Cloudflare Summary - September 2026

Several days of unprocessed alerts piled up this week, so here is a consolidated recap of 21 to 27 September, ordered from most to least relevant.

What happened. French email marketing platform Brevo was compromised in two phases. On 10 September attackers leveraged a vulnerability in its SAML SSO and accessed 138 customer accounts. Four days later they came back, this time using a Cloudflare API key with full permissions that had been left forgotten and embedded in source.

How they did it. With that key they deployed a malicious Cloudflare Worker that rewrote HTTP responses directly at the network edge, without touching any source file, which made the attack extremely hard to detect with traditional audits. They combined it with a hidden WordPress plugin that installed itself without extra authentication on admin sessions, and a fake clickfix that only showed up to admin profiles to bypass detection systems.

Scope. More than 100,000 websites served malicious code for several hours on 14 September. Affected names include eBay, Louis Vuitton and Michelin, and Trezor (cryptocurrency wallet maker) confirmed the compromise of 347,000 contact addresses.

Why it matters for Cloudflare users. The attack vector was not a vulnerability in Cloudflare's own infrastructure but an API credential that was never rotated. It is a very direct reminder that Workers operate without leaving the code of origin and become an especially attractive target when a key is exposed. Time to revisit periodic token rotation, scoped API tokens and auditing of Worker deployments on our own accounts.

What was signed. A three-year collaboration protocol between the Community of Madrid and Cloudflare, dubbed Madrid Digital AI Trailblazer, aimed at strengthening the security of public administration and Madrid-based companies in light of the advance of AI.

What it includes. Application of agentic AI and automation to around 1,400 administrative procedures; a startup acceleration programme with access to Cloudflare secure infrastructure; three editions of training and certification (up to 300 participants each); AI labs with advanced tooling and advisory; extension to research projects at Madrid universities; and adoption of encryption and authentication systems.

The most striking data point. Cloudflare is exploring installing its European operations centre in Madrid, which would make the region a relevant piece of its European infrastructure.

Why it matters. It is one of the most ambitious public-private digital infrastructure agreements signed in Spain this year, and if the European operations centre materialises it would have direct implications in latency and data sovereignty for European Cloudflare customers.

What Cloudflare announced. New controls (Disallow AI Training) that let website owners reject the training of AI models with their content without affecting indexing in traditional search engines. Until now, the same crawler could index content for search and use it to train models, forcing a choice between visibility and protection.

Technical details. Cloudflare replaces the previous generic controls with three specific categories of crawlers: Search (building indexes), Training (collecting data for models) and Agent (real-time access on behalf of users). A new Accountable designation is also introduced for crawlers that meet certain transparency requirements and ensure that blocking training does not penalise ranking; for now it is held by Apple, Google and Microsoft. Since 15 September, Cloudflare blocks AI training crawlers by default on ad-monetised pages unless the publisher grants explicit authorisation.

A revealing data point. Less than 1% of sites block search crawlers, but already 17% use some mechanism to prevent AI training. It is a clear signal of where publisher sentiment is going.

What it means for us. No immediate action is needed, existing configuration is migrated automatically and the feature is available on all plans at no extra cost. It is a relevant change: two decisions that until recently were de facto tied together are finally separate.

What EvilTokens was. A phishing-as-a-service platform that operated on Telegram, offering ready-made web panels to capture Microsoft Office 365 authentication tokens. Its hook: access to victims' corporate mailboxes persisted even after they changed their password, thanks to stealing the session token itself.

The operation. Coordinated on 15 September between Cloudforce One (Cloudflare's threat intelligence team), Microsoft's Digital Crimes Unit and several government authorities. Hundreds of domains were blocked, Cloudflare Worker accounts used by the attackers were cancelled, and automated detection rules were deployed.

The most unsettling detail. The platform included an AI assistant that guided attackers on how to structure fake US tax documents and on business email compromise (BEC) tactics.

What Cloudflare recommends. Adopt FIDO2 / WebAuthn security keys (resistant to this kind of phishing), shorten the duration of active sessions, and configure conditional access with detection of suspicious geographies.

The data point. According to Cloudflare, automated traffic surpassed human traffic on its network back in May 2026, earlier than the company itself expected. Its CEO, Matthew Prince has gone as far as saying only 4 out of 10 visits to the internet now come from people.

The most striking projection. Prince anticipates that by 2031 the volume of non-human traffic could be up to 1,000 times larger than human traffic. Best read as an executive projection, not a confirmed measurement.

The figures that are measured. The ratio of Google crawlers to human visitors has gone from about 6:1 to 18:1 (or more); and AI training crawlers already account for 40% to 52% of all AI crawling activity. Important: these numbers are specific to Cloudflare's network, not to the internet as a whole.

Why it matters. If such a large part of your real traffic is actually machine traffic, it is worth checking how much of your classic analytics may be inflated, and starting to treat AI agents as an audience with its own needs and behaviour, not as background noise.

What's new. Cloudflare has refreshed Quick Tunnels (also known as TryCloudflare), which exposes a locally running server to the internet with a single command, no account, no DNS configuration, and no open router ports. It creates a temporary URL at trycloudflare.com that changes on every run, and now offers JSON output designed for AI agents and automation scripts to capture the address and integrate it into their workflows. Useful for sharing game builds, 3D viewers or internal tools with a remote team.

The security caveat that still stands. RedesZone reminded us this week that these URLs are not hidden from Google, which is able to index the generated subdomains. Anyone can find and access a project that was supposed to be temporary or private if no extra precaution is taken, since the service has no authentication by default.

The combined recommendation. For truly one-off tests with no sensitive data, Quick Tunnels remains convenient. But for anything that will be accessible for more than a few minutes or contains sensitive data, prefer Cloudflare Tunnel (the serious version, with wildcard certificates that do not expose subdomains) and always add an extra authentication layer.

The achievement. Cloudflare's team freed 100 TB of RAM in its infrastructure by tuning the Pingora cache framework (written in Rust), with no impact on performance or load distribution.

How they did it. They reduced cache hash map entries from 100,000 to 10,000 per server after statistical analysis showed diminishing returns above 10,000 entries: adding more entries barely improved real traffic management. They also optimised data structures to shave 2 bytes per entry.

Why it matters. It is a good reminder of large-scale infrastructure engineering: measuring before scaling is usually more effective than adding resources by inertia. For those running their own services on Cloudflare or designing large-scale caching systems, it is a textbook case study.

What Jev is. An AI model by TypeSafe AI designed to make structured decisions rather than generate free text: it returns typed choices, scores and confidence levels that software can consume directly.

Its arrival at Cloudflare. Launched on 15 September, Jev landed on Vercel's AI Gateway within 24 hours, and Cloudflare already documents it as a third-party model available on Cloudflare Workers AI, accessible via REST API or TypeScript SDK, with a 32,000-token context.

Performance and use cases. Around 67.8% accuracy (similar to Claude Sonnet 5) at an approximate cost of $0.0004 per decision and 0.4 seconds of latency. It is useful for routing support requests, classifying incidents by severity, or deciding which tool an agent should use. Caveat: it does not generate explanations and struggles with arithmetic or date comparison.

Why it matters. One more signal of where edge AI infrastructure is going: lightweight, specialised models for repetitive decisions, integrated directly into Cloudflare Workers AI, leaving the large models for tasks that actually require reasoning.

Good morning. Here is the recap of the most relevant Cloudflare news from the last few days, ordered from most to least important for those of us running on its infrastructure.

What Cloudflare announced. According to the company's own numbers (covering more than 20% of global web traffic), automated traffic (bots, crawlers and AI agents) surpassed human traffic on its network in May 2026, a year earlier than the company itself had forecast. In concrete numbers, 57.4% of analysed web requests come from automated systems versus 42.6% from people, reaching 69% in North American traffic. Cloudflare CEO Matthew Prince goes further and projects that in five years machine traffic could be up to 1,000 times larger than human traffic.

Key points and technical implications. Cloudflare distinguishes several kinds of automation: search engine crawlers, monitoring systems, security tools, real-time agents and programmes that scrape content to train AI models. To address this paradigm shift economically, Cloudflare is working with Coinbase and Stripe to revive HTTP status code 402 (Payment Required), letting website owners charge a fraction of a cent every time an AI agent accesses a page. This moves the debate from crawl control (robots.txt, blocks) to economic conditions of access to content.

What it means for Cloudflare businesses and users. The traditional advertising model loses effectiveness when whoever visits a site is a machine that does not generate ad conversions. Anyone running sites on Cloudflare should start familiarising themselves with bot management tooling and the upcoming HTTP 402 micropayments mechanism, which could become a new revenue stream (or cost, depending on the role) for AI agent access to their own content.

What Cloudflare announced. Cloudflare and the Community of Madrid have signed a three-year collaboration protocol to strengthen the digital security of the public administration and regional companies in the face of advancing AI.

Key points and technical implications. The agreement covers the deployment of agentic AI and automation to streamline more than 1,400 administrative procedures, as well as encryption and authentication systems to harden public digital infrastructure. It includes the Madrid Digital AI Trailblazer programme for senior digital transformation officers, a startup acceleration programme with access to Cloudflare services (up to three editions of training and certification, with 300 participants each) and support for university research projects. A fact to watch: Cloudflare could establish its European headquarters in Madrid.

What it means for Cloudflare businesses and users. A relevant institutional expansion move in Spain, which can translate into greater Cloudflare adoption in the Spanish public sector and new opportunities for startups that want facilitated access to its security and infrastructure stack.

What Cloudflare announced. Cloudflare has taken part in an operation together with Microsoft (through its Digital Crimes Unit) and law enforcement to take down EvilTokens, a phishing-as-a-service (PhaaS) platform active since January, distributed on Telegram and notable for incorporating AI assistance to craft attacks.

Key points and technical implications. EvilTokens operators let their users employ Cloudflare API keys to set up malicious Workers that harvested credentials, set up phishing pages, and automated session token extraction, with persistent access even after token expiration. Cloudflare responded with an exhaustive sweep: blocking of hundreds of domains and Worker projects, and deployment of security warning pages at domain registrars in uncooperative jurisdictions. Microsoft, for its part, filed legal complaints to force registrars to suspend the implicated domains.

What it means for Cloudflare businesses and users. A reminder that Cloudflare infrastructure itself (Workers, API) can be abused by malicious actors, and of the importance of reviewing permissions and API key usage on our own accounts. It also reinforces the image of Cloudflare as an active player in the fight against cybercrime in partnership with other big tech companies.

If you want to dig into the infrastructure on which all of this is built, you can start with the Cloudflare entry on Wikipedia.