Research

August 18, 2026

BGP Role model: tracking the adoption of RFC 9234

RFC 9234 lets routers reject route leaks on their own, using BGP Roles and the Only to Customer attribute. We measured who has deployed it, and found two Tier 1 networks unexpectedly stripping OTC.

July 29, 2026

Post-quantum authentication to origins is now supported

Cloudflare now supports post-quantum (PQ) authentication when connecting to customer origin servers via Authenticated Origin Pulls and Custom Origin Trust Store. This is the first step towards providing PQ authentication for all Cloudflare products.

July 9, 2026

Why we cannot wait for better post-quantum signature algorithms

NIST is advancing nine new post-quantum signature algorithms as potential candidates for future standardization. We take a closer look at all of them, and argue that while they are in the works and show great potential, we should use ML-DSA for now the best currently available.

July 8, 2026

Introducing Meerkat: an experiment in global consensus

Cloudflare Research is building a global consensus service called Meerkat that uses a new consensus algorithm called QuePaxa. We plan to use Meerkat to build a strongly consistent, fault-tolerant key-value store, and other applications.

June 18, 2026

Build your own vulnerability harness

We break down the technical architecture behind our multi-stage vulnerability discovery harness and automated triage loop. Learn how we manage state controls, squash false positives through adversarial review, and route around LLM context limits.

April 21, 2026

Moving past bots vs. humans

As AI assistants and privacy proxies challenge the capabilities of traditional bot detection, the Web needs new models for accountability. We believe that control should remain with the client, and that an open ecosystem of anonymous credentials is key to preserving user privacy while protecting origins from abuse.

April 17, 2026

Unweight: how we compressed an LLM 22% without sacrificing quality

Running LLMs across Cloudflares network requires us to be smarter and more efficient about GPU memory bandwidth. Thats why we developed Unweight, a lossless inference-time compression system that achieves up to a 22% model footprint reduction, so that we can deliver faster and cheaper inference than ever before.

April 2, 2026

Why we're rethinking cache for the AI era

The explosion of AI-bot traffic, representing over 10 billion requests per week, has opened up new challenges and opportunities for cache design. We look at some of the ways AI bot traffic differs from humans, how this impacts CDN cache, and some early ideas for how Cloudflare is designing systems to improve the AI and human experience.

February 27, 2026

Bringing more transparency to post-quantum usage, encrypted messaging, and routing security

Cloudflare Radar has added new tools for monitoring PQ adoption, KT logs for messaging, and ASPA routing records to track the Internet's migration toward more secure encryption and routing standards.

December 11, 2025

React2Shell and related RSC vulnerabilities threat brief: early exploitation activity and threat actor techniques

Early activity indicates that threat actors quickly integrated this vulnerability into their scanning and reconnaissance routines and targeted critical infrastructure including nuclear fuel, uranium and rare earth elements. We outline the tactics they appear to be using and how Cloudflare is protecting customers.

November 3, 2025

Fresh insights from old data: corroborating reports of Turkmenistan IP unblocking and firewall testing

Cloudflare used historical data to investigate reports of potential new firewall tests in Turkmenistan. Shifts in TCP resets/timeouts across ASNs corroborate large-scale network control system changes.

October 30, 2025

Beyond IP lists: a registry format for bots and agents

We propose an open registry format for Web Bot Auth to move beyond IP-based identity. This allows any origin to discover and verify cryptographic keys for bots, fostering a decentralized and more trustworthy ecosystem.

October 30, 2025

Anonymous credentials: rate-limiting bots and agents without compromising privacy

As AI agents change how the Internet is used, they create a challenge for security. We explore how Anonymous Credentials can rate limit agent traffic and block abuse without tracking users or compromising their privacy.

October 29, 2025

So long, and thanks for all the fish: how to escape the Linux networking stack

Many products at Cloudflare arent possible without pushing the limits of network hardware and software to deliver improved performance, increased efficiency, or novel capabilities such as soft-unicast, our method for sharing IP subnets across data centers. Happily, most people do not need to know the intricacies of how your operating system handles network and Internet access in general. Yes, even most people within Cloudflare. But sometimes we try to push well beyond the design intentions of Linuxs networking stack. This is a story about one of those attempts.

October 29, 2025

One IP address, many users: detecting CGNAT to reduce collateral effects

IPv4 scarcity drives widespread use of Carrier-Grade Network Address Translation, a practice in ISPs and mobile networks that places many users behind each IP address, along with their collected activity and volumes of traffic. We introduce the method weve developed to detect large-scale IP sharing globally and mitigate the issues that result.

October 29, 2025

Measuring characteristics of TCP connections at Internet scale

Researchers and practitioners have been studying connections almost as long as the Internet that supports them. Today, Cloudflares global network receives millions of connections per second. We explore various characteristics of TCP connections, including lifetimes, sizes, and more.

October 29, 2025

How to build your own VPN, or: the history of WARP

WARPs initial implementation resembled a VPN that allows Internet access through it. Heres how we built it and how you can, too.

October 29, 2025

Defending QUIC from acknowledgement-based DDoS attacks

We identified and patched two DDoS vulnerabilities in our QUIC implementation related to packet acknowledgements. Cloudflare customers were not affected. We examine the "Optimistic ACK" attack vector and our solution, which dynamically skips packet numbers to validate client behavior.