Cloudflare halves DNS build delay with targeted zone builds and cuts peak memory by 85%
Cloudflare's Zone Builder now rebuilds only what a zone setting change provably touches, instead of whole zones that can hold more than 20 million records.
Cloud
CloudFront can now tell an origin the viewer's ISP and whether TLS used PQC
Two new optional headers, CloudFront-Viewer-ISP and CloudFront-Viewer-TLS-Details, are forwarded to the origin through an origin request policy.
Cloudflare opens private origins to all: WAF and caching without a public IP
A proxied DNS record can now point at an RFC 1918 or CGNAT address and reach the origin over the customer's Cloudflare One link; private-to-private traffic is targeted for a closed beta in early 2027.
Cloudflare Q3 DDoS report: short bursts up 208%, terabit attacks down
18.2 million network-layer attacks were mitigated in July to September; CLDAP floods all but vanished while DNS amplification rose 215% and the US again tops the list of targets.
Aurora Serverless now scales PostgreSQL to 384 ACUs, about 768 GiB of memory
The ceiling rises 50% from 256 ACUs, only on Platform Version 4 and specific engine versions; existing PV4 clusters change the setting without downtime.
AWS KMS adds ML-KEM key pairs with Encapsulate and Decapsulate APIs
All three FIPS 203 parameter sets are supported; private keys stay in FIPS 140-3 Level 3 HSMs, and UAE, Bahrain and China Regions are excluded.
Cloudflare ties post-quantum keys to a region with hybrid ML-KEM-768 wrapping
A closed beta of a geographically fenced key manager wraps decryption keys so only servers inside the chosen region can unwrap them, built to resist harvest-now-decrypt-later.
Cloudflare will score Verified bots on whether they obey robots.txt and back off on 429
A new system turns observed crawler behaviour into an explainable trust band; scores are due on Radar later, and customers will be able to set their own threshold.
DynamoDB Streams can now start reading at a timestamp with the AT_TIMESTAMP shard iterator
Announced on 15 October, the option sits between TRIM_HORIZON and LATEST; it works through the Kinesis adapter 2.5.0 or later, needs no new permissions and costs nothing beyond GetRecords.
CloudWatch pipelines add conditional log routing and chained parsers
Amazon CloudWatch can now send each log event from a pipeline to a different log group based on processed fields, and apply several parsers in sequence, such as a JSON envelope followed by Grok.