GoKawiil
Tech News
Cloudflare has launched support for the HTTP Vary response header within its Cache Rules feature, available to customers on every service tier. The update lets origin servers specify which request headers may affect a response, while giving Cloudflare customers control over how those variations are handled in caching—whether by normalizing header values, preserving exact values, or bypassing the cache entirely.
Security researchers at Manifold Security found that third-party.com, a domain frequently used as a generic placeholder in developer documentation and code samples, now hosts a fake Cloudflare verification page. BleepingComputer confirmed the page mimics a 'Performing security verification' CAPTCHA that copies a malicious PowerShell command to a user's clipboard, then instructs them to paste and run it via Windows key + R, which downloads and executes malware from an external URL.
Microsoft and partners including Cloudflare, Coinbase, OpenAI, SpyCloud, TRM Labs and Health-ISAC disrupted EvilTokens, a phishing-as-a-service platform that used AI to scan compromised inboxes and craft tailored lures. The operation had compromised over 12,000 inboxes across more than 10,000 organizations worldwide, spanning sectors like healthcare, finance and higher education. The takedown seized 50 sites and disabled 150 domains, and UK police arrested two men, aged 32 and 38, after Microsoft shared intelligence with the Metropolitan Police's cybercrime unit.
Cloudflare announced that Python Workers, the runtime it introduced two years ago to run Python code on its edge network, is now generally available. Developers can use existing Python code and popular frameworks like FastAPI, Django, and Flask, and connect them to Cloudflare services such as Workers AI, R2, D1, Hyperdrive, Durable Objects, Queues, and Workflows.
Developers on Hacker News and X recently rediscovered Cloudflare's Quick Tunnels tool, which lets anyone expose a local server to the internet with a single command—no account, DNS setup, or router configuration needed. The feature, built by a summer intern and shipped in 2021 under the Argo Tunnel lineage, generates a temporary public URL at trycloudflare.com that disappears once the process is stopped. Cloudflare recently refreshed its marketing for the tool, now pitching it for AI coding agents that need a reachable endpoint for locally running code.
Cloudflare re-tuned the hash-mapping algorithm its Pingora framework uses to route URL requests to cache servers, drastically reducing the number of hash entries needed per server. The optimization freed up roughly 100 terabytes of RAM across its infrastructure, marking a second major memory-saving effort by the company.
Cloudflare engineers found that its internal load-balancing service, Pingora Backend Router, was consuming far more memory than necessary in its pingora-ketama consistent-hashing library. By reworking the underlying algorithm with better math and Rust code, the team eliminated the excess memory usage across its global fleet.
Cloudflare offers a feature called Quick Tunnels that lets developers publicly expose a locally running web server or API with a single command, using the cloudflared command-line tool. No account login is required, and the tool automatically handles TLS certificates, traffic routing, and DDoS protection for the exposed endpoint.
A developer known as MAAN built a browser-based demo that reimplements Nvidia's DLSS 5 neural rendering network using WebGPU compute shaders, hosted on Cloudflare Workers with adjustable settings and sample scenes. The port reportedly works on non-Nvidia GPUs and even macOS, using roughly 147MB of extracted model weights alongside a small JavaScript runtime, though each rendered frame currently takes one to two seconds. MAAN says the weights came from a leaked DLSS 5 library file and plans to release the source code on GitHub soon.
Brevo disclosed that hackers obtained a hardcoded, full-permission Cloudflare API key and used it to deploy a rogue Cloudflare Worker that rewrote content at the CDN edge for roughly 5.5 hours on September 14. The tampered scripts, including Brevo's forms widget, Conversations tool and SDK loader embedded on customer sites, were altered to serve ClickFix malware while stripping security headers to evade detection.
Cloudflare released Security-Audit-Skill, a coding-agent tool that runs a six-phase security audit: mapping a codebase's architecture and attack surface, assigning isolated 'hunter' agents to search for vulnerabilities against a coverage ledger, validating candidates with skeptical verifier agents, and producing structured reports categorized as confirmed, needs_validation, or rejected. It served as the original single-repo prototype that Cloudflare later expanded into its larger, fleet-wide vulnerability discovery harness.
Cloudflare launched a 'Disallow AI Training' control that lets website owners stay visible in search results while blocking the same crawler from using their content to train AI models. Apple, Google and Microsoft have agreed to honor the new setting, which addresses the problem of mixed-use crawlers that previously forced sites to accept both search indexing and AI training together or neither.