Introducing the Cloudflare PHP Capture the Flag challenge
Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged certificates that could be used to impersonate servers. Then came php2shell: serious vulnerabilities in PHP, the runtime behind a large portion of the Web.
Cloudflare worked around the clock as these events unfolded to protect our customers and help protect the Internet. We shipped client updates and multiple mitigations, updated our web application firewall (WAF) with new rules to block attackers from exploiting the PHP vulnerabilities, and introduced a new feature called full transaction detection.
As always in situations like this, these new capabilities were made available on all plans, including Free.
Put our WAF to the test
Protecting systems from vulnerabilities like these is always an ongoing process, not a one-time event. The widespread adoption of AI allows attackers to discover new vectors with unprecedented speed and efficiency, so collecting real-world data to test our assumptions and strengthen defenses is essential.
That’s why today we're launching the Cloudflare PHP Capture the Flag challenge, run through our Bug Bounty program. We've put a deliberately vulnerable PHP installation behind our WAF, and we're inviting security researchers Continue reading
What took the Internet offline in Q3 2026
The Internet can feel invisible when everything is working normally. But when connectivity breaks, the many systems it depends upon become evident in an instant. Because Cloudflare’s global network handles more than 20% of the web’s traffic, it offers a unique perspective of how Internet traffic is behaving. When failures in infrastructure, power, policy, or security disrupt access to the Internet, Cloudflare Radar can observe the impact by monitoring traffic to our customers. Each quarter, we review the disruptions detected and annotated on Radar, highlighting what happened, where it happened, and the broader conditions that shaped each event.
In this post, we examine the major categories of Internet disruptions observed during the third quarter of 2026, including government-directed shutdowns, power outages and natural disasters.
Disruptions at a glance
Between July and September, Internet disruptions were largely driven by failures in the systems the Internet depends on. Power grids failed in Cuba, Honduras, Guam, Ukraine, and several other countries. Natural disasters damaged electricity and telecommunications infrastructure from Nepal to Colombia. Government-directed shutdowns remained the most frequent source of disruption, driven largely by exam-related shutdowns in Iraq, while renewed conflict in Ethiopia’s Tigray region showed how quickly connectivity can become part of Continue reading
Skills to Power the Future
Getting certifications, along with practical, role-based, integrated workflow learning means IT teams apply the skills needed for innovation at scaleCross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
On September 8, 2026, we were alerted by a security researcher, Gadi Evron from Knostic, to a tenant isolation issue affecting the GLM-5.3 Workers AI model (@cf/zai-org/glm-5.3) starting on August 27, 2026. We have remediated the issue, and we restored the model on September 9. We have confirmed that no other model hosted on Workers AI was affected.
Between August 27 and September 9, a small number of customers using the GLM 5.3 Workers AI model received responses that contained data from other customers' requests made to the same model shortly before theirs. In total, 155 responses were affected, all to prompts longer than 681,280 tokens.
After excluding our own testing and the researcher's, the requests we identified are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug. We found no evidence of deliberate exploitation.
Today we are publishing this report alongside a post from SGLang, the open-source inference engine that we use, as a coordinated disclosure. This post describes the bug that caused this issue, our response timeline, and the subsequent hardening we have conducted on our production SGLang deployments. We also detail our continued efforts with Continue reading
Building an OSPF Network from Scratch with Ansible
This post is part of an ongoing series - see all the posts below.
So far in this series, we've been working with pretty much the same set of devices, core1, core2, access1, access2, and access3. We've used them to configure VLANs, NTP, syslog, and interface descriptions, and to learn the core Ansible concepts along the way.
For this part, we're going to start with a new topology and put everything we've learned into practice with a real-world example. The lab has six Cisco routers, split across three OSPF areas. I created it using Containerlab, and I've included the topology file below, so you should be able to build the same lab and follow along.
name: ospf_lab
mgmt:
network: mgmt
ipv4-subnet: 192.168.202.0/24
topology:
kinds:
cisco_iol:
image: cisco-iol-17.12.01
nodes:
r1:
kind: cisco_iol
mgmt-ipv4: 192.168.202.101
r2:
kind: cisco_iol
mgmt-ipv4: 192.168.202.102
r3:
kind: cisco_iol
mgmt-ipv4: 192.168.202.103
r4:
kind: cisco_iol
mgmt-ipv4: 192.168.202.104
r5:
kind: cisco_iol
mgmt-ipv4: 192.168.202.105
r6:
kind: cisco_iol
mgmt-ipv4: 192.168.202.106
links:
# Area 0
- endpoints: ["r1:Ethernet0/1", "r2:Ethernet0/1"] # 10.100.12. Continue readingUseful Ansible Filters for Network Engineers
This post is part of an ongoing series - see all the posts below.
In the previous part of this series, we looked at what filters are and covered some of the most commonly used ones, such as selectattr, map, and regex_replace. We also used filters to solve a real problem in the previous part by sharing the same syslog servers between Cisco and Arista.
Ansible has a huge number of filters, and it's impossible to cover all of them. So in this part, I want to focus on a handful that I find especially useful as a network engineer. We'll work with IP addresses and subnets, compare lists to check whether a device's config is what it should be, merge dictionaries together, and sort lists. Along the way, we'll also build a simple compliance check that you can use in your own network right away.
This post is part of a series on Ansible for network engineers. If you're new to the series, I recommend following the parts in order, since each one builds on the previous one. Here's a quick overview of the setup we're using. The lab has five switches, core1, core2 Continue reading
Starbound: Cara Menjelajahi Planet dan Mengembangkan Karakter
Dalam dunia game eksplorasi antariksa saat ini, Starbound menjadi salah satu judul paling diminati yang menawarkan pengalaman menjelajah lintas galaksi dengan kebebasan tak terbatas. Artikel ini akan membahas secara lengkap bagaimana cara menjelajahi planet dan mengembangkan karakter dalam Starbound di periode terbaru, sehingga Anda bisa memaksimalkan petualangan Anda di dunia yang luas dan penuh misteri ini.
Memahami Dunia Starbound dan Relevansinya di Masa Kini
Starbound merupakan game sandbox eksplorasi yang memungkinkan pemain untuk menjelajahi beragam planet secara bebas, mengumpulkan sumber daya, membangun markas, dan mengembangkan kemampuan karakter di luar angkasa. Saat ini, game ini terus mendapatkan pembaruan yang menghadirkan konten-konten baru, menjaga pemain tetap tertarik dengan pengalaman yang dinamis dan terus berkembang. Dalam konteks gaming modern, Starbound mampu bersaing dengan game eksplorasi lain berkat fitur unik dan komunitas yang aktif.
Cara Menjelajahi Planet dalam Starbound
1. Memulai Petualangan di Antariksa
Setelah menyelesaikan tahap tutorial awal, pemain akan mendapatkan pesawat luar angkasa yang menjadi alat utama untuk berpindah antarplanet. Pesawat ini dapat di-upgrade untuk memungkinkan perjalanan lebih jauh dan membawa lebih banyak barang selama eksplorasi. Saat ini, kemampuan upgrade pesawat sangat penting karena bintang-bintang dan galaksi yang tersedia semakin luas dan variatif.
2. Menganalisis Planet dan Memilih Tujuan
Setiap sistem bintang Continue reading
Core Keeper: Cara Efektif Menambang dan Membangun Markas Bawah Tanah
Pendahuluan
Core Keeper saat ini menjadi salah satu game sandbox bawah tanah yang paling diminati oleh para gamer dan penggemar eksplorasi dunia virtual. Dalam permainan ini, kemampuan menambang sumber daya dan membangun markas merupakan kunci utama untuk bertahan hidup dan berkembang. Artikel ini akan membahas secara mendalam bagaimana cara efektif menambang berbagai sumber daya serta membangun markas yang kokoh di dunia bawah tanah Core Keeper, sehingga Anda bisa memaksimalkan pengalaman bermain dan semakin unggul dalam permainan.
Menambang Sumber Daya di Core Keeper
Sumber daya adalah bahan baku utama yang Anda perlukan untuk membuat peralatan, struktur markas, dan item berharga lainnya. Hingga saat ini, Core Keeper menawarkan beragam tipe sumber daya yang bisa ditemukan di berbagai zona bawah tanah dengan tingkat kesulitan yang berbeda.
- Memahami Jenis Sumber Daya
Terdapat beberapa kategori sumber daya yang wajib Anda ketahui, seperti batu, logam (besi, emas), mineral langka, kristal ajaib, dan sumber daya organik seperti rotan dan jamur. Setiap jenis sumber daya biasanya tersebar di kedalaman dan area yang berbeda, sehingga eksplorasi yang cermat sangat disarankan. - Alat Penambangan yang Tepat
Untuk menambang dengan efisien, memilih alat yang tepat adalah langkah awal yang sangat penting. Pickaxe standar bisa digunakan untuk memulai menambang batu dan sebagian logam, Continue reading
Developing AI-Based Digital Twins and Simulation for the Manufacturing Industry
Software, automation, and digitalization now separate leading manufacturers from the rest.Hedge 323: AI and Liability
Who should be held liable when AI fails? Who is liable when an AI system “breaks into” a network or system, causing a major breach? Listen in as Tom and Russ discuss two articles covering these topics on this roundtable episode of the Hedge.
The two articles discussed in this episode are available here and here.
download
Origin Range Requests: Serving large files without range-request tuning
A video player seeking to the middle of a movie asks for a few megabytes. Under our old range caching, that one request could make Cloudflare pull 128 MiB from the origin and move it between data centers, sometimes after the viewer had already left. Range requests are how large files get delivered, and caching them naively easily leads to wasted network bandwidth and wasted disk operations when running a CDN at scale.
So we rebuilt how our cache handles them. For R2, Cloudflare's object storage, p99 time to first byte dropped by about half, and a follow-up improvement cut tiered cache traffic for R2 and similar workloads by about 6%.
Today, we're making that new implementation available as Origin Range Requests, a self-service feature on all plans. There's no range size to tune and no need to contact support. Turn it on with a Cache Rule, and Cloudflare handles the rest.
A request for part of a file
An HTTP range request asks for part of a resource instead of the whole resource. The client sends a normal GET with a Range header:
GET /movie.mp4 HTTP/1.1
Host: example.com
Range: bytes=1048576-2097151If the server supports the Continue reading
Bringing post-quantum cryptography to geographically fenced key management
Today, Cloudflare is launching a post-quantum geographically restricted key manager in support of our Data Localization Suite (DLS) in closed beta. This new PQ GeoKey Manager is a cornerstone of Cloudflare’s data sovereignty solutions, making sure that a customer's decryption keys are only accessible in their chosen geography. GeoKey Manager implements this by wrapping each decryption key such that it can only be decrypted by Cloudflare servers that are located in the allowed geography.
While general availability (GA) is planned for Q1 2027, today’s launch is an important milestone on our journey to support our customers’ data sovereignty goals while also migrating all Cloudflare products to post-quantum (PQ) cryptography.
Governments, financial institutions, healthcare providers, and defense organizations process highly sensitive data that can remain sensitive for years or decades after it is produced. Encryption is often required to protect this data. When classical, public-key encryption is used, adversaries do not immediately need a quantum computer today to put that data at risk: they can store the ciphertext and retain them until quantum computers can break the public key cryptography protecting it — an attack strategy known as harvest now, decrypt later.
For organizations with geographic requirements, resisting that threat is Continue reading
Public Videos: Data Center Fabric Architectures
All the videos in the Data Center Fabric Architectures webinar are now available without a valid ipSpace.net account.
The webinar hasn’t been updated in years, so the vendor-specific information is mostly obsolete. However, I’m sure you’ll still find the requirements, architectures, designs, and technology overviews sections relevant.
To watch more free ipSpace.net videos, browse them here, or click the Access Free Content button in any webinar roadmap.