September 2026 Summaries

Fastly and Google Cloud have introduced the Autonomous Edge Defense Agent (AEDA) in Gemini Enterprise, an AI-powered incident-response tool designed to help security teams investigate spikes in errors and other edge anomalies more quickly. AEDA combines Fastly’s real-time request telemetry, global traffic patterns, and edge controls with Gemini Enterprise’s reasoning capabilities to analyze structured network data alongside unstructured threat intelligence. When triggered, it can generate potential root-cause hypotheses, run automated tests across Fastly data sources and origin infrastructure, and recommend actions such as rate limits, WAF updates, or origin shielding changes with supporting evidence and implementation guidance. The system also compares an organization’s activity with anonymized aggregated traffic to distinguish isolated production issues from broader coordinated attacks. Fastly positions the tool as a way to reduce alert fatigue, shorten mean time to resolution, support compliance reporting, and measure business impacts such as malicious traffic absorbed and origin costs avoided; it is available through an early-access preview.

Fastly’s 2025 Sustainability Report describes progress toward decarbonization, including fulfillment of its commitment to cover non-renewable electricity use across its global network and offices with environmental attribute certificates, contributing to a 94% year-over-year reduction in market-based Scope 1 and 2 emissions and a 3% decline in total market-based emissions. The company also reported declining carbon intensity as revenue grew faster than emissions and obtained independent limited assurance for portions of its greenhouse-gas inventory and validation for its customer sustainability dashboard. Market-based Scope 3 emissions rose 13%, prompting Fastly to map supplier-level emissions and develop reduction plans addressing electricity, supply chains, and business travel. The report also discusses edge computing as a potential way to reduce AI-related energy demands, alongside an internal AI policy emphasizing appropriate tool use, data restrictions, and human review. Beyond carbon, Fastly highlighted more than $16 million in in-kind support for open-source projects and nonprofits through its Fast Forward program, as well as community technology education initiatives.

Fastly reports that AI-generated traffic is growing 6.5 times faster than human traffic and became the majority of traffic on its network in July 2026, creating visibility, cost-management, performance, and security challenges for enterprise infrastructure teams. Its expanded Fastly for AI portfolio includes AI Runtime Control, which records AI and LLM calls, maps them to keys and sessions, supports spending and rate limits, tracks token costs, provides searchable logs, and can fail over between model providers without code changes. AI Firewall adds edge-based inspection intended to detect malicious prompt instructions before they reach models, complementing Fastly’s broader web application, bot, DDoS, and API security products. The company also introduces API Security schema enforcement, which validates live API requests against published schemas and can either block or log nonconforming requests, aiming to help organizations manage unpredictable AI-agent activity as well as conventional API traffic.

Fastly has introduced AI Runtime Control (ARC), a centralized control plane for managing application and agent interactions with large language model providers as AI traffic grows substantially faster than human traffic. ARC routes model calls through a Fastly-managed endpoint while allowing organizations to retain their existing provider accounts and rates through a bring-your-own-key model. It aims to replace fragmented tools and shared API keys with per-application virtual keys, real-time usage and cost attribution, model-use policies, budget limits, rate limiting, and searchable request and response logs. ARC also includes optional AI Firewall protections against threats such as prompt injection and supports automatic retries and failover across model providers to improve reliability. Fastly positions ARC as a foundation for governing, securing, auditing, and scaling enterprise AI workloads similarly to production infrastructure.

Rising bot and AI crawler traffic increasingly affects both origin servers and CDN caches, creating security, performance, and content-control challenges for websites. Fastly argues that organizations should use a selective bot policy rather than block all automation, allowing beneficial search engines and LLM crawlers while blocking malicious actors and challenging excessive scraping based on identity and behavior. Fastly Bot Management provides dashboard visibility into bot categories, traffic patterns, and anomalous activity, enabling users to create and adjust rules that allow, block, rate-limit, or challenge specific bots at the network edge. ContentGuard extends these controls to cached CDN content, addressing the need to protect content regardless of whether it is served from an origin server or cache. Together, the tools are presented as a way for businesses to retain consent-based control over automated access while preserving indexing, AI visibility, and potential content monetization opportunities.

Stripe and Tempo’s Machine Payments Protocol (MPP) extends HTTP 402-based machine payments from single paid requests to streaming and usage-based services, allowing payment authorization to remain connected to delivery over time. An experimental Fastly Compute demo compares a Stripe Shared Payment Token flow, which uses `intent=charge` to preauthorize a fixed $0.50 budget before a ten-unit stream begins, with a Tempo flow using `intent=session`, where a payment channel’s cumulative authorization increases as each unit is consumed. Both approaches provide similar browser-visible streaming events, but Stripe meters delivery within one preauthorized PaymentIntent while Tempo natively associates payment with incremental consumption and settles when the session closes. The Tempo implementation uses Fastly Fanout to retain a long-lived browser connection while Compute processes bounded payment and delivery requests, with KV Store preserving session state. Potential applications include AI output, premium data feeds, licensed crawling, and multi-step processing services, although the demo is not production-ready and would require secure secret storage, atomic state management, replay protection, spending controls, rate limits, observability, idempotency, and policies for interrupted streams or unused funds.

Fastly has introduced a Challenge action for its DDoS Protection service to help organizations maintain security during high-traffic events such as sales, major sports streams, or product launches without incorrectly blocking legitimate users. The option can be applied at either the service or rule level and uses Dynamic Challenges to tailor responses based on request context, providing low-friction background JavaScript challenges for likely human users, CAPTCHAs for malicious bots, and optimized treatment for API traffic. Fastly can also validate some human traffic through Private Access Tokens without requiring a traditional challenge. The feature is intended for organizations expecting sudden legitimate traffic surges that could resemble DDoS attacks, allowing them to reduce false-positive blocking while continuing to mitigate application-layer volumetric threats.

Sansec identified CVE-2026-75650, an unauthenticated server-side template injection vulnerability in Adobe Commerce and Magento that can lead to remote code execution and was reportedly exploited before Adobe released partial fixes in APSB26-146 on September 7, 2026. Known as “Style Smuggler,” the attack chain uses several requests to place PHP code into a Magento log file, insert crafted template directives into a guest cart address, and trigger failed-payment email processing to instantiate arbitrary classes and include the poisoned log file. The vulnerability arises from template-filter behavior that can improperly propagate signed directives and from pre-patch handling that permits block directives to create classes beyond intended block types. Researchers noted that alternative methods and gadget chains may exist, while providing a Nuclei detection template tested against multiple Magento versions. Fastly has also issued an optional virtual patch designed to block each stage of the exploit chain and provide interim protection while organizations apply official updates.

Modern DDoS attacks increasingly use brief, high-volume traffic bursts that can end before security teams can respond manually, making automated mitigation essential. Fastly highlights Khan Academy, Yottaa, and Magnolia as users of its DDoS Protection and Adaptive Threat Engine, which establish traffic baselines, distinguish legitimate demand spikes from attacks, and block malicious traffic in near real time. Khan Academy reports automatically stopping a traffic spike exceeding 17,000% amid ongoing bot activity, Yottaa uses the service to protect more than 1,500 ecommerce storefronts from short-lived attacks during critical sales periods, and Magnolia applies shared protections across hundreds of customers while maintaining a 99.9% uptime SLA. Across these examples, Fastly presents automation, low false-positive rates, and edge-based security tools as ways to reduce operational disruption while preserving availability.

Common Media Client Data (CMCD) was created to bridge the gap between video-player telemetry and CDN logs by attaching standardized key/value data to media requests, enabling streaming operators to correlate buffering, quality changes, network conditions, CDN performance, and viewer sessions across devices and providers. CMCDv1 also supports request hints that can help CDNs prefetch likely subsequent content, and its open adoption has improved interoperability among players, CDNs, and monitoring platforms. CMCDv2 remains backward-compatible with this Request Mode while expanding its metrics and adding Response Mode, which reports post-download information such as time to first and last byte and HTTP response codes, and Event Mode, which captures asynchronous playback events such as pauses, backgrounding, and manual quality changes. New measures include buffer targets, degradation severity and frequency, and distinctions between main content and advertising segments. Adoption may require updated player and analytics support, careful event selection and data-pipeline planning due to increased telemetry volume, and consideration of ad blockers when data is sent directly to third-party endpoints.

Fastly has introduced Direct Fetch, an S3 server-side transfer API that moves data from S3-compatible sources directly into Fastly Object Storage without routing objects through a customer’s local client. Unlike conventional tools such as rclone, which require downloading and re-uploading data over potentially constrained public internet connections, Direct Fetch uses Fastly’s network to fetch source objects and synchronously write them to a destination bucket. Clients initiate transfers by submitting empty PutObject or UploadPart requests containing a source URL in the fastly-object-storage-source-url header, while pre-signed URLs can support transfers of private assets without sharing long-term credentials. The feature also supports byte-range requests for multipart uploads when the source returns HTTP 200 or 206 responses, and is available immediately for migrations into Fastly Object Storage.

CVE-2026-82329 is a critical unauthenticated authentication-bypass flaw in self-hosted JFrog Artifactory that allows attackers to forge a JWT using a deterministic empty join key, access the cluster-join endpoint, and ultimately obtain a non-expiring platform administrator token. Because Artifactory commonly stores software artifacts and credentials, successful exploitation can enable supply-chain tampering, unauthorized user and repository creation, and credential theft. After JFrog disclosed the flaw on August 28, 2026, observed activity progressed from minimal probing to widespread automated scanning following the release of a public proof of concept, peaking at roughly 406,000 attempts on September 2; most traffic involved indiscriminate mass scanning, while lower-volume actors made more focused exploitation attempts. Organizations should immediately upgrade to a fixed Artifactory version, enable Fastly’s virtual WAF patch where available, rotate join keys, revoke tokens issued since disclosure, and audit for unauthorized administrative changes, since patching alone does not invalidate previously minted tokens. Defenders should investigate requests to Artifactory’s registry join endpoints, particularly successful HTTP 201 responses involving the SHA-256 hash of an empty string as the JWT key ID, which is presented as a high-confidence compromise indicator.

Fastly Log Analytics is an open-source, self-hosted log analytics system designed to let Fastly customers store, search, filter, and visualize raw request-level logs without relying on external providers such as Splunk or Grafana. Built around Fastly’s S3-compatible Object Storage, it streams configurable JSON logs into customer-controlled encrypted buckets, converts them into optimized Apache Iceberg and Parquet data, and uses DuckDB to power local interactive dashboards without a separate database server. The tool includes traffic views, geographic maps, raw-log filtering, top-field aggregations, CMCD streaming-media metrics, and 45 anomaly detectors covering security, origin health, edge performance, network paths, and traffic volume. Deployment is intended to be simple through Docker Compose and an automated provisioning wizard, although users need a Fastly account, Object Storage, a VCL service, and a superuser API key. There is no license fee, but users pay Fastly Object Storage and CDN egress costs, which can be managed through configurable logging, sampling, caching, batching, and a built-in cost estimator. The project is actively developed but is not an officially supported Fastly product and has not yet been tested at extreme request volumes.

Anthropic’s emerging Model Hardware Standard, based on lessons from the Model Context Protocol, aims to provide a shared way for AI agents to safely control physical equipment such as robot arms, laboratory instruments, and manufacturing machinery. Unlike software-focused agent protocols, hardware control introduces higher risks because delayed or repeated commands can damage materials, wear out devices, or compromise scientific experiments. Building on its edge MCP implementation, Fastly has developed a research prototype that retains existing authentication, authorization, and schema-validation capabilities while adding device-specific safety-limit checks, per-device command quotas, and privacy-conscious audit trails. Although the standard remains in an early stage, the work highlights the need for reliable network performance, strong end-to-end security, and coordinated controls across software and physical systems as AI agents increasingly interact with real-world hardware.

Fastly’s Next-Gen WAF and VCL can be configured to protect an origin from automated traffic while preserving marketing attribution that might otherwise be lost when users complete browser challenges. The approach addresses a common issue in which a post-challenge page reload replaces the original external Referer with the challenge URL, causing analytics platforms such as Google Analytics to misclassify traffic as direct. An NGWAF rule identifies suspicious requests and returns a 456 status while checking for an invalid challenge token to prevent verification loops, and VCL intercepts that response to serve a custom synthetic HTML challenge page. The embedded page includes Fastly Bot Management challenge scripts, client-side detection, Google Tag Manager or Google Analytics tracking, and JavaScript that reloads the requested page after verification succeeds. By handling the workflow at the edge, the method aims to provide a seamless visitor experience, retain accurate source attribution, and reduce unnecessary requests to the origin.