Cloudflare Birthday Week 2026 recap: 46 announcements covering post-quantum CA, WAF AI red-teaming, Threat Signals and agent tooling
Cloudflare published its Birthday Week 2026 wrap-up, listing 46 product and platform announcements made between September 28 and October 2. The article is vendor product news and describes no incident, vulnerability or active threat. Security-relevant items include Cloudflare's plan to become a public certificate authority issuing Merkle Tree Certificates, and its target of completing its post-quantum migration by 2029. It also announced post-quantum visibility in analytics and logs, and an IETF extension to prevent quantum downgrade attacks on IPsec. Other launches cover Application Profiles, Threat Signals, and Account Abuse Protection. The remaining announcements concern developer platform, AI agent monetization and observability.
Technical Details
- Certificate authority: Cloudflare intends to become a public CA and issue free Merkle Tree Certificates for post-quantum authentication.
- Post-quantum migration: CryptoLabe uses AI to find and classify cryptography in Cloudflare's codebase. The migration is targeted for completion by 2029. HTTP Analytics, Log Explorer and Logpush now show whether requests negotiated post-quantum key exchange. Workers adds opt-in Web Crypto support for ML-KEM and ML-DSA.
- IPsec: Cloudflare helped develop an IETF extension that authenticates the full IKEv2 transcript to prevent downgrade of post-quantum IPsec tunnels.
- WAF testing: An adaptive AI red-team system built on frontier AI models found WAF detection gaps across six attack categories. Cloudflare used the findings to improve normalization and managed rules.
- Application security: Application Profiles learn the expected structure of HTTP requests to enforce positive security. Threat Signals converts open-source threat reporting into structured indicators linked to WAF rules, and the Threat Events Platform expands to every account.
- Abuse investigation: Account Abuse Protection uses stateful analysis and privacy-preserving Hashed User IDs to investigate credential stuffing and fake-account creation.
- Plugin isolation: EmDash, an open-source CMS, runs plugins in isolated Worker sandboxes with explicitly approved capabilities.
Remediation
No remediation is required. Defenders using Cloudflare may evaluate the new post-quantum visibility, Application Profiles and Threat Signals features.
Linha do tempo
-
Cloudflare Birthday Week 2026 recap: 46 announcements covering post-quantum CA, WAF AI red-teaming, Threat Signals and agent tooling
ler a análise desta fonte ocultar
Cloudflare published its Birthday Week 2026 wrap-up, listing 46 product and platform announcements made between September 28 and October 2. The article is vendor product news and describes no incident, vulnerability or active threat. Security-relevant items include Cloudflare's plan to become a public certificate authority issuing Merkle Tree Certificates, and its target of completing its post-quantum migration by 2029. It also announced post-quantum visibility in analytics and logs, and an IETF extension to prevent quantum downgrade attacks on IPsec. Other launches cover Application Profiles, Threat Signals, and Account Abuse Protection. The remaining announcements concern developer platform, AI agent monetization and observability.
Technical Details
- Certificate authority: Cloudflare intends to become a public CA and issue free Merkle Tree Certificates for post-quantum authentication.
- Post-quantum migration: CryptoLabe uses AI to find and classify cryptography in Cloudflare's codebase. The migration is targeted for completion by 2029. HTTP Analytics, Log Explorer and Logpush now show whether requests negotiated post-quantum key exchange. Workers adds opt-in Web Crypto support for ML-KEM and ML-DSA.
- IPsec: Cloudflare helped develop an IETF extension that authenticates the full IKEv2 transcript to prevent downgrade of post-quantum IPsec tunnels.
- WAF testing: An adaptive AI red-team system built on frontier AI models found WAF detection gaps across six attack categories. Cloudflare used the findings to improve normalization and managed rules.
- Application security: Application Profiles learn the expected structure of HTTP requests to enforce positive security. Threat Signals converts open-source threat reporting into structured indicators linked to WAF rules, and the Threat Events Platform expands to every account.
- Abuse investigation: Account Abuse Protection uses stateful analysis and privacy-preserving Hashed User IDs to investigate credential stuffing and fake-account creation.
- Plugin isolation: EmDash, an open-source CMS, runs plugins in isolated Worker sandboxes with explicitly approved capabilities.
Remediation
No remediation is required. Defenders using Cloudflare may evaluate the new post-quantum visibility, Application Profiles and Threat Signals features.