Origin Range Requests: Cloudflare serves large files without tuning
Cloudflare introduced Origin Range Requests, a self-service feature that changes how partial HTTP downloads are satisfied to cut extra data movement and speed large-file reads.
Updated every morning
Web Development
WordPress, browsers, web platform, and developer tooling news, explained for site owners and the people who build for them.
php2shell vulnerability: Cloudflare deploys WAF protections
Cloudflare says it deployed web application firewall protections ahead of public disclosure for two php2shell flaws in PHP that can lead to remote code execution, data exposure, or denial of service.
PHP security update: critical release requires immediate action
The PHP project released a security update that fixes two critical vulnerabilities. Site owners should check with their host and update PHP as soon as possible to reduce risk.
NetScaler gateway security: protect login pages after Citrix flaw
A Citrix NetScaler vulnerability let attackers run commands without signing in. Cloudflare recommends urgent patching, fronting login pages with access controls, and tightening origin restrictions.
Logpush Transformers let you filter and reshape Cloudflare logs
According to the Cloudflare Blog, Cloudflare made Logpush available on all self-serve plans and released Transformers generally available, letting teams run SQL-style filters and redactions before export.
GitHub secret scanning gets faster, more accurate with new AI model
GitHub announced a new context‑aware AI classifier that reduces false secret alerts by 11.5% and speeds post‑push scans by 86%, making secret detection more reliable and cheaper.
GitHub secret protection adds fast AI classifier to block more secrets
According to the GitHub Blog, GitHub introduced a new, low-latency AI classifier that can more than double the secrets blocked at push and will roll out to Cloud, Teams, and Server previews.
Root KSK rollover on Oct 11: what web teams must check
On October 11, 2026 the DNS root will switch its key-signing key. Most sites need no change, but teams running DNSSEC-validating resolvers should verify they trust KSK-2024 to avoid reachability problems.
WordPress security update: 7.1.3 fixes seven security issues
WordPress 7.1.3 is a maintenance and security release that addresses seven security issues and four bug fixes. WordPress.org recommends updating sites immediately; here is what changed and what to do.
New Account Abuse Dashboard Helps Spot Credential‑Stuffing Attacks
Cloudflare has released a dashboard that aggregates login and signup activity, making it easier for fraud teams to spot abnormal patterns and investigate compromised accounts.
Workers KV Instant: Cloudflare brings Quicksilver speed to KV data
Cloudflare announced Workers KV Instant, a new KV mode powered by Quicksilver that delivers much lower read latency and instant global updates for small, read-heavy configuration data.
AI-driven testing shows Cloudflare WAF still blocks most frontier model attacks
Cloudflare used large language models to act like a hacker and probe a staged web app. Out of 1,107 attempts, most attacks were blocked, but the exercise uncovered dozens of SSRF and command‑injection leads that helped improve the service.