Cloudflare
Cloudflare is an American technology company providing network infrastructure and security services. Its core offerings include a content delivery network (CDN), DDoS attack mitigation, domain name resolution (DNS), cloud-based firewall, and zero-trust network access. Its services span data centers globally, helping enterprises and individual users improve website performance, ensure network security, and optimize internet connectivity, with applications in website acceleration, application security, and network traffic management.
Core Facts
Cloudflare Workers is an edge computing platform based on V8 Isolate technology, running across Cloudflare's 300+ data center nodes distributed globally.
Cloudflare Email Routing provides a free domain email forwarding service that supports the Catch-all feature
Cloudflare R2 is an Amazon S3-compatible storage service known for its zero egress fees.
Timeline (last 90 days)
Both fixes passed reproduction tests and tagging test verification before the model was restored on September 9.
The scope of impact was 155 affected responses, all of which came from prompts longer than 681,280 tokens.
Oversized requests were rejected internally and replaced with a single-token placeholder, but the rejection did not prevent the request from being passed through.
Cloudflare published an incident report on October 26 regarding the GLM 5.3 deployment on Workers AI.
The exposure window lasted from the model's launch on August 27 to September 9; a researcher reported the issue on September 8, and Cloudflare took the model offline during the investigation.
The investigation concluded that, after excluding its own tests and the researcher's requests, no evidence of deliberate exploitation was found.
The context window allows 1,048,576 tokens, while the preparation pool holds only 681,280.
Cloudflare's tests only checked HTTP status codes, so they failed to detect the problem of a 200 response containing cross-contaminated data.
On the Cloudflare Workers AI platform, 155 responses from the GLM 5.3 model between August 27 and September 9, 2025 contained other customers' data.
Cloudflare took the model offline within 40 minutes of announcing the incident and restored it the same day after completing the fix.
40 more timeline events
All Facts (20)
Cloudflare Workers is an edge computing platform based on V8 Isolate technology, running across Cloudflare's 300+ data center nodes distributed globally.
80%VerifiedCloudflare Email Routing provides a free domain email forwarding service that supports the Catch-all feature
75%VerifiedCloudflare R2 is an Amazon S3-compatible storage service known for its zero egress fees.
75%VerifiedExposing home services through Cloudflare Tunnel eliminates the need to open inbound ports on the router, thereby avoiding the security risk of directly exposing the home IP address.
70%VerifiedThe HTTP 200 status code only indicates that the server successfully received and processed the request; it does not represent correct execution of business logic, as a large number of business errors can be wrapped inside a 200 response body.
70%VerifiedCloudflare Durable Objects assign a globally unique ID to each object and guarantee that all requests with the same ID are routed to the same instance, thereby achieving strongly consistent state storage.
65%VerifiedPreviously, Cloudflare Workers was primarily oriented toward JavaScript and WebAssembly-based languages
65%VerifiedCloudflare Tunnel (formerly Argo Tunnel) is a reverse tunneling technology that establishes outbound connections to the Cloudflare edge network through a locally running cloudflared daemon, requiring no public IP, port forwarding, or firewall configuration.
65%VerifiedThe Linux kernel, Android system components, and Microsoft Azure cloud infrastructure have all introduced Rust to rewrite critical modules.
65%VerifiedAdversarial training improves a model's ability to recognize and resist attack prompts by incorporating known jailbreak samples into training data, but faces the ongoing challenge of novel variants.
65%VerifiedOn July 2, 2019, Cloudflare experienced a global service outage lasting approximately 27 minutes, directly caused by a regular expression in the WAF rule engine triggering catastrophic backtracking.
65%VerifiedDurable Objects are stateful compute units on the Cloudflare Workers platform; each object has its own in-memory state and persistent storage, and only one instance of the same object ID runs at any given time.
65%VerifiedCloudflare Pages is a static website hosting service provided by Cloudflare, deeply integrated with GitHub, and completely free for individual users.
65%VerifiedCloudflare launched two open-weight decision models, Clef and Clef-flash, in October 2026.
65%VerifiedEnd-to-end infrastructure will evolve toward multi-cloud and hybrid cloud support, edge deployment, AI security integration, and enhanced observability.
65%VerifiedCloudflare released a new bot detection engine called Adaptive Intelligence, whose core philosophy shifts from building walls to keep attackers out to making attacks slow and costly enough to not be worthwhile.
65%Unverified启用Cloudflare邮件路由时，Cloudflare会自动为域名添加指向其邮件处理服务器的MX记录
90%UnverifiedCloudflare、Akamai等CDN厂商和Google reCAPTCHA等验证系统使用多维指纹组合来检测自动化流量
90%Unverified2019年Cloudflare曾因正则表达式灾难性回溯问题导致全球宕机事件
90%UnverifiedCloudflare Turnstile是Cloudflare推出的免费人机验证替代方案，通过浏览器环境检测和行为分析等非侵入式手段判断访问者是否为真人
90%