181
Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)
A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.
Cloudflare Blog
Technical deep dives, product updates, and insights from the teams that are helping to build a better Internet.
- Popular posts
- 326
- Total points
- 93,334
- HN comments
- 39,830
- Rank
- #6 company
Visit blog.cloudflare.com → RSS feedOn Hacker News Jun 2011 – Nov 2026
Networking & Internet 106Security & Privacy 101Infrastructure & DevOps 77Web & Frontend 75Systems & Performance 64Software Engineering 53
182
When can two TCP sockets share a local address?
If I navigate to https://blog.cloudflare.com/, my browser will connect to a remote TCP address from the local IP address assigned to my machine, and a randomly chosen local TCP port. What happens if I then decide to head to another site?
183
BoringTun, a Userspace WireGuard Implementation in Rust
Today we are happy to release the source code of a project we’ve been working on for the past few months. It is called BoringTun, and is a userspace implementation of the WireGuard® protocol written in Rust.
184
Web3 – A Vision for a Decentralized Web
In this blog we start to explain Web3 in the context of the web's evolution, and how Cloudflare might help to support it.
185
Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
It’s well known that SHA-1 is no longer considered a secure cryptographic hash function. Researchers now believe that finding a hash collision (two values that result in the same value when SHA-1 is applied) is inevitable and likely to happen.
186
How Cloudflare analyzes 1M DNS queries per second
On Friday, we announced DNS analytics for all Cloudflare customers. Because of our scale –– by the time you’ve finished reading this, Cloudflare DNS will have handled millions of DNS queries –– we had to be creative in our implementation.
187
Bypassing the Linux kernel for high-performance packet filtering
In two previous posts we've discussed how to receive 1M UDP packets per second and how to reduce the round trip time. We did the experiments on Linux and the performance was very good considering it's a general purpose operating system.
188
Caching the uncacheable: CloudFlare's Railgun
CloudFlare recently rolled out a premium service called Railgun that's available to CloudFlare Business and Enterprise customers. Railgun is web optimization software that's designed to speed up the delivery of content that cannot be cached.
189
Two years of production Go at CloudFlare
Almost two years ago CloudFlare started working with Go. What started as an experiment on one network and concurrency heavy project has turned into full, production use of Go for multiple services.
190
Building Cloudflare TV from Scratch
Cloudflare TV is a 24x7 TV channel that takes you behind-the-scenes and let’s you hear directly from the builders working on your favorite Cloudflare products. This blog post covers the story of why we decided to build Cloudflare TV in-house and some of the technologies that make it possible.
191
Cf: The Agentic CLI for the Cloudflare API
We are releasing cf, our new command-line tool that mirrors the entire Cloudflare API and supports programmatic TypeScript configuration. We are also open-sourcing Forge, our internal SDK generator.
192
CloudFlare Now Supports WebSockets
I'm pleased to announce that CloudFlare now supports WebSockets. The ability to protect and accelerate WebSockets has been one of our most requested features.
193
New standards for a faster and more private Internet
Cloudflare's customers can now take advantage of Zstandard (zstd) compression, offering 42% faster compression than Brotli and 11.3% more efficiency than GZIP. We're further optimizing performance for our customers with HTTP/3 prioritization and BBR congestion control, and enhancing privacy through Encrypted Client…
194
A steam locomotive from 1993 broke my yarn test
Yarn tests fail consistently at the 27-second mark. The usual suspects are swiftly eliminated to no avail. A deep dive is taken to comb through traces, only to be derailed into an unexpected crash investigation.
195
Running Zig with WASI on Cloudflare Workers
After the recent announcement regarding WASI support in Workers I decided to see what it would take to get code written in Zig to run as a Worker, and it turned out to be pretty trivial. This post documents the process I followed
196
Route leak incident on January 22, 2026
An automated routing policy configuration error caused us to leak some Border Gateway Protocol prefixes unintentionally from a router at our Miami data center. We discuss the impact and the changes we are implementing as a result.
197
Fuzzing a DNS parser written in Go
Here at CloudFlare we are heavy users of the github.com/miekg/dns Go DNS library and we make sure to contribute to its development as much as possible. Therefore when Dmitry Vyukov published go-fuzz and started to uncover tens of bugs in the Go standard library, our task was clear.
198
Why does one Nginx worker take all the load?
Scaling up TCP servers is usually straightforward. Most deployments start by using a single process setup. When the need arises more worker processes are added.
199
We found a bug in the hyper HTTP library
By rearchitecting the Images binding, we accidentally uncovered a bug that existed in the open-source hyper library across multiple major versions.
200
When “idle” isn't idle: how a Linux kernel optimization became a QUIC bug
We investigated a bug where CUBIC's congestion window became pinned at its minimum floor, causing a performance to plummet. The fix involved correctly measuring idle periods to distinguish RTT wait times from actual application idleness.
201
Keyless SSL: The Nitty Gritty Technical Details
We announced Keyless SSL yesterday to an overwhelmingly positive response. We read through the comments on this blog, Reddit, Hacker News, and people seem interested in knowing more and getting deeper into the technical details.
202
RFC8482 – Saying Goodbye to ANY
Ladies and gentlemen, I would like you to welcome the new shiny RFC8482, which effectively deprecates DNS ANY query type. DNS ANY was a "meta-query" - think about it as a similar thing to the common A, AAAA, MX or SRV query types, but unlike these it wasn't a real query type - it was special.
203
However improbable: The story of a processor bug
Processor problems have been in the news lately, due to the Meltdown and Spectre vulnerabilities. But generally, engineers writing software assume that computer hardware operates in a reliable, well-understood fashion, and that any problems lie on the software side of the software-hardware divide.
204
Cloudflare R2 IA storage tier
We’re excited to announce three new features for Cloudflare R2: event notifications, support for migrations from Google Cloud Storage, and an infrequent access storage tier
205
Cloudflare’s Transparency Report for Second Half 2016 and a Disclosure for 2013
Cloudflare is publishing today its seventh transparency report, covering the second half of 2016. For the first time, we are able to present information on a previously undisclosed National Security Letter (NSL) Cloudflare received in the 2013 reporting period.
206
CloudFlare Is Now a Google Cloud Platform Technology Partner
We’re excited to announce that CloudFlare has just been named a Google Cloud Platform Technology Partner. So what does this mean?
207
Helping to Build Cloudflare, Part 2: The Worst Two Weeks
It’s always best to speak plainly and honestly about the situation you are in. Or as Matthew Prince likes to put it “Panic Early”. Long ago I started a company in Silicon Valley which had the most beautiful code.
208
Turnstile: privacy-preserving alternative to CAPTCHA by Cloudflare
Any website can use a simple API to replace CAPTCHAs with our invisible alternative, whether they’re on the Cloudflare network or not.
209
Flan Scan: Lightweight Network Vulnerability Scanner
Flan Scan is a thin wrapper around Nmap that converts this popular open source tool into a vulnerability scanner with an easy deployment.
210
Serverless Performance: Cloudflare Workers, Lambda and LambdaEdge
A few months ago we released a new way for people to run serverless Javascript called Cloudflare Workers. We believe Workers is the fastest way to execute serverless functions, but lets prove it.