Dogfooding at scale: migrating cdnjs to Cloudflare’s Developer Platform

As of June 23, 2026, cdnjs, one of the Internet's busiest open-source CDNs, is running exclusively on Cloudflare’s Developer Platform. Along the way, cdnjs surfaced limits in the platform, and the platform grew to meet them.

cdnjs is a free, open-source content delivery network for JavaScript and CSS libraries. Instead of using a bundler or self-hosting jQuery, Bootstrap, or Lodash, you drop a <script> tag pointing to cdnjs.cloudflare.com and the library loads from Cloudflare's edge, instantly, anywhere in the world, with no signup, no API keys, and no rate limits. It's the infrastructure behind a significant portion of “intro to JavaScript” tutorials, CodePen demos, and Stack Overflow answers.

Community-driven, cdnjs is used on roughly 12% of all websites, a 48.3% share of the JavaScript CDN market. It serves an average of 108,000 requests per second, 9 billion per day, across more than 330 Cloudflare data centers, with a 98.6% cache hit rate. Pretty cool, Internet!

In 2011, when bundlers were exotic, npm was barely a year old, and "just drop a <script> tag" was how the web shipped JavaScript, Ryan Kirkman and Thomas Davis built cdnjs as a free, community-run mirror of every popular Continue reading

Post-quantum authentication to origins is now supported

Cloudflare's Authenticated Origin Pulls and Custom Origin Trust Store now support post-quantum authentication.

Here we’ll explain how you can configure fully post-quantum secure mutually authenticated TLS connections to your origin server, dive into the engineering details of how we built it, make a shameful confession, and finally explain how this work fits into our overall post-quantum migration roadmap.

Reaching a major milestone

Our focus for the past several years has been in deploying post-quantum encryption to protect against harvest-now/decrypt-later attacks, where an attacker quietly stockpiles your encrypted data with the hope of decrypting it in the future with a quantum computer.

However, recent breakthroughs in quantum computing and cryptanalysis pulled the timelines for upgrading to post-quantum cryptography forward across industry and government and have caused us to shift our attention to deploying post-quantum authentication, to protect against attackers who will soon be able to use quantum computers to break classical credentials and carry out impersonation attacks.

In a previous post, we announced that Cloudflare is targeting 2029 for full post-quantum security, and laid out several milestones to hit along the way. We have reached the first of those milestones: our Authenticated Origin Pulls and Custom Origin Trust Store products Continue reading

DNS Topics at IETF 126

The 126th meeting of the Internet Engineering Task Force (IETF) was held in Vienna at the end of July 2026. It’s a busy week with a large number of meetings and conversations. These are some notes from sessions that had DNS topics that I found to be of interest.

HW084: Spatial Reuse in Wi-Fi

Jake Snyder joins Keith Parsons to explain the mechanics of spatial reuse in Wi-Fi. They discuss practical implementation, the trade-offs involved in increasing signal detection thresholds, and why effective RF design remains the primary method for optimizing network performance. Episode Links: Jake Snyder’s Website

The Consumable Space Data Center

I’ll admit that I’m already shaking my head when I hear someone talking about the concept of data centers in space. You’re always going to hear the same three points trying to sell it. There is unlimited solar power, no land or water constraints, and cooling in space is free because it’s cold. Sounds good in theory but physics always wins. The costs associated with the drawbacks means that what you’re being sold is entirely different from what is being delivered.

Lots of companies are jumping in to get into space. Starcloud, Axiom, Sophia Space, Google Project Suncatcher, and even the crazy million satellite promise from SpaceX want a piece of the action. However, read through the marketing and you’ll see that these companies aren’t building data centers in space. They’re really building disposable compute modules that just happen to be in space because calling them “data centers” is where you get your funding.

The hints are there if you look closely. Coverage of India’s space aspirations talk about plans to deorbit failed modules and replace them, much like Starlink satellites or mobile phones. Other consultants have talked about servicing and unit refreshes as the real Continue reading

MCP’s Auth Hardening: What the Six New OAuth SEPs Fix, and What They Still Don’t

In short, the MCP 2026-07-28 release candidate is getting attention for going stateless. The quieter story is a package of six SEPs that harden the protocol’s OAuth layer: issuer validation, credential binding, client type declaration, and cleanups around refresh tokens, scopes, and discovery. All six are worth shipping, and all six fix real failure modes. But they harden how a client authenticates to a server, and that was never the whole problem. Agent identity, per-request authorization, delegation, and audit still sit outside the spec. Which means they still sit with you.

The stateless core is soaking up most of the commentary on the new MCP release candidate, and fair enough: deleting the initialize handshake and the session ID changes how everyone deploys. But scroll past that section of the announcement and you hit six SEPs of authorization hardening that almost nobody is writing about. That’s a mistake. If you operate MCP servers that hold real credentials, this is the part of the spec that decides whether a confused client hands a token to the wrong party.

The final spec ships July 28, 2026. The release candidate was locked on May 21, and SDK maintainers are in a ten-week validation window Continue reading

Bring Your Own VLAN: Moving VMs to Kubernetes Without Changing a Single IP

For many organizations, modernizing their VMs before migrating them is not a realistic option, especially when external events trigger the migration. Mapping dependencies and refactoring network configurations before the deadline is impractical, forcing VMs to move as they are.

The mechanics of moving a VM are largely solved. Tools like Forklift handle what a vSphere admin would recognize as a cold or warm migration: copy the VMDKs off the datastore, convert the guest, and boot it as a KubeVirt VM on Kubernetes. The guest comes through with its disks, its OS, its MAC address, and the static IP still written in its network configuration.

Recreating the NSX segment the vNIC was attached to, the VLAN that defined the VM’s compliance scope, or the firewall rules that reference its address is a different story. The VM arrives in a cluster that knows nothing about any of it. Everything NSX was doing for that VM now has to be rebuilt on the Kubernetes side.

Kubernetes networking cannot solve this on its own, for two reasons. First, pod IPs are assigned dynamically from the cluster’s pod CIDR, and a KubeVirt VM attached to the pod network is treated like any other workload, meaning Continue reading

Natural disasters and government interference: examining Q2 2026’s major Internet disruption events

Like most infrastructure, the Internet's fragility is easy to overlook — as long as it's working. When it fails, its complexity comes into full view. Cloudflare is in a unique position to detect and document the moments when one of the interrelated systems the Internet depends on breaks down and connectivity suffers as a result. Each quarter, we summarize the disruptions we detect and annotate on Cloudflare Radar.

In Q2 2026, Super Typhoon Sinlaku just north of Guam caused the longest outage, while government-mandated shutdowns during exam periods in Sudan were the most frequent. Iran restored national Internet access, reconnecting its citizens to the global network after an 88-day blackout, even as damage from drone strikes continued to disrupt AWS infrastructure elsewhere in the region. Finally, a cable cut in Saint Lucia and the distribution of faulty DNSSEC signatures in Germany underscored the fragility of Internet infrastructure, but also the remarkable stability these regional and global systems maintain when operating normally.

Here we will walk through the most significant Internet disruptions we observed in the second quarter of 2026, drawing on traffic data from Cloudflare Radar to show how each unfolded and what it meant for users on the ground. Continue reading

Worth Reading 072826


Today’s Internet runs on a vast infrastructure of replicated data, and the difference between order and chaos lies in maintaining consistency through synchronization across the many distributed points where that data is published.

 


IPv6-only networks often still depend on IPv4 subnets and ARP. This article introduces an IETF proposal to eliminate both.

 


Traditional software engineering approaches reliability as a binary state of uptime and downtime. Modern ML pipelines render this paradigm obsolete.

 


Yet while the radios and protocols largely reuse terrestrial 5G designs, one small but crucial component has been left behind: The control plane timers that quietly govern how registration, mobility, and session procedures behave under real-world conditions.

 


Apparently, nearly all of them have reached the same conclusion. I don’t merely need AI occasionally. I need it waiting inside every search bar, messaging app, music player, and document reader I already use.

Why eBPF Is Useful for Watching and Sandboxing AI Agents

Most of our runtime security habits were built for deterministic workloads. A service does what its code says: review the code, sign the image, and its behavior is bounded. Agents are different. An agent’s behavior emerges from a model reasoning over whatever lands in its context window, and some of that context comes from places we don’t fully control — a retrieved document, a tool’s output, a user’s prompt. Meanwhile the agent usually runs with real privileges: a service account, network reach, mounted secrets, a filesystem. When untrusted input shapes behavior, those privileges get exercised less predictably than we’re used to.

A lot of good work goes into making agents harder to mislead — prompt hygiene, injection classifiers, guardrail models. It’s worth pairing that with a second question: if an agent does something we didn’t intend, how far can it actually reach? That’s blast radius, and it’s mostly a decision we make at the runtime layer, independent of how the prompt was handled.

This is where eBPF is a good fit, for two reasons: it’s an excellent way to see what an agent is doing, and it can enforce limits on what the agent can touch — without changing the Continue reading

Andean Condor: Burung dengan Rentang Sayap Terpanjang di Dunia

Andean condor adalah salah satu burung paling ikonik dan mempesona di dunia, dikenal luas karena rentang sayapnya yang luar biasa panjang. Saat ini, burung ini tidak hanya menjadi simbol kekuatan dan kebebasan di pegunungan Andes, tetapi juga menarik perhatian para ilmuwan, konservasionis, dan pecinta alam karena peran ekologisnya yang penting serta kondisi konservasi terkini yang terus berkembang. Dalam artikel ini, kita akan mengupas tuntas fakta terkini tentang Andean condor, mulai dari ciri fisik, habitat, perilaku, hingga usaha pelestarian yang dilakukan untuk menjaga kelangsungan hidupnya di alam liar.

Mengenal Ciri Fisik Andean Condor

Andean condor adalah burung pemakan bangkai terbesar di Amerika Selatan dan terkenal dengan rentang sayapnya yang bisa mencapai hingga 3 meter, menjadikannya burung dengan rentang sayap terpanjang di dunia saat ini. Sayapnya yang lebar dan kuat memungkinkan burung ini untuk terbang dengan efisiensi energi yang luar biasa, memanfaatkan arus udara termal di pegunungan Andes untuk melayang berjam-jam tanpa kepakan sayap yang signifikan.

Warna bulu Andean condor didominasi oleh hitam legam dengan semburat putih di sayap bagian atas, yang lebih jelas pada jantan dibanding betina. Jantan memiliki jambul khas di kepala, sedangkan betina cenderung lebih kecil dan tidak memiliki jambul. Paruhnya yang besar dan tajam sangat efektif untuk mengoyak Continue reading

Misteri Fenomena Brime: Pembentukan Es Bergerigi di Kutub

Fenomena brime formation saat ini semakin menarik perhatian para ilmuwan dan pengamat iklim, terutama dalam konteks perubahan lingkungan di wilayah kutub. Istilah brime merujuk pada formasi es bergerigi atau kristal es yang unik, terbentuk di permukaan salju dan es di daerah kutub utara dan selatan. Fenomena ini tidak hanya menjadi objek penelitian ilmiah, tetapi juga memberikan gambaran penting mengenai dinamika perubahan iklim dan kondisi permukaan es di era saat ini.

Apa Itu Brime Formation?

Brime merupakan jenis es yang terbentuk akibat proses sublimasi dan kondensasi yang berlangsung pada permukaan es dan salju di wilayah kutub. Bentuknya khas, yakni menyerupai kristal-kristal bergerigi yang muncul karena kondisi suhu dan kelembapan yang sangat spesifik. Berbeda dengan es biasa, brime memiliki struktur yang lebih rapuh dan berpori, membuatnya mudah berubah seiring perubahan cuaca.

Fenomena brime formation kian sering diamati di wilayah kutub saat ini, dengan dampak signifikan terhadap stabilitas dan sifat fisik permukaan es. Secara visual, formasi ini memberikan pola bergerigi yang tak hanya memengaruhi estetika lanskap es, tetapi juga memicu perubahan reflektansi permukaan—yang pada gilirannya berkontribusi pada proses pemanasan global di daerah tersebut.

Proses Terbentuknya Brime di Kutub Saat Ini

Proses terbentuknya brime saat ini melibatkan interaksi kompleks antara suhu udara, kadar kelembapan, Continue reading

1 2 3 … 3,890