Read what ships.

01Cloudflare · architecture

Origin Range Requests: Serving large files without range-request tuning

Cloudflare replaced a legacy, fixed-size range caching design that suffered from bandwidth waste and memory pressure with a Pingora-based chunk coordinator. The new implementation dynamically combines cached chunks and aligned origin fetches to serve range requests accurately without manual tuning. This approach cut p99 time to first byte in half for R2 storage and reduced tiered cache traffic by six percent.

DEPTH ■■■■■8 min read2 days ago

DatabasesPerformanceRedis

Sign in to save and rate

02GitLab · tutorial

PHP2Shell: GitLab helps find and remediate critical PHP flaws

Critical remote code execution vulnerabilities known as PHP2Shell affect the PHP engine across multiple versions, requiring immediate runtime updates to fixed versions or patched distribution packages. The team utilized platform features like container scanning, code search, and automated agent workflows to locate PHP projects and remediate vulnerabilities. Operators must also check logs and environments for signs of compromise as framework updates and input validations cannot prevent these engine-level flaws.

DEPTH ■■■■■10 min read3 days ago

ArchitectureSecurity

Sign in to save and rate

03Cloudflare · architecture

Bringing post-quantum cryptography to geographically fenced key management

Cloudflare introduced a post-quantum geographically restricted key manager in closed beta to enforce data sovereignty and protect customers against harvest-now-decrypt-later attacks. The team implemented a hybrid ML-KEM-768 and X25519 cryptographic design that separates globally distributed wrapped private keys from regionally restricted root keys. This ensures that decryption keys are only accessible within authorized geographical boundaries and fails closed if validation fails.

DEPTH ■■■■■12 min read2 days ago

Security

Sign in to save and rate

04Go · performance

Better HTTP/1 connection reuse

Failing to read an HTTP/1 response body completely prevents connection reuse, forcing clients to repeatedly pay the high cost of TCP and TLS handshakes. While developers previously had to implement complex manual body-draining logic, Go 1.27 introduces automatic asynchronous response draining in the net/http package. This improvement allows developers to simply close response bodies without worrying about connection pooling performance.

DEPTH ■■■■■7 min read11 days ago

Sign in to save and rate

05Cloudflare · performance

Cutting our inference bill by 68% by being obsessive about optimization

An engineering team investigated a steady rise in AI code review costs and found that cache misses and redundant model calls were driving up expenses. By restructuring system prompts to enable cross-repository prompt caching, eliminating wasted tool calls, and switching to more efficient models, the team cut inference costs by 68% while also significantly improving review latency.

DEPTH ■■■■■15 min read6 days ago

Machine Learning

Sign in to save and rate

06GitLab · scaling

Make every AI credit count: See, cap, and reduce agent spend

Uncontrolled AI agent spending can be mitigated by combining open-weight models, centralized context graphs to reduce retries, and usage analytics with credit caps. GitLab introduced these capabilities in its Duo Agent Platform to help platform teams trace, limit, and optimize AI credit consumption. The resulting architecture matches specific tasks to lower-cost models while maintaining task completion quality.

DEPTH ■■■■■6 min read12 days ago

Sign in to save and rate

07Go · architecture

Arch-specific SIMD in Go

Go 1.27 introduces the archsimd package to provide low-level architecture-specific SIMD intrinsics for amd64, arm64, and wasm without requiring assembly. The API uses sensible naming conventions, zero-cost type reinterpretation, and opaque masks to improve usability and maintainability while achieving high performance. The resulting design enables developers to write optimized vectorized code safely with proper runtime CPU feature checking and compiler optimizations.

DEPTH ■■■■■12 min read3 weeks ago

Sign in to save and rate

08Cloudflare · performance

Yandex outage: Data shows that instead of going dark, malicious bots went on the move

Following physical strikes on Yandex data centers, overall HTTP traffic from the network dropped significantly, leading to speculation that malicious bot farms had been disabled. However, traffic analysis revealed that search crawling simply decreased while malicious automation quickly migrated to other hosting providers with identical fingerprints. Consequently, overall malicious bot traffic remained flat, demonstrating that network disruptions do not stop portable automated workloads.

DEPTH ■■■■■8 min read11 days ago

Incidents & Postmortems

Sign in to save and rate

09Cloudflare · postmortem

Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug

During the beta of MySQL support for Hyperdrive, engineers investigated rare empty query responses and connection hangs occurring in 0.001% of requests. They discovered that sharing the data center cache between client and endpoint nodes caused protocol capability mismatches when translating MySQL wire messages. The team resolved the issue by standardizing the cache to always store responses encoded with canonical Hyperdrive capabilities.

DEPTH ■■■■■9 min read11 days ago

MySQL

Sign in to save and rate

10Tailscale · tutorial

It's time to make your own RSS reader

This post walks through the process of self-hosting a personal RSS reader using FreshRSS and Docker, secured privately over a Tailscale network. The author details the configuration of environment variables, auth keys, and Docker compose deployment to avoid exposing the service to the open web. The result is a private, algorithm-free news reader accessible across multiple devices and integrable with external reading apps or AI agents.

DEPTH ■■■■■10 min read9 days ago

Sign in to save and rate

11Cloudflare · architecture

Under the hood, off the hot path: How D1 scales to millions of databases

Cloudflare scaled its serverless SQLite database, D1, to support millions of databases by decoupling the control plane from the data plane. The team used distributed metadata caching via Workers KV, optimized database connections through Hyperdrive, and implemented a self-correcting heartbeat mechanism. This architecture prevents centralized bottlenecks and allows D1 to handle rapid on-demand database creation efficiently.

DEPTH ■■■■■22 min read12 days ago

Databases

Sign in to save and rate

12Cloudflare · scaling

Rewinding the exponential: How we keep hardware usage down

Cloudflare tackled exponential traffic growth against linear hardware growth by continuously evolving their data pipeline architecture over five years. Key optimizations included breaking up monolithic schemas, switching to zstd compression, decoupling pipeline transit from database replication, decentralizing sampling, and moving aggregations earlier in the pipeline. These strategies significantly reduced backbone bandwidth usage, network congestion, and storage requirements while preserving data quality.

DEPTH ■■■■■12 min read12 days ago

Infrastructure

Sign in to save and rate

13Cloudflare · architecture

Filter, reshape, and redact logs before export with Transformers

Cloudflare integrated SQL-based log transformation directly into its Logpush export pipeline, allowing customers to filter, redact, and reshape logs before delivery. The team chose to embed the Apache DataFusion engine in-process using Rust and Go across an Arrow IPC boundary to ensure high throughput and avoid network latency. As a result, the system processes high-volume log streams efficiently while maintaining predictable resource usage and strict delivery reliability.

DEPTH ■■■■■8 min read13 days ago

Sign in to save and rate

14Tailscale · architecture

Your agent, your network: How Meta’s Muse agent works with Tailscale

Meta integrated Tailscale into its Muse personal AI agent, allowing the agent to join a user's tailnet as a separate node and interact with self-hosted services and SSH sessions. By treating Muse like any standard tailnet node, users can apply Tailscale's access controls, grants, and tags to enforce security and adhere to the principle of least privilege.

DEPTH ■■■■■5 min read3 weeks ago

Sign in to save and rate

15Cloudflare · architecture

Cloudflare deploys protections against php2shell vulnerability

Recent disclosures revealed critical remote code execution and data exposure vulnerabilities in the PHP runtime. To mitigate the threat before public disclosure, Cloudflare developed full transaction detection to combine request and response signals within the WAF. This capability enabled automatic deployment of rules protecting customers against the php2shell exploits.

DEPTH ■■■■■6 min read4 days ago

Security

Sign in to save and rate

16GitLab · tutorial

Three developer tasks worth handing to an agent

The post explains how to use GitLab Duo Agent Platform features such as automated code reviews, CI/CD pipeline failure diagnosis, and cross-project chat. It provides setup instructions for configuration and outlines a consumption-based pricing model using credits. The features aim to automate routine developer workflows using broader project context than standard IDE assistants.

DEPTH ■■■■■4 min read6 days ago

Sign in to save and rate

17Cloudflare · architecture

How Commerce.com and Cloudflare are getting storefronts ready for AI agents

Commerce.com and Cloudflare collaborated to enable WebMCP at the edge for nearly 100,000 storefronts, allowing AI agents to interact reliably with e-commerce sites using structured tools rather than fragile HTML scraping. The team implemented edge-level configuration rules using custom hostname metadata to provide individual merchants with a seamless opt-out mechanism and added support for custom MCP paths. This integration allows agents to execute shopping tasks directly within the active browser session while ensuring fallback safety and zero extra latency for opted-out stores.

DEPTH ■■■■■6 min read4 days ago

Machine Learning

Sign in to save and rate

18Cloudflare · postmortem

8 eMudhra certificates are compromised. Here's what you need to know

Private keys associated with eight eMudhra intermediate certificates were compromised, allowing potential traffic interception. Cloudflare prioritized patching critical services, released client and tunnel updates, and deployed mitigations across its products. Customers are advised to upgrade affected software, update custom trust stores, and avoid disabling verification despite error messages.

DEPTH ■■■■■4 min read5 days ago

Security

Sign in to save and rate

19Cloudflare · architecture

A fully programmable secure web gateway

Cloudflare integrated its secure web gateway and data loss prevention services with its edge computing platform to allow customers to run custom code inline during policy evaluation. The team introduced a new Forward action for traffic transformation and Custom Functions for dynamic rule evaluation without requiring external proxy infrastructure. This enables complex security logic, real-time alerting, and dynamic header injection with zero network hop overhead.

DEPTH ■■■■■13 min read10 days ago

Sign in to save and rate

20Cloudflare · practice

Localizing compliance at scale: achieving South Korea’s ISMS certification

To achieve South Korea's ISMS certification, Cloudflare had to modify its account sign-up flow to itemize required consents and disable third-party social logins that bypassed the form. By combining IP geolocation with user country selection, the team ensured localized compliance without breaking global functionality. The resulting certification provides a localized assurance benchmark for Korean users.

DEPTH ■■■■■8 min read3 days ago

Security

Sign in to save and rate