Engineering Insights

WAF - WAF Release - 2025-10-20

This week’s update introduces an enhanced rule that expands detection coverage for a critical vulnerability in Oracle E-Business Suite. It also improves an existing rule to provide more reliable coverage in request processing. Key Findings New WAF rule deployed for Oracle E-Business Suite (CVE-2025-61882) to block unauthenticated attacker's network access via HTTP to compromise Oracle Concurrent Processing. If successfully exploited, this vulnerability may result in remote code execution. Impac

Email security - On-Demand Security Report

You can now generate on-demand security reports directly from the Cloudflare dashboard. This new feature provides a comprehensive overview of your email security posture, making it easier than ever to demonstrate the value of Cloudflare’s Email security to executives and other decision makers. These reports offer several key benefits: Executive Summary: Quickly view the performance of Email security with a high-level executive summary. Actionable Insights: Dive deep into trend data, breakdowns o

Zero-configuration support for NestJS

Vercel now supports applications, a popular framework for building efficient, scalable server-side applications, with zero-configuration.NestJSNode.js Backends on Vercel use with by default. This means your NestJS app will automatically scale up and down based on traffic, and you only pay for what you use.Fluid computeActive CPU pricing or visit the Deploy NestJS on VercelNestJS on Vercel documentation Read more

Security Center - New Application Security reports (Closed Beta)

Cloudflare's new Application Security report, currently in Closed Beta, is now available in the dashboard. Go to Security reports The reports are generated monthly and provide cyber security insights trends for all of the Enterprise zones in your Cloudflare account. The reports also include an industry benchmark, comparing your cyber security landscape to peers in your industry. Learn more about the reports by referring to the Security Reports documentation. Use the feedback survey link at

WAF - New detections released for WAF managed rulesets

This week we introduced several new detections across Cloudflare Managed Rulesets, expanding coverage for high-impact vulnerability classes such as SSRF, SQLi, SSTI, Reverse Shell attempts, and Prototype Pollution. These rules aim to improve protection against attacker-controlled payloads that exploit misconfigurations or unvalidated input in web applications. Key Findings New detections added for multiple exploit categories: SSRF (Server-Side Request Forgery) — new rules targeting both local an

AI for Food Allergies

Cloudflare One Client - WARP client for Windows (version 2025.9.173.1)

A new Beta release for the Windows WARP client is now available on the beta releases downloads page. This release contains minor fixes, improvements, and new features including Path Maximum Transmission Unit Discovery (PMTUD). With PMTUD enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to debug connectivi

Cloudflare One Client - WARP client for macOS (version 2025.9.173.1)

A new Beta release for the macOS WARP client is now available on the beta releases downloads page. This release contains minor fixes, improvements, and new features including Path Maximum Transmission Unit Discovery (PMTUD). With PMTUD enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to debug connectivity