This Week's Highlights — issue 002, July 15, 2026

A new tiered cache sits in front of a Worker, enabled with a single cache.enabled block in wrangler.toml, so cacheable requests never invoke Worker code or incur CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. billing. It supports stale-while-revalidate (stale responses served instantly while the Worker re-renders in the background), the standard Vary header for storing separate variants per header combination with no allowlist restrictions, and a new ctx.cache.purge() API for purging by tag (e.g. tags: ["product:123"]), path prefix, or everything, scoped to the Worker entrypoint rather than the zone. The cache follows the Worker rather than the hostname — shared across custom domains, workers.dev, service bindings, preview URLs, and Workers for Platforms tenants — with per-entrypoint isolation for Workers for Platforms tenants and preview deployments, and ctx.props allows shaping multi-tenant-safe cache keys programmatically without zone-level Cache Rules or Page Rules.

⤢ ⤢ ⤢ ⤢

{
  "name": "my-worker",
  "main": "src/index.ts",
  "compatibility_date": "2026-05-01",
  "cache": {
    "enabled": true
  }
}

return new Response(html, {
  headers: {
    "Content-Type": "text/html; charset=utf-8",
    "Cache-Control": "public, max-age=300, stale-while-revalidate=3600",
  },
});

await ctx.cache.purge({ tags: ["product:123"] });

WAF custom and rate-limiting rules can now match cf.intel.ip.* fields populated from Cloudforce One threat intelligence for IPs flagged within the past seven days. cf.intel.ip.datasets identifies whether a flagged IP was tied to DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. or WAF attack activity, cf.intel.ip.attacker_names and cf.intel.ip.attacker_countries expose known threat actor identities and source countries, and cf.intel.ip.target_industries and cf.intel.ip.target_countries let rules prioritize defense by historically targeted sectors or regions. Matches are recorded in Security Analytics and fully supported via the Cloudflare API and Terraform.

$ any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos")

Smart Tiered Cache adds cloud region hint configuration for anycast origins on AWS, GCP, Azure, and Oracle Cloud, letting it select the optimal upper tier instead of hairpinning traffic across continents. A new Origin Configuration table in the dashboard (Caching > Tiered Cache > Origin Configuration) supports per-IP region hint assignment or bulk editing of all origin IPs, with region hints also manageable via the Cloudflare API and Terraform. Anycast origins are detected via speed-of-light latency checks across global checkpoint data centers, with cloud provider IP range mappings refreshed every few hours, upper-tier probe data refreshed every 15 minutes, and geographic fallback for regions lacking probe data.

⤢ ⤢ ⤢ ⤢

Precursor is a session-based client-side verification system that dynamically injects JavaScript into HTML responses to continuously collect behavioral signals (pointer movement, keyboard timing/rhythm, focus changes, visibility) across a full user journey with no application changes required. It accumulates behavioral evaluation across a session — preventing bots from resetting their signature via page refresh or a new challenge — cross-references multiple interaction streams in an edge-side evaluation layer to detect linear mouse interpolation, inhuman click precision, missing physiological tremor, and atypical timing, and feeds session-level signals into existing bot score, challenge decisions, and Security Rules. Keyboard activity is captured only as timing/rhythm (not keystrokes) and is not exposed to customer dashboards or tied to user identities; new session-based views in Security Analytics let practitioners analyze full visitor journeys and surface sessions showing sustained automation.

⤢ ⤢

1.1.1.1 now emits EDE 33 (Negative Trust Anchor) on every response served while an NTA is active — including for non-DNSSEC domains — making DNSSEC validation bypass visible to clients instead of silently returning an unverified answer. It also returns EDE 9 (DNSKEY Missing) alongside EDE 33 during NTA incidents, giving operators and monitoring tools visibility into both the underlying DNSSEC chain-of-trust failure and the resolver's mitigation.

⤢ ⤢ ⤢ ⤢

$ kdig @1.1.1.1 google.al

The Cloudflare Managed Ruleset gained detections for: SSRF - Restricted Protocol (rule 7fbdc9407bdb4a4eae2b3d91215e7d31), SSRF - Obfuscated Host (rule 6ca512d240d848d6a0c7ef42a935ee5d), LFI - Path Traversal (rule a3fb0870c38440d8a9a0eba81b0230ac), Adobe ColdFusion File Upload Path Traversal CVE-2026-48276 (rule 452a04be3f73458c863d8dae61349c8b), Adobe ColdFusion Path Traversal CVE-2026-48282 (rule a53a3fb491c64d74908081ee9cb61eac), and JS bracket-concatenation XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. obfuscation across request body (rule d8b63828c2344d919b94d2594ac5e21f), headers (rule 264a83a764be428ca41d516ff31f5559), and URI (rule 4ba21a60837244029183b782987984fd) — all deployed in Log mode; Citrix NetScaler ADC/Gateway unauthenticated memory disclosure CVE-2026-8451 (rule 78826e3223b94da493a2ade876973ac4); Progress Kemp LoadMaster unauthenticated RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. CVE-2026-8037 (rule 6b64d216620449fbb273d07910233f36); Fortinet FortiSandbox path traversal CVE-2026-39813 (rule 32075e19b1494117ac5915e8d84c92c9, Log action); Ivanti Sentry unauthenticated OS command injectionOS command injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. CVE-2026-10520 (rule 500a90789f874345b60b0de7242fdf83); Ghost CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. Content API blind SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. CVE-2026-26980 affecting versions 3.24.0–6.19.0 (rule 439c4ef64b32447989bdf412b4c29bc6, Block action); and a generic obfuscated boolean SQLi bypass detection for URI parameters (rule 6c64b68ef5ed45e7a622cdaab56f403f, shipped Disabled).

BotBase is a searchable in-dashboard directory of every bot Cloudflare tracks, classified by behavior (Search, Agent, Training, Transact, Data Collection, SEO, Ads Verification), letting practitioners filter live zone traffic down to a single bot and copy its detection ID for use in Security rules. Attribution Business Insights adds a dashboard showing crawl-to-referral ratios per bot operator over 24 hours, 7 days, or 30 days with Allowed/Blocked/Partially blocked status, and every tracked bot from BotBase is published to Cloudflare Radar's public bots and agents directory.

⤢

The Anomaly:Header:User-Agent - Fake Bing or MSN Bot rule (ae20608d93b94e97988db1bbc12cf9c8) had its action changed from Enabled/Block to Disabled; zones relying on this rule for bot enforcement must now implement alternative coverage, such as a custom WAF rule matching known fake-bot User-Agent patterns.

Adds experimental OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Shared Signals Framework (SSF) 1.0 Transmitter support: Keycloak pushes signed Security Event Tokens (SETs) to subscribed receivers for events like session revocation, credential change and account disable, supporting both HTTP push (RFC 8935) and HTTP poll (RFC 8936) delivery with a durable, transactional outbox and exponential-backoff retry. Maps native Keycloak events to CAEP 1.0 and RISC 1.0 profiles, plus a legacy SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. CAEP draft profile for Apple Business Manager/School Manager interoperability. A new synthetic event REST endpoint lets external SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared./IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. tools inject events that didn't originate in Keycloak. Receivers are configured as standard OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. clients via a per-client ssf.enabled toggle, ssf.read/ssf.manage scopes, a defaultSubjects policy of ALL or NONE, and a per-receiver emit-only-events allowlist. Full stream CRUD plus status, verification, and stream-config endpoints are exposed via the Admin REST API and new Admin Console SSF tabs, with Prometheus metrics under the keycloak_ssf_* namespace covering dispatcher, drainer, poll endpoints, verification flow, outbox depth, and per-delivery counters/latencies. Enabled with --features=ssf (or --feature-ssf=enabled).

$ kc.sh start-dev --feature-ssf=enabled

$ curl -s -X POST "https://my.keycloak.test/realms/myrealm/protocol/openid-connect/token" \
  -d "grant_type=client_credentials" \
  -d "client_id=caep-receiver" \
  -d "client_secret=…" \
  -d "scope=ssf.read ssf.manage"

$ bin/kc.sh start --features=ssf

Adds a preview SCIM API for automating user and group provisioning and deprovisioning via standard CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information., PATCH, filtering, pagination, and schema discovery endpoints. Enabled with bin/kc.sh start --features=scim-api.

$ bin/kc.sh start --features=scim-api

Implements the OpenID AuthZENOpenID AuthZENAn emerging standard from the OpenID Foundation that defines a common API for querying authorization engines, letting cyber tools swap policy decision points without rewriting integration code. Authorization API 1.0, exposing single and batch PDP evaluation endpoints so policy enforcement points get vendor-neutral permit/deny decisions without coupling to Keycloak's proprietary authorization API. Enabled with bin/kc.sh start --features=authzen.

$ bin/kc.sh start --features=authzen

An experimental native SSH endpoint in sandboxd lets you connect with ssh <sandbox-name>@127.0.0.1 -p 2222 using publickey auth, connect-to-create, and an interactive shell or exec; enable it with sbx settings set feature.ssh true.

$ sbx settings set feature.ssh true

$ ssh <sandbox-name>@127.0.0.1 -p 2222

The --name flag for sbx run identifies a sandbox independently of its working directory, enabling multiple named sandboxes in the same workspace and re-attachment from any directory; the old positional-name re-attach form now warns of deprecation and will be removed, and sbx run --name no longer auto-creates numbered sibling sandboxes when a same-named sandbox exists. Re-attaching to a sandbox created with a custom --kit agent now also works via sbx run --name <name> without re-passing --kit.

$ sbx run --name feature-a claude && sbx run --name feature-b claude

$ sbx run --name feature-a

Sandboxes can now route outbound traffic through a SOCKS5 upstream proxy using socks5:// or socks5h:// URLs set via DOCKER_SANDBOXES_PROXY, HTTP_PROXY, or HTTPS_PROXY, with optional proxy authentication and exclusions via DOCKER_SANDBOXES_NO_PROXY.

$ DOCKER_SANDBOXES_PROXY=socks5://proxyuser:proxypass@proxy.corp.example.com:1080 DOCKER_SANDBOXES_NO_PROXY=localhost,127.0.0.1 sbx run

Kit installs are now restricted to an allowlist of sources, defaulting to Docker Hub (docker.io/) only; installing from another registry or a Git URL fails unless its prefix is added via sbx settings set kit.allowedSources — a breaking change.

$ sbx settings set kit.allowedSources ghcr.io/myorg/

sbx secret set-custom --host and serviceDomains in kits now accept wildcard host patterns (* for one label, ** for any number of labels) and are repeatable, allowing one secret to cover multiple subdomains.

$ sbx secret set-custom --host '*.internal.corp' --host '**.api.internal.corp' MY_API_TOKEN

The experimental sbx setup command imports agent credentials from environment variables for first-time onboarding, while sbx secret import imports credential env vars into the keychain and sbx secret ls now flags env-only and OAuth-shadowed entries. Host env vars no longer auto-inject at runtime, so existing env-var-based credentials must be migrated with sbx secret import.

$ sbx secret import

sbx policy inspect examines policy details; sbx policy check network tests whether the current policy would allow a specific network access request before executing; sbx policy ls is revamped with --wide, --source, and --decision filters for concise listing; and sbx policy set-default is renamed to sbx policy init (the old name kept as a hidden deprecated alias).

$ sbx policy check network --host api.example.com --port 443

sbx kit add now recreates the sandbox container with the full kit set while preserving state, applying the kit's network allow/deny rules and composed policy. Kits can also inject the user's Docker login token into requests to docker.com hosts via a credential with service sbx-login.

virtiofs caching is now enabled by default on macOS and Linux for faster filesystem performance, and this default was extended to all operating systems, with opt-out via DOCKER_SANDBOXES_ENABLE_VIRTIOFS_CACHE=0.

New sbx daemon command adds start, stop, status, and log-level subcommands for managing the sandbox daemon's lifecycle.

sbx rm now requires the --force flag to delete an active session, preventing accidental teardown of running sandboxes.

Kit artifacts now use OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. v2 streaming, decompressing layers once to a cache directory and using seek-based random access, reducing memory pressure during kit reads.

Sandbox DNS resolution is now gated on network policy, closing a DNS-based data-exfiltration channel (CVE-2026-12039), with loopback names remaining exempt; outgoing ICMP from sandboxes is now blocked persistently across daemon restarts (CVE-2026-12539).

Linux arm64 build packages are now produced, extending platform support, and a new keychain fallback to an encrypted on-disk store activates on Linux when dbus-launch is unavailable, enabling headless/server deployments.

sbx cp -L now follows symlinks in the source path for sandbox-to-host copies, and sbx exec now uses the same working directory as sbx run.

Detects malicious symlinks pointing to sensitive files at git clone time, catching GhostApproval-style attacks before the AI coding assistant is even involved. It also monitors writes to sensitive files (e.g., SSH authorized_keys) at write time, triggering alerts regardless of whether the write originates via a symlink, and auto-elevates alert severity when the malicious activity originates from an AI coding assistant process operating on untrusted repositories.

Adds Source Attribution to the Policy Evaluations log via two new columns — Source and Source Identifier — tracing every package request to the developer machine or CI pipeline that made it. Attribution is opt-in by appending an identifier suffix to the API key token: ::dev: for developer machines and gha: for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. pipeline runs.

New Secret Exfiltration Attempt detection flags workflow runs combining known attack indicators — malicious workflow name, toJSON(secrets) secret dump, suspicious commit message, and an exfiltration artifact — before stolen secrets can be retrieved. Confidence scoring elevates a detection to High when the workflow run, branch, or workflow file is deleted shortly after execution, treating evidence removal as a strong exploitation signal. The Detections page provides direct navigation to the affected repository, matched rule, indicators, workflow file, and the exact job, step, and line where the secret dump occurred, and alerting can be opted into via Notification Settings for immediate notification.

Supports Cosign keyless (OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.) signing for versioned and FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. arc-harden-runner and broker image manifests published to ghcr.io, enabling supply-chain verification.

$ cosign verify ghcr.io/step-security/arc-harden-runner/arc-harden-runner:v2.18.3 \
  --certificate-identity-regexp 'https://github.com/step-security/arc-harden-runner/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

$ cosign verify ghcr.io/step-security/broker/broker:v1.3.0 \
  --certificate-identity-regexp 'https://github.com/step-security/broker/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Adds Maven Package Compromised Updates PR control (blocks pull requests introducing or updating a Maven dependency flagged in StepSecurity's compromised-packages database), Maven Package Cooldown PR control (blocks PRs adding recently published Maven versions until they age past the configured cooldown window), and Maven ecosystem selection in OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. Package Search for blast-radius analysis of Maven packages across pull requests, default branches, and developer machines.

New disk-based package scanning for npm (lockfile parsing) and Python (dist-info metadata) adds a scan cache and concurrent workers for faster runs; the previous method remains available via the use_legacy_package_scan opt-out.

Adds broker pod-spec customization via new Helm values under broker.* — volumeMounts, imagePullSecrets, automountServiceAccountToken, serviceAccountName, resources, nodeSelector, tolerations, affinity, topologySpreadConstraints — for scheduling the broker alongside strict workloads.

Device Policy enforcement via the DMG agent is now generally available, enforcing approved VS Code extension sets on developer machines without requiring MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.; policies can be assigned per device or globally from the dashboard.

Harden Runner supports egress-policy: block mode on macOS and Windows GitHub-hosted runners, enabling outbound traffic restriction (not just auditing) on these platforms.

- uses: step-security/harden-runner@v2.20.0
  with:
    egress-policy: block
    allowed-endpoints: >
      api.nuget.org:443
      github.com:443

New Typosquatting Protection control blocks packages whose names closely resemble popular packages, configurable per ecosystem, with a Whitelisted Packages allowlist to clear false positives by exact package name.