Cloudflare

Global – November 10, 2026 -- The PHP project shipped fixes on October 21 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0 and enabling unauthenticated remote code execution (RCE) over HTTP. Dubbed PHP2Shell, the flaws sit in the language itself, so every application built on PHP inherits the exposure.

Wiz says every PHP version back to 5.4 is affected

Wiz, one of the groups that reported the bugs, says PHP powers 70% of the world's websites. Against Apache with mod_php, the attack works before any application code runs.

GLOBAL – October 27, 2026 -- Cloudflare's Technology Partnerships Program organizes technical integrations and joint sales and marketing around four solution areas: application services, Zero Trust services, network services and developer services.

Partners gain technical integrations and access to joint sales and marketing

Technology partners receive integrations with Cloudflare and can run sales and marketing efforts aimed at mutual customers and prospects. Cloudflare says the integrations are meant to create value for joint customers, its partners and Cloudflare itself.

Application services target apps, APIs and websites via DNS change

Customers can secure and accelerate apps, APIs and websites by pointing DNS to Cloudflare, which switches on performance and security services instantly.

Global – October 26, 2026 -- Cloudflare Registrar sells domain names with no markup, charging registration, transfer and renewal prices at or below what registries and ICANN charge Cloudflare, and supports more than 430 top-level domains.

Cloudflare Registrar removes markups and add-on fees from domain pricing

Cloudflare says registration, transfer and renewal prices are shown upfront, with no hidden fees or required add-ons. Customers pay only the registry and ICANN price, which removes the inflated renewal costs common in the domain market.

The TLD catalog ranges from .com, .net and .org to niche extensions such as .ai, .app and .dev.

Free DNSSEC and default domain locks target hijacking and spoofing

Every domain is locked by default to block unauthorized transfers until the owner unlocks it. One-click DNSSEC is free and uses cryptographic signatures to verify DNS responses, aimed at preventing spoofing and on-path attacks.

Global – October 26, 2026 -- Cloudflare is pitching Cloudflare WAN, a network-as-a-service offering within its Cloudflare One SASE platform, as a way to augment or replace legacy MPLS and SD-WAN deployments with a "light-branch, heavy-cloud" architecture.

Cloudflare WAN shifts network functions from branch hardware to the cloud

Enterprises connect sites through the Cloudflare One Appliance, offered as a physical or virtual unit, which steers traffic onto the Cloudflare network. Cloudflare WAN then enforces Cloudflare One security policies and delivers traffic to other sites, Internet applications and cloud workloads. The company says traffic can be on-ramped in minutes using zero-touch configuration, with connectivity and security managed from a single interface.

Global – October 26, 2026 -- Cloudflare prices its Workers serverless platform at $0.30 per million requests and $0.02 per million CPU milliseconds, billing for execution time rather than idle time spent waiting on I/O.

Workers drops pre-provisioned concurrency fees

The pricing table also lists 100,000 requests per day and 10 ms of CPU time per request. Cloudflare says customers pay no markup for concurrency and do not pay for pre-provisioned capacity, so launch-day traffic scales with demand. The platform scales from zero to millions of requests.

Isolate architecture removes cold starts across 335+ cities

Workers run on isolates, which Cloudflare describes as an order of magnitude more lightweight than containers. The company states the platform has no cold starts. Code deploys by default to Cloudflare's 335+ cities, while Smart Placement runs functions near a customer's data to cut end-to-end latency.

Global – October 25, 2026 -- Cloudflare's PowerUP partner program offers four distinct partner models and ties partner benefits to three performance criteria, with Zero Trust bundles as an early commercial focus.

Four partner models cover resale, managed services, distribution and consulting

Resell partners sell or integrate Cloudflare products into customer solutions. Manage partners build, sell and remotely manage Cloudflare-based services. Distribute partners give resell and manage partners access to Cloudflare products, services and support. Consult partners provide services and refer customers to Cloudflare, without reselling solutions or managing services.

Global – October 25, 2026 -- Cloudflare provides free cyber security protection to more than 2,900 vulnerable Internet properties through Project Galileo, its program for human rights, civil society, journalism and democracy organizations targeted by DDoS and other cyber attacks.

Cloudflare launched Project Galileo in 2014 after attacks on vulnerable targets

Founded in 2014, the program was a response to devastating cyber attacks against humanitarian organizations, civil society groups and human rights defenders. Cloudflare notes that these organizations often face powerful, entrenched opponents while operating on limited budgets.

Journalists, social activists and minority groups flooded with malicious traffic risk being knocked offline.

San Francisco – October 25, 2026 -- Cloudflare will accept private network interconnect (PNI) requests only from networks that exchange more than 10 Gbps of peak traffic with it in a single location, according to its peering policy dated October 25, 2026.

Cloudflare applies an open peering policy across 335 cities

AS13335 runs a global anycast network spanning more than 335 cities in over 125 countries. Cloudflare will peer with networks that share a presence in mutual locations, and it may grant exceptions to the policy.

All peers must run 24x7 NOCs and secure BGP sessions

Every peer must keep a complete, current PeeringDB entry listing accurate peering locations, IPv4 and IPv6 prefix limits and contact details. Cloudflare uses the record for automated provisioning and network notifications. Peers must also operate a 24x7 Network Operations Center that responds to peering issues.

Global – October 25, 2026 -- Cloudflare is pitching Workers AI as a serverless inference platform that bills only for usage, at $0.011 per thousand neurons, and runs 50+ models across 200+ cities.

Cloudflare targets idle GPU spend with usage-based billing

Cloudflare argues that inference demand is spiky, unlike training. It cites average GPU utilization of only 20-40%, with one-third of organizations below 15%. Workers AI removes hardware commitments, GPU management and capacity planning, so customers pay only for inference they run.

The pricing page lists 10,000 neurons per day alongside the $0.011 per thousand neurons rate.

Platform exposes Kimi K2.6, GLM 4.7 Flash, GPT-OSS-120B and Llama 4 Scout through one API

The catalog includes:

Global – October 25, 2026 -- Cloudflare's Learning Center covers 16 topic areas, from DDoS attacks and DNS to AI, SASE and domain registration, according to the resource index.

Security guides cover DDoS, bots, email and web applications

The DDoS guide describes a network of computers working in tandem to overflow an access point and block legitimate users from a service. The bots guide separates helpful automated applications from malicious ones that can harm sites and applications.

The web application security guide calls for a holistic approach to mitigating attacks. The email security guide covers preventing email-based cyber attacks, protecting accounts from takeover and securing message contents. The SSL guide describes the protocol, known today as TLS, as an encryption protocol running on top of HTTP to protect communication between servers and clients.