GoKawiil
Tech News
Jim Cramer highlighted Cloudflare, Akamai and Fastly as beneficiaries of surging internet traffic driven by AI agents, with Fastly up 159% year to date, Cloudflare up 78%, and Akamai up 22%. He noted Akamai's recent $11.6 billion, seven-year computing capacity deal with Anthropic, and said Cloudflare's CEO reported AI agent traffic has already exceeded human traffic on its network.
Cloudflare has released two open-weight models, Clef and Clef-flash, built for structured decision tasks like yes/no answers, multiple-choice, and ranking. The models use frozen, post-trained versions of Qwen backbones, support images, video, and a 64K context window, and are downloadable via Hugging Face.
Cloudflare has released K2, a durable event streaming primitive on its Developer Platform, now in public beta. K2 stores incoming events as an ordered log built on R2 object storage, letting multiple consumers read data independently and at their own pace without losing events during downtime.
Cloudflare announced plans to issue hybrid TLS certificates combining classic cryptography with post-quantum Merkle Tree Certificates, using an open-source certificate authority platform. The certificates will be free for all users, and Cloudflare is acquiring an established trusted certificate root from GlobalSign to help deploy the system broadly. Cloudflare executive Steve Goldsmith said the company is not yet issuing the certificates but is publicly committing to the work and sharing milestones as it collaborates with root programs and the broader WebPKI community.
Cloudflare announced plans to become a publicly trusted Certificate Authority, issuing both standard TLS certificates and new post-quantum Merkle Tree Certificates. The company also agreed to acquire root CA key material from GlobalSign to gain broad trust across existing browsers and devices without requiring website operators to change tools.
Cloudflare announced plans to become a publicly trusted certificate authority, applying for inclusion in Chrome, Apple, Microsoft and Mozilla root programs. It has also signed a definitive agreement to acquire an established root from GlobalSign to ensure broad device compatibility once it starts issuing certificates, and plans to be among the first CAs supporting post-quantum certificates under Chrome's Quantum-resistant Root Program. The company says it is not yet issuing certificates but is publicly committing to the milestones ahead.
Cloudflare introduced cf, a new command-line tool designed to let AI agents access essentially all of Cloudflare's API rather than the roughly 280 operations supported by Wrangler. The open beta is installable now via npm, uses JSON as its default output format, and introduces a cloudflare.config.ts configuration format along with Vite-based local development.
Cloudflare fixed a vulnerability in its Containers and Sandboxes service that let Workers Paid customers recover leftover data from other customers' containers on the same physical host. The flaw stemmed from a shared storage pool that reused 64 KiB disk blocks without zeroing them, leaving up to 60 KiB of previous customer data readable when a new customer wrote only 4 KiB to that space. Security researcher Oren Yomtov of Accomplish reported the issue via HackerOne on September 4, and testing found recoverable data—including SQLite databases, .env files, and credential files—on 18 of 24 container placements checked.
In a Decoder interview, Cloudflare CEO Matthew Prince discussed how the company sits between websites and AI bots, giving site owners options to block, allow, or charge for automated access. Cloudflare's own data found that bots now account for more than half of internet traffic, a share that continues to rise as AI companies scrape content and deploy agents. Prince also addressed Cloudflare's earlier layoff of over 1,000 employees this year, tied to an op-ed he wrote about replacing staff with AI.
Cloudflare has launched support for the HTTP Vary response header within its Cache Rules feature, available to customers on every service tier. The update lets origin servers specify which request headers may affect a response, while giving Cloudflare customers control over how those variations are handled in caching—whether by normalizing header values, preserving exact values, or bypassing the cache entirely.
Security researchers at Manifold Security found that third-party.com, a domain frequently used as a generic placeholder in developer documentation and code samples, now hosts a fake Cloudflare verification page. BleepingComputer confirmed the page mimics a 'Performing security verification' CAPTCHA that copies a malicious PowerShell command to a user's clipboard, then instructs them to paste and run it via Windows key + R, which downloads and executes malware from an external URL.
Microsoft and partners including Cloudflare, Coinbase, OpenAI, SpyCloud, TRM Labs and Health-ISAC disrupted EvilTokens, a phishing-as-a-service platform that used AI to scan compromised inboxes and craft tailored lures. The operation had compromised over 12,000 inboxes across more than 10,000 organizations worldwide, spanning sectors like healthcare, finance and higher education. The takedown seized 50 sites and disabled 150 domains, and UK police arrested two men, aged 32 and 38, after Microsoft shared intelligence with the Metropolitan Police's cybercrime unit.