July 2026 Summaries

Cloudflare has introduced a new Media over QUIC (MoQ) provisioning API that adds isolation and access controls to its global MoQ endpoint, enabling users to create isolated relays and issue distinct credentials for publishers and subscribers. This update allows applications to leverage Cloudflare's network without the need for deploying specialized servers, offering a scalable and cost-effective solution for low-latency data streaming. The MoQ protocol, under development at the IETF, supports draft-14 and draft-16 versions with authentication, allowing relays to handle various data types like live video and messaging without needing to understand the data content. By enabling separate access tokens for publishers and subscribers, Cloudflare ensures secure and controlled data distribution, addressing confidentiality and access management concerns. The API is available for free in beta, with Cloudflare actively seeking feedback to refine its features and align with the broader MoQ community's needs.

As of June 23, 2026, cdnjs, a prominent open-source content delivery network for JavaScript and CSS libraries, is now exclusively operating on Cloudflare's Developer Platform, after identifying platform limitations and driving its growth. Initially built in 2011 as a community-driven mirror for open-source libraries, cdnjs is now utilized by approximately 12% of all websites, handling 9 billion requests daily with a 98.6% cache hit rate across over 330 Cloudflare data centers. Despite advancements in web development tools, cdnjs remains vital due to its consistent URL pattern and immutable versions, which are widely embedded in educational resources and favored by AI models for scaffolding HTML demos. The recent migration from a complex, multi-component architecture involving Google Cloud Platform and Cloudflare Workers to a streamlined system running entirely on Cloudflare's platform addressed previous challenges with observability, storage, and pipeline resilience. This transition allows cdnjs to support future possibilities, such as serving modern ES modules, while maintaining its free and open-source nature, with input encouraged from the community for continuous improvement.

Cloudflare has implemented post-quantum authentication for its Authenticated Origin Pulls and Custom Origin Trust Store products, marking a significant step in its roadmap towards full post-quantum security by 2029. This initiative aims to protect against future quantum computer threats that could compromise classical encryption methods. The new capability supports Module-Lattice-Based Digital Signature Algorithm (ML-DSA) signatures to secure connections between Cloudflare and customer origin servers, differentiating in approach from visitor-to-Cloudflare connections. The company has also collaborated with Google and the IETF on developing Merkle Tree Certificates for fast post-quantum web certificates, targeting 2027 for initial deployments. Cloudflare's deployment is ahead of the broader WebPKI implementation, allowing the use of custom PKIs to expedite post-quantum authentication without the typical public infrastructure constraints. The company offers flexible configuration options, enabling customers to upload ML-DSA CAs to the Custom Origin Trust Store and configure Authenticated Origin Pulls with ML-DSA certificates. Furthermore, Cloudflare has updated its control and data plane services to support these new post-quantum features, and plans to integrate future updates as the ecosystem evolves, including anticipated native support for ML-DSA in Go 1.27.

Cloudflare's analysis of Internet disruptions in the second quarter of 2026 highlights the fragility and resilience of global connectivity, documenting significant outages caused by natural disasters, government actions, and infrastructure failures. The longest disruption was due to Super Typhoon Sinlaku near Guam, while frequent shutdowns in Sudan were state-mandated during exams. Iran's restoration of Internet access marked the end of an 88-day blackout, despite ongoing regional conflicts affecting AWS infrastructure. In Germany, a DNSSEC misconfiguration temporarily disrupted access to .de domains, while a cable cut in Saint Lucia significantly impacted connectivity. These events underscore the significant influence of both natural and human factors on Internet stability, emphasizing the need for robust network infrastructure to withstand various disruptions.

Debugging privacy-preserving protocols, such as Oblivious HTTP (OHTTP), can be complex due to the multiple steps and parties involved, as well as the intricacies of binary HTTP encoding. To simplify this process, a new open-source CLI tool named pvcli has been introduced, designed to manage these complexities efficiently and facilitate the debugging process. Released under the Apache-2.0 License, pvcli consolidates various privacy protocols into one tool with a user-friendly interface, supporting the debugging of OHTTP by automating the manual and error-prone processes of parsing and encrypting binary HTTP requests. This tool is inspired by curl and aims to support additional privacy-preserving protocols beyond OHTTP, such as MASQUE and Privacy Pass, while encouraging contributions from developers to further enhance its functionality. Through pvcli, users can perform complete OHTTP requests with ease, significantly reducing the complexity and time involved in identifying and resolving issues within privacy-preserving communication systems.

Border Gateway Protocol (BGP) is the primary routing protocol of the Internet, allowing Autonomous Systems (ASes) to dictate traffic routing via path attributes, including the mandatory ORIGIN attribute, which indicates how a route was introduced into BGP. Despite its intended stability, ORIGIN is frequently manipulated, with studies showing that around 70% of observed paths have altered ORIGIN values compared to the original setting by the originating AS. This manipulation, primarily changing ORIGIN to IGP, affects traffic forwarding decisions, often diverting traffic through specific networks to gain revenue advantages. Investigations reveal that this practice is prevalent among major networks, including Tier-1 ASes, who alter ORIGIN to attract more traffic. Despite being contrary to RFC guidelines, the practice has become widespread, prompting discussions about the relevance of the ORIGIN attribute in modern Internet routing. Some propose setting ORIGIN to IGP universally to mitigate the unfair advantages created by its manipulation, or even deprecating the attribute entirely to ensure fairer and more stable routing practices across the Internet.

Cache Response Rules are a new feature introduced by Cloudflare to enhance caching efficiency by allowing modifications to be made to origin server responses before they are cached. This feature addresses common issues such as unintended headers like Set-Cookie and incorrect Cache-Control directives that prevent content from being cached efficiently, which can increase origin server load and infrastructure costs. Cache Response Rules operate in the response phase, after the origin server has replied but before Cloudflare writes to its cache, enabling adjustments like rewriting Cache-Control directives, managing cache tags, and stripping problematic headers without altering the origin server's code. This addition complements existing Cache Rules that run during the request phase and determine initial caching eligibility. By providing an additional layer of control, Cache Response Rules help optimize caching strategies, improve performance, and reduce unnecessary bandwidth usage.

For nearly a century, the World Cup has been a unifying force worldwide, bringing nations together through their shared passion for soccer, and its impact is evident in the shifts in global online behavior, as observed by Cloudflare's extensive network. During the 2026 tournament, Cloudflare's data revealed significant variations in internet traffic patterns, influenced by the timing of matches and the countries involved. Matches played during off-hours, such as late at night or early in the morning, led to substantial spikes in online activity as fans adjusted their schedules to watch, while games during regular hours saw little change. Notable variations included how different countries behaved during matches, with some showing increased traffic during breaks, likely due to the use of streaming services. Argentina's matches, due to their high-profile status and star players, especially influenced internet traffic globally, and the tournament saw a marked rise in visits to sports betting sites. Highlighting the broader cultural impact, Cloudflare Radar's analysis provides a window into how such international events reshape digital engagement, offering insights into the interplay between global sports events and internet usage.

Cloudflare has announced the general availability of its Internal DNS service, which integrates authoritative and recursive DNS for private networks within the same global network and control plane used for public DNS and other Cloudflare services. This consolidation addresses the complexity and synchronization issues of managing separate DNS systems for public and private networks, as well as the challenges of split-horizon DNS. By running both public and private DNS on a unified platform, Cloudflare simplifies DNS operations, enhances security through Zero Trust policies, and modernizes legacy infrastructure by eliminating the need for hardware appliances and cloud-locked resolvers. The Internal DNS service, which includes components like the Gateway Resolver and Internal Authoritative DNS, allows organizations to manage DNS operations with a single API, audit trail, and policy-setting interface. This integration is part of Cloudflare's broader Connectivity Cloud platform, facilitating consistent DNS experiences across diverse environments and paving the way for tighter integration of networking and Zero Trust policies. Enterprise users of Cloudflare Gateway can access this service without additional costs, streamlining their infrastructure management and enhancing security.

Cloudflare has implemented new Web Application Firewall (WAF) protections to address two critical vulnerabilities in WordPress, namely an Unauthenticated Remote Code Execution (RCE) vulnerability in the REST API and a related SQL Injection vulnerability. These vulnerabilities, present in WordPress versions 6.8 and later, were disclosed to Cloudflare by the WordPress security team before public release, allowing for preemptive deployment of protective rules effective from July 17, 2026. While Cloudflare's protections mitigate risks for sites with proxied traffic, they are not a substitute for applying the official WordPress patches released in version 7.0.2 and relevant backports. WordPress has classified these issues as high-severity and is automatically updating affected sites, though verification of updates is still recommended. Cloudflare has introduced specific rules to detect and block requests exploiting these vulnerabilities, with monitoring and adjustments planned as necessary to address evolving threats. The collaboration between WordPress and Cloudflare aims to enhance security for users before vulnerabilities were publicly exposed.

On July 3, 2026, a failed DNSSEC key rollover by the Albanian communications authority (AKEP) led to DNSSEC validation failures across the .AL top-level domain, affecting access to Albanian government services, banks, and media for users relying on validating DNS resolvers like Cloudflare's 1.1.1.1. This incident mirrored a similar issue with Germany's .DE domain and prompted Cloudflare to apply a Negative Trust Anchor (NTA) to temporarily suspend DNSSEC validation, allowing .AL domains to remain accessible despite losing cryptographic verification against DNS spoofing. During this process, Cloudflare introduced a new Extended DNS Error (EDE) code to signal when responses were served under an NTA, thereby enhancing transparency and addressing a gap in client awareness that had persisted in previous incidents. The response provided insight into both the DNSSEC failure and the application of the NTA, a practice that has been formalized in an Internet-Draft and is being discussed within the IETF DNSOP Working Group to encourage broader adoption by other resolver implementations.

Cloudflare has introduced Precursor, a client-side, session-based verification system designed to enhance bot mitigation by capturing and analyzing user behavior across entire sessions. Unlike traditional methods that focus on isolated checkpoints, Precursor uses dynamically injected JavaScript to continuously collect behavioral signals such as mouse movements and keyboard activity, distinguishing human interactions from automated ones. This system complements the existing Cloudflare Turnstile by extending detection capabilities beyond specific challenges to cover complete user journeys, thereby improving precision in identifying bot activity without increasing friction for legitimate users. Precursor evaluates session-level data and integrates with Cloudflare's bot protection framework, offering a more robust mechanism for detecting fraud and abuse. This new tool is privacy-focused, capturing minimal data necessary for effective detection and ensuring it is not exposed to user accounts or dashboards. Precursor is available for free until its general availability release, allowing users to enhance their existing bot defenses without requiring changes to their applications.

Cloudflare's Smart Tiered Cache system, initially launched in 2021, optimizes data routing by selecting the best upper-tier data center based on real-time latency to enhance cache efficiency. However, traditional latency-based selection faced challenges with public cloud origins that utilize anycast or regional unicast networks, leading to inefficient routing paths or "hairpinning." To address this, Cloudflare introduced a feature that allows users to provide a cloud region hint, enabling the system to map public cloud origins to the appropriate region and select optimal upper tiers, even when the origin IPs appear ambiguous. This enhancement, which is available for free across all plans, fetches the latest IP range files from cloud providers like AWS, GCP, Azure, and Oracle Cloud to dynamically assign upper tiers based on continuous latency probing. By doing so, it aims to reduce latency and improve cache hit ratios for origins on anycast IPs, bridging a significant performance gap reported by customers.

RSA and ECC, long-standing cryptographic algorithms, are at risk from future quantum computers, prompting a shift towards post-quantum cryptography with ML-KEM encryption and ML-DSA signatures, standardized by NIST in 2024. The transition to quantum-resistant cryptography is underway, with Cloudflare already using ML-KEM and aiming for complete post-quantum security by 2029. Despite challenges such as ML-DSA's larger size and performance limitations, efforts continue to develop better algorithms, including promising candidates like FN-DSA and SQIsign, though none are expected to be widely available before 2033. The urgency of the transition is driven by the potential for quantum computers to break current encryption, and the need for diverse cryptographic solutions is emphasized to ensure robust security across various applications. The ongoing NIST competition aids in evolving post-quantum cryptography beyond basic cryptographic primitives, making way for innovations like efficient post-quantum anonymous credentials.

Cloudflare is developing a new distributed consensus service called Meerkat, powered by the QuePaxa algorithm, to address the challenges of maintaining strong consistency and high availability across its global network of data centers. Unlike traditional consensus algorithms like Raft, which rely on a single leader and can suffer from availability issues during leader failures or network delays, QuePaxa allows all replicas to perform writes independently, avoiding the single point of failure. Meerkat is designed to handle control-plane data, ensuring linearizability and fault tolerance even in less stable network conditions, making it ideal for Cloudflare's needs. The system is currently experimental and internal, but Cloudflare plans to release more information about its development and potential applications in future blog posts.

The UK government has introduced the Cyber Resilience Pledge, a voluntary initiative encouraging organizations to enhance cybersecurity governance, accountability at the board level, and comprehensive protection across supply chains. Cloudflare, as a founding signatory, supports this framework, which aligns with its long-standing security principles. The pledge emphasizes democratizing security, leadership accountability, and radical transparency, which are integral to Cloudflare's operations. With an increasing number of cyber threats, including a significant rise in DDoS attacks in the UK, the pledge is timely and seeks to address vulnerabilities like unpatched systems and poor vendor oversight. Cloudflare's approach to cyber resilience involves extensive threat intelligence, network visibility, and integrating security into every business facet. The pledge aims to elevate cybersecurity standards universally, enabling organizations of all sizes to contribute to a safer digital landscape. Cloudflare's commitment to transparency, rigorous supply chain security, and continuous improvement reflects its dedication to making the internet more resilient.

Cloudflare has introduced Workers Cache, a tiered caching system designed to optimize requests processed by a Worker, which is easily configured through a single line of Wrangler configuration and familiar Cache-Control headers. When a cacheable request is made, Cloudflare's cache is checked first; if a fresh cached response exists, it is returned without executing the Worker, thus saving on CPU time. If the cache misses, the Worker runs, and if the response is cacheable, it is stored for future requests. This setup allows subsequent requests from any location to be served directly from the cache, managed through simple configuration and header settings. Additionally, Workers have the ability to purge their own caches when content changes, ensuring that responses remain up-to-date.

A year after introducing the concept of Content Independence Day, Cloudflare has evolved its strategy to empower website owners with more nuanced control over AI bot traffic. Initially focused on blocking AI bots that used content for training without compensation, the approach now recognizes the need for a more sophisticated taxonomy that categorizes bot behaviors into three main use cases: Search, Agent, and Training. This allows website owners to manage AI bot access more precisely, ensuring that they can protect their content while still benefiting from search engine visibility. Cloudflare is also introducing BotBase, a comprehensive database for tracking bot activity, and implementing new default settings that will block certain crawlers by default based on their use case. These changes aim to foster transparency and trust, enabling site owners to understand and control how their content is used by AI, while offering more options to manage automated traffic effectively.

For nearly three decades, the web's search ecosystem was driven by a simple exchange: search engines would crawl content, sending visitors back to creators who could monetize through ads or subscriptions. However, the rise of AI-driven search is altering this dynamic, as AI answers often circumvent direct traffic to the original content, impacting revenue for creators. Cloudflare is responding by introducing new bot options to help site owners control access and by exploring a new economic model for search that compensates creators through initiatives like Pay Per Use. Collaborating with AI companies like Ceramic.ai, Cloudflare is experimenting with payment models that reward content creators based on the actual use of their content, rather than mere crawling frequency. These efforts aim to provide a fairer, more sustainable framework for content discoverability and creator compensation in the evolving web landscape.

Cloudflare has introduced the Monetization Gateway, a new engine that enables customers to charge for any asset protected by Cloudflare, such as web pages, datasets, APIs, or MCP tools, by managing payment policies and access controls through a single control plane. This innovation addresses the shifting economic model of the internet, where traditional methods of monetizing content through advertising and subscriptions are becoming less effective due to the rise of AI agents that consume data without engaging in such systems. The Gateway supports usage-based pricing and leverages stablecoins for micropayments, facilitating transactions that are economically impractical with conventional payment rails. By utilizing the x402 open protocol, the Monetization Gateway aims to streamline payment processes, allowing for frictionless sub-cent transactions directly within HTTP requests, thus expanding revenue opportunities for content creators and service providers. This system is designed to support the evolving digital economy by providing a simple and scalable solution for monetizing digital assets and services, ultimately fostering an agent-first Internet where every useful interaction has a corresponding economic exchange.

One year after Cloudflare's declaration of Content Independence Day, the fundamental economics of the Internet have shifted rapidly, driven by the accelerated adoption of AI technologies and a decline in traditional referral traffic. Cloudflare implemented measures to give site owners control over AI crawler access, creating a new market where content can be monetized through licensing agreements. This shift has led to a significant change in the balance of power, with publishers gaining leverage through scarcity and control, enabling them to negotiate better deals with AI companies. As a result, a licensing economy is emerging, but challenges remain in efficiently matching supply and demand, particularly with Google's mixed-use crawlers complicating transparency and control. Cloudflare's unique position in the market, due to its extensive network and partnerships with leading AI companies, provides insights into the evolving dynamics of the agentic Internet, highlighting the need for improved transparency, real-time signals, and infrastructure to facilitate more efficient content discovery and monetization.

Cloudflare's new Attribution Business Insights dashboard offers website owners a powerful tool to manage and understand the impact of AI bot traffic on their content. As the Internet shifts from an SEO-centric model to a landscape dominated by AI crawlers, publishers are faced with challenges such as reduced referral traffic and increased infrastructure costs. This dashboard provides valuable insights into bot behavior, crawl-to-referral ratios, and the classification of AI crawlers, enabling site owners to differentiate between helpful and harmful bot activity. By offering detailed analytics, the tool empowers decision-makers to strategize effectively, ensuring their content remains secure and their business models viable amidst evolving digital dynamics.