupted in Iran, initially triggered by economic grievances but evolving into demands for political change, coinciding with a nearly complete shutdown of the country's Internet connectivity. This disruption was reminiscent of previous actions by the Iranian government, which has a history of cutting off Internet access during significant protests, such as during the fuel price protests in November 2019 and the demonstrations following the death of Mahsa Amini in September 2022. The current shutdown began with a dramatic reduction in announced IPv6 address space on January 8, effectively isolating Iran from the global Internet, as noted by traffic data from major network providers like MCCI, IranCell, and TCI. Although brief windows of connectivity were observed on January 9 at some universities and through Cloudflare's public DNS resolver, these were short-lived, and the Internet remains largely inaccessible in Iran. Changes in HTTP traffic patterns and the usage of protocols like HTTP/3 and QUIC also preceded the shutdown, suggesting increased filtering and whitelisting efforts. Monitoring of the situation continues, with updates available through Cloudflare Radar and social media platforms.

The newsletter explores a series of BGP route leaks in Venezuela linked to the state-run ISP, CANTV (AS8048), which appear to be due to inadequate routing export and import policies rather than malicious intent. These leaks, characterized by the misrouting of traffic and the redistribution of routes beyond their intended scope, were noted on Cloudflare Radar and involved the transfer of routes from CANTV's provider, Sparkle (AS6762), to another provider, V.tal GlobeNet (AS52320). The analysis suggests that these incidents are common and often result from technical oversights, such as mismatched export policies, rather than deliberate actions. The post emphasizes the importance of implementing path-based validations, like Autonomous System Provider Authorization (ASPA), alongside existing Resource Public Key Infrastructure (RPKI) measures to prevent such anomalies. Additionally, it highlights the need for collaborative efforts to enhance BGP security, including the adoption of RFC9234, which introduces BGP roles and attributes to mitigate route leaks, illustrating the broader context of how routing frameworks can be fortified through collective industry action.