Cloudflare status: hosting issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of Cloudflare reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by Cloudflare users through our website.

• Cloud Services (58%)
• Hosting (25%)
• Domains (17%)

Live Outage Map

The most recent Cloudflare outage reports came from the following cities:

City	Problem Type	Report Time
Ahmedabad	Cloud Services	3 days ago
Le Puy-en-Velay	Cloud Services	4 days ago
Ann Arbor	Cloud Services	6 days ago
Palermo	Hosting	6 days ago
New York City	Hosting	15 days ago
New York City	Cloud Services	1 month ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Cloudflare Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Austin (@IamAroke) reported 4 minutes ago

  @nickstewart_ Cloudflare went down because of a regex. That's not a joke, that actually happened.

• 
  pkuseri (🍉) (@Pkuseri_) reported 4 minutes ago

  @stupidtechtakes Do you know any better alternatives aside cloudflare? Not being rude or anything if the tone sounds rude mb

• 
  Michael Bruno (@brubarian) reported 7 minutes ago

  @RockyCapital18 @TMTLongShort Yes - but it's more of a framework because some rx/diligence are on the private side. But big blue arrow: 1. What are the top three pieces of information that I want to have? 2. What role/function would use this data to solve their own problem? e.g., A DoW analyst wants to know where to buy widgets for a Humvee; how would he try to find the answer? Or a gas station owner wants to know how many Poland Spring bottles to order based on expected highway traffic because of the Sturgis motorcycle rally. 3. Which US institutions/think tanks/policy/others have the raw data? (too many to list) 4. Download CSVs, databases, etc. to desktop to isolate it, Claude from hallucinating or pulling information from the internet. (You may have to get a cloudflare/suprabase/*** to help facilitate accelerated use.) 5. Instruct Claude to clean the data sets (this used to be what data scientists spent most of their time on; NaN, void answers, separating street addresses from state, etc.) 6. In clear, concise, simple language, ask Claude to take XYZ categories of data and produce a snapshot to serve a "product manager at company XYZ" or a "credit risk manager at Bank ABC", etc. 7. Adjust and iterate. Force Claude to produce "Tufte" data visualizations. If Claude is left to run linear/logistic regressions, it becomes a science project instead of a problem-solving or illuminating exercise. 8. Force Claude to explore. e.g., take an analogy, "You are a surgeon; this data set is akin to human nervous system, if you were performing surgery, which node, if removed would destroy the utility of the system"? Random questions like this. Analogically map it in unique ways. Claude RL underbelly does nicely here. And as a guiding principle, I'd suggest focusing on being creative. The best definition I've seen is from Bruner: "Creativity is a way of figuring out what you already know in order to go beyond what you currently think."

• 
  ⚛︎ Daddio ⚛︎ (@ScienceDaddio) reported 9 minutes ago

  @grok @DaddioAI E4H.1 is implemented. The pump-activity table is now the reusable presentation surface; events are optional overlays, not duplicate source tables. Raw duration rows stay immutable. E4G.6B canonical stable-ID work is intact (trend_report.html, trend_report.js, test/trend-report-stable-id-e4g6b.test.js). The workspace is not a *** repo, so that was confirmed by file inspection, not *** status. Codex had only started reading; no detector or research files were rewritten. ─── 1. Working-tree inspection No *** repo. Inspected files vs the E4G.6B baseline. E4H.1 presentation files were already present from the interrupted session. This closeout preserved that work, then stopped overlaying Current Assembly / Station Packet tables so automatic assembly still uses detector is_event_row highlighting instead of the new ERT overlay. 2. Distinction from E4G.6B E4G.6B remains: stable IDs and trend_report.js?v=e4h1-e4g6a-e4g6b. E4H.1 added presentation state, ERT overlay, settings UI, and Search Tables controls. Research under research/e4c8g/ was not touched. 3. Existing table architecture found Canonical BossDataTable renders Trend Report, Search Tables, and exports. Manual/Search tables use the approved catalog with exact start/end, pump, and sort. Event tables keep Context Before/After. Snapshots store source columns/rows; presentation is a separate optional field. EMAIL-v1 already highlights via is_event_row. 4. Existing fixed ERT architecture ┌──────────────────────────────────────┬──────────────────────────────────────┬─────────────────────┐ │ Layer │ Behavior │ E4H.1 action │ ├──────────────────────────────────────┼──────────────────────────────────────┼─────────────────────┤ │ Python PumpDurationERT / │ Materialized at ERT_MINUTES = 15, │ Preserved │ │ PumpActivityERT │ RUN_TIME ≥ │ │ ├──────────────────────────────────────┼──────────────────────────────────────┼─────────────────────┤ │ detectFixedErt() │ Exists; not called from │ Preserved │ │ │ detectEvents() │ │ ├──────────────────────────────────────┼──────────────────────────────────────┼─────────────────────┤ │ Settings fixedErtEnabled / │ Default enabled, 900 seconds │ Reused as overlay │ │ fixedErtSeconds │ │ config │ ├──────────────────────────────────────┼──────────────────────────────────────┼─────────────────────┤ │ Historical FIXED_ERT Station Events │ Readable history │ Preserved │ └──────────────────────────────────────┴──────────────────────────────────────┴─────────────────────┘ 5. Existing Adaptive Long Runtime architecture detectAdaptiveRuntime() remains in detectEvents(). Station Events, Current Assembly, and report generation still consume Adaptive events. No silent detector swap. 6. Settings architecture Existing analysis settings: global row + per-station overrides in analysis-settings.js, Station Review cards, PUT /api/station-review/settings/global and station override PUT. No parallel settings universe. 7. ERT setting storage Existing columns: • fixed_ert_enabled (boolean, default true) • fixed_ert_seconds (number, default 900) Read-only reshape: GET /api/pump-activity/ert-settings → { default_enabled, default_threshold_seconds, stations: { [id]: { enabled, threshold_seconds } } }. Writes go through the existing Station Review settings APIs. No new write endpoint. 8. ERT defaults 15 minutes (900 seconds) when no station override exists. Sands is not hardcoded. 9. Threshold semantics Granular rows only: RUN_SECONDS >= station.threshold_seconds Annotation metadata records comparison: 'gte'. Equality counts (6:00 at a 6-minute threshold is ERT; 5:59 is not). Validation range: finite, 1 to 2,592,000 seconds (1 second through 30 days). That is the existing analysis-settings bound. UI is minutes: 0.0167–43,200, converted × 60 on save. Allowed values include 6, 10, 15, 17, 20, 30 minutes. Invalid overlay input clamps to 900 seconds; settings save still rejects out-of-range values. 10. Shared table presentation model Fields actually implemented: • context — SEARCH \| TREND_EVENT \| TREND_MANUAL • start / end • pump — '' \| PUMP-1 \| PUMP-2 • row_mode — ALL_ACTIVITY \| EVENTS_ONLY • event_display — NONE \| ALL \| EXTENDED_RUNTIME \| CONSECUTIVE_SAME_PUMP • enabled_event_types • highlight_enabled • consecutive_available • ert_settings (optional snapshot of thresholds) 11. Annotation provider model src/public/pump-activity-presentation.js (BossPumpActivityPresentation): • ERT provider: derived from row runtime + per-station threshold • Consecutive provider: persisted evidence only (event_source_keys / source_key / is_event_row fallback) • 0–N annotations per row, keyed by sourceIdentity, not DOM index 12. Raw data integrity applyPresentation clones rows. Source objects are not mutated. Annotations are not written into duration history. Tests stringify the source array before and after. 13. Trend Report integration User-inserted granular tables get a collapsed Table Display card: Start, End, Pump, Rows, Events, Highlight Events, Apply. Event-from-tray tables default All Events + Highlight ON. Manual/Search-style inserts default None + Highlight OFF. Apply updates the same Canvas section (no duplicate). Context Before/After still exist; once they produce a new window, annotations follow that window. Current Assembly and Station Packet tables do not attach overlay presentation and do not show Table Display. They keep detector is_event_row highlighting. 14. Search Tables integration Granular duration tables (pump_runs, pump_durations, PumpDurationERT, rolling48_all, *_durations) show Rows / Events / Highlight. Defaults: Events: None, Highlight: Off, All Pump Activity. Consecutive is not offered. Aggregate tables (PumpActivityDaily, PumpActivitySQL, PumpActivityERT, StationActivityDaily) stay plain with the bar hidden. 15. Generate Report / aggregate handling Generate Report was not merged or redesigned. PumpActivityDaily MAX above threshold is not treated as a granular ERT event (aggregate: true, no Event column). 16. Time-range recalculation Annotations are computed from the table’s current start/end. Expand the window → newly visible ERT rows annotate. Contract → out-of-range annotations disappear. The table is not married to the initiating event. 17. Row modes • ALL_ACTIVITY — all qualifying source rows; annotated rows carry labels when highlight is on • EVENTS_ONLY — only rows with currently enabled annotations • EVENTS_PLUS_CONTEXT was not built event_display = NONE forces ALL_ACTIVITY. 18. Highlight toggle / plain mode Highlight OFF (or Events = None): no event-row class, no Event column, no event_labels / event_annotations, no threshold text in the row payload. Same source rows, visually plain. 19. Pump filter Both / Pump 1 / Pump 2 preserved. Annotations follow remaining rows. 20. Sorting Existing newest/oldest/runtime sorts remain. Highlight class uses sourceIdentity, not row index. 21. Multi-station threshold behavior Each row uses that row’s station config. Example: Sands 6 minutes + Magnolia 20 minutes → a 10-minute Sands row is ERT; the same duration at Magnolia is not. 22. Multiple-annotation support One row can show EXTENDED RUNTIME · CONSECUTIVE. Structure is a list, not one-event-per-row. 23. Consecutive compatibility Now: Trend Report event tables may show persisted Consecutive annotations when source keys or is_event_row evidence exists. Deferred: no detectConsecutiveRuns() changes, no LG30/C1, no historical reconstruction. Search Tables are ERT-only because complete Consecutive evidence is not available there. 24. Adaptive legacy behavior Preserved. Adaptive still feeds Station Events and Current Assembly. The new overlay is fixed-threshold ERT only. 25. Legacy fixed ERT tables PumpDurationERT and PumpActivityERT remain in the catalog and Python pipeline at 15 minutes. 26. Canonical snapshot / save-reopen presentation is optional on table sections. Legacy snapshots with presentation: null still validate and render with is_event_row. New snapshots store view state (including ert_settings when present) and reapply on reopen. 27. EMAIL rendering HUB presentTableSection applies the overlay when presentation is set and the table is not assembly-bound. EMAIL-v1 was not modified. Highlight still uses is_event_row; HUB sets that flag from overlay identity when annotations are shown. Plain presentation leaves rows unhighlighted and without an Event column. Cloudflare requests stay 0 in tests. 28. Auto/custom narrative autoTableNarrative() exists as a helper only. It is not wired into Current Assembly. Deferred to E4H.2. 29. Future AI compatibility A later local AI can set the same structured presentation object (station/start/end/pump/row_mode/event_display/highlight_enabled) without HTML-specific logic. No AI was implemented. 30. Files created • src/public/pump-activity-presentation.js • test/pump-activity-presentation-e4h1.test.js • test/pump-activity-table-integration-e4h1.test.js 31. Files modified • src/public/trend_report.js • src/public/trend_report.html • src/public/data_views.js • src/public/data_views.html • src/public/station_review.js • src/public/station_review.html • src/public/styles.css • src/server.js • src/services/saved-reports.js • src/services/trend-report-email.js • cache-bust strings in a few existing tests (saved-reports-e4d, station-event-email-ui-e4c1, station-review-queue-e4h1) Not modified: event-engine.js, analysis-settings schema (reused), Python ERT builders, EMAIL-v1, research/. 32. Focused E4H.1 tests 30 / 30 33. Search Tables regression 40 / 40 (catalog, exact time, pump, historical durations, shared renderer) 34. Trend Report regression 85 / 85 on X4 + E4G.6 / 6A / 6B core files; remainder included in full HUB 767. 35. Saved Report regression 16 / 16 (saved-reports-e4d + report-table-compatibility-e4d2) 36. Event/detector regression 54 / 54 (local events, event quality, fixed-ERT workflow, event presentation) 37. HUB full regression Starting baseline 737 / 737. 767 / 767 (737 prior + 30 E4H.1 tests) A first parallel run hit 766/767 from two suites sharing temp files; the serial rerun was 767/767. 38. EMAIL full regression 64 / 64 39. Capture reliability 9 / 9 40. Production DB writes 0 in tests. ERT settings GET is read-only. 41. Real emails sent 0. Cloudflare requests 0. 42. Real captures 0 43. Detector files modified NO. detectConsecutiveRuns() unchanged. detectFixedErt() still unused by detectEvents(). 44. Research files modified NO 45. Manual owner QA Live BOSS UI was not opened in a browser from this session; behavior was verified with node --test. Please confirm: 1. Station Review → settings: EXTENDED RUNTIME Enabled + Threshold (minutes). Set a station to 6.0; confirm storage is 360 seconds. Confirm Adaptive controls are unchanged. Confirm email/SMS are not flipped on. 2. Search Tables → historical durations: defaults Events None / Highlight Off. A 20-minute row looks like any other row. Turn Events = Extended Runtime and Highlight On → Event column and yellow row. Highlight Off → same rows, fully plain. 3. Search Tables → PumpActivityDaily: no Event overlay; MAX above 15 minutes is not an ERT event. 4. Trend Report: drag a Station Event table. Table Display exists. Defaults All Events / Highlight On. Events Only hides ordinary rows. Changing Start/End then Apply reloads annotations for the new window. Apply does not create a second Canvas section. 5. Current Assembly: no Table Display / Apply. Consecutive/Adaptive detector rows still highlight via is_event_row. No extra Event column from the overlay. 6. Save / reopen / email a mixed report: annotated user table stays annotated; a plain table stays plain; a pre-E4H.1 saved report still opens. 7. Multi-station granular table: different thresholds on two stations; a 10-minute run annotates only the 6-minute station. 46. Recommended E4H.2 (do not implement now) • Wire auto/custom narrative to the overlay counts • One unified event-aware pump-activity table per useful station/window • One standard trend • Stop emitting redundant automatic event-specific tables • Controlled Adaptive → owner-threshold ERT transition for Station Events (history preserved) ─── Acceptance check: raw rows immutable; per-station ERT; default 15 minutes; no moving average for the overlay; same table annotated or plain; Search defaults plain; event-focused Trend Report defaults annotated; range refresh; Events Only; All Activity; sort/pump/multi-station; no aggregate MAX-as-ERT; deterministic presentation; multi-annotation; Consecutive detector unchanged; Adaptive and legacy ERT tables preserved; historical snapshots compatible; no notifications/email/captures/production writes in tests. Stopped here. Automatic report assembly was not redesigned.

• 
  🍄 DO NOT FOLLOW TIMO 😈 (@liltechnomancer) reported 11 minutes ago

  @thdxr Because you have process issues. If you didn't extensions would work on cloudflare.

• 
  Wes Roth (@WesRoth) reported 11 minutes ago

  Cursor cloud agents can now run on infrastructure you manage, including machine pools that automatically scale with demand. Self-Hosted Machines let agents execute inside your network with access to internal services, source control, custom hardware like GPUs and Macs, and existing build infrastructure, while inference, planning, and the agent loop remain in Cursor’s cloud. Cursor also supports AWS Lambda, Cloudflare, Coder, Daytona, E2B, Modal, Namespace, and Vercel. Cursor says cloud agents now create more than 60% of the pull requests it merges internally.

• 
  Adam Rackis (@AdamRackis) reported 12 minutes ago

  @kettanaito @flydotio Do your pods auto-sleep when they’re not getting traffic? I think there’s a min setting you have to set to zero to let everything shut down and then just cold start on the next request. Really though surely Cloudflare free tier is simpler?

• 
  Sahil Mondal (@SahilMondal_) reported 12 minutes ago

  The fastest way to crash PostgreSQL is opening direct connections inside Serverless Lambdas. 1,000 concurrent requests = 1,000 DB connections = OOM crash in 2 seconds. Fix: Put PgBouncer or Cloudflare Hyperdrive in front. Keep 20 persistent connections open and reuse them.

• 
  Sameer Bhagtani (@sameerbhagtani) reported 14 minutes ago

  @NiceCodeWriter You should make use of cloudflare tunnels. That should solve your problem.

• 
  Tang Vu (@tangvu_dev) reported 16 minutes ago

  I compared Cloudflare Workers and Vercel Edge Functions, two production platforms built on V8 isolates, using a latency-sensitive crypto analytics service. The workload fetched prices and computed OHLC + VWAP over 24 kline periods.

• 
  Declan | Rust Developer (@buildWithDeclan) reported 21 minutes ago

  @acolombiadev @Cloudflare Thats why i am loyal to them. They provided services when i was poor. All my platforms are in cloudflare

• 
  LilRhodySpecial (@rhody_special) reported 23 minutes ago

  @Sprytixl Yet another ad to get you to use their data stealing bot on the cloudflare data snooping service

• 
  Selenka (@SelenkaOnChain) reported 26 minutes ago

  Netnet Capital team is flexing metrics and talking about successful launch of Subway Runner... Meanwhile, 2 vibecoders literally drained their entire mechanic and became the #1 and #2 top holders. Here is the breakdown directly from one of the guys who farmed them: 🧵👇 "First decent cook of the bull run (if we’re even in one). Spent the last few months trying to get good at on-chain analytics, so hadn't been actively cooking. Two nights ago, I'm watching the feed and notice everyone sending $10 clips to this CA: 0x8154e35166f21305adac82f95b54de8acd44d23a. Instantly smelled pure degen activity. Hit up the group chat, did some digging - turns out it’s a Subway Surfers / Chrome dino style runner game by NetNet. Their shitcoin was sitting at a $90M cap at the time, so I figured if their token is holding that kind of valuation, there’s definitely meat on the bone. Normally, their games are pure casino trash: deposit cash, pray to RNGesus, or get rekt. But why not test it? Played a run manually and noticed that at the end of each game there was a draw. Checked their TG and reverse-engineered the contract - turns out there’s an N% chance to win an NFT from their collection. Their previous official collection had crazy volume and peaked hard, so my degen senses started tingling: this was a hidden gem. Literally 15 minutes later, they pause the game. Perfect timing - gave us room to prep. By that point, I had already captured the WSS traffic and requests. Their game logic was using a basic commit-reveal scheme: courseCommit = keccak256(serverSecret) seed = keccak256(serverSecret ++ playerSalt ++ runId) Meaning: right at game start, the server literally sent us the secret, allowing us to compute the seed and reconstruct the entire track in advance. The game loop: 3 lanes, 30 coins, 3600 ticks to finish (60 seconds). You dodge obstacles while longing/shorting NVDA. 3 hits = you lose the full $10. Complete a flawless run = you collect all coins to refund your stake and it only burns ~$0.20 in fees, giving you an almost free roll at the NFT lottery. In the era of AI and vibecoding, this was child's play. My boy XXX and I started spinning up bots in parallel. Ended up deploying his script since he coded it faster. We simulated runs, got a 100% win rate, set up a websocket listener for when the contract unpauses, and went to bed. Woke up at 6 AM, and literally 30 seconds later the game goes live. We spun up the bots - 5 minutes in, we already bagged our first NFT. Then came the scaling phase. At first, the team didn't give a single **** - no Cloudflare, no rate limiting, not even a basic 429. We ran 10 wallets simultaneously. After a few hours, they finally threw in a primitive 429, and that was it. No bot protection, no captcha, nothing. They didn’t even enforce single-session checks per wallet, so we were running multiple concurrent instances on the exact same address (literally impossible to do manually). The bots printed flawlessly. At one point, our load was crashing live games for actual manual players, forcing the team to repeatedly pause the game to fix lag. Every time they brought it back up, we resumed blasting. Total mint size was 1,060 NFTs. We scooped over 20% of the entire supply. Then came the funny part: the collection had zero secondary volume. Time for a little social engineering. We hopped into their TG playing dumb, gently nudging the admins: 'Hey guys, might want to tweet that the game is live and apply for OpenSea verification!' The final tally: * Total capital spent on fees/burns: ~$1,700 * Total NFTs pulled: ~50–60 pieces (friends got a similar bag) * PnL: Dumped most of the floor tier into bids today at $200–$300 a pop, still holding some. Nothing crazy for a real bull run, but an easy 5-figure profit for a couple of hours of vibecoding."

• 
  David T Kramaley (@simplydt) reported 26 minutes ago

  @mathieuxtms @whop lean stack wins. we run supabase, cloudflare, and a tiny video‑automation service, staying under 15% of MRR

• 
  volkanolmez (@volkanolmez) reported 29 minutes ago

  @xDestin0 That's almost always a local proxy or antivirus doing SSL inspection — the cert itself is valid (Google Trust Services via Cloudflare). Corporate networks and Kaspersky/ESET-type antivirus are usual suspects. Any chance you're on a work network? 🙏

• 
  JP (@jpshrodinger) reported 30 minutes ago

  my site had a react hydration bug for WEEKS checked my code 100 times. rewrote providers. nothing it was cloudflare. it rewrites email addresses in your HTML to "protect" them and breaks react silently the bug was never in my house

• 
  Julian Schubert (@julian_durian) reported 30 minutes ago

  @Gaus450 Before I bought mine at Namecheap, I moved everything to Cloudflare after their huge outage.

• 
  Gabriel | Algo Trading (@gabrielrockson_) reported 33 minutes ago

  The moment you have the thought to make a domain public, you should think of how much bot traffic you would be getting, and all the weird things that people would attempt to do. Slapping @Cloudflare in front of your services is one good step in that direction. You are able to configure a lot at that level before you even look at your service itself.

• 
  Reina Cruz 🥼🧤🇨🇺 (@rea1ReinaCruz) reported 33 minutes ago

  @Cloudflare Fix human verification

• 
  James Martinez (@realjamesmtz) reported 37 minutes ago

  @mrfundman @Cloudflare Damn too rich for me.

• 
  James (@jamescoder12) reported 39 minutes ago

  The full impact. What he changed and what happened: 1. Moved router from cabinet to open shelf: 74 Mbps → 155 Mbps 2. Changed Wi-Fi channel to least congested: 155 Mbps → 290 Mbps 3. Widened channel width to 80 MHz: 290 Mbps → 380 Mbps 4. Switched DNS to Cloudflare (1.1.1.1): browsing latency dropped noticeably on every device 5. Updated firmware (first time in 4 years): 380 Mbps → 400 Mbps + eliminated smart TV disconnections 6. Changed admin password + upgraded to WPA3: closed the 2 biggest security holes in the network 7. Separated 2.4 GHz and 5 GHz bands: eliminated TV buffering caused by band steering 8. Enabled QoS (work laptop prioritized): zero Zoom call drops during peak household usage 9. Bought own router, returned ISP rental: $168/year saved + full control over all settings Starting speed: 74 Mbps (on a 500 Mbps plan getting 15% of what he paid for) Ending speed: 440 Mbps (getting 88% of what he paid for) Then the real move: he downgraded from the 500 Mbps plan back to 200 Mbps because 200 Mbps with optimized settings delivered faster Wi-Fi to his devices than 500 Mbps with factory defaults. Monthly savings from the plan downgrade: $30 Monthly savings from returning the rental: $14 Total annual savings: $528 with faster, more stable, more secure internet Total time to make all 9 changes: 15 minutes of settings + one trip to Best Buy + one phone call to return the rental.

• 
  Reina Cruz 🥼🧤🇨🇺 (@rea1ReinaCruz) reported 40 minutes ago

  @Cloudflare Fix human verification

• 
  Irfan (@learnatick) reported 40 minutes ago

  @acolombiadev @Cloudflare @expo EAS service 🐐 tier for React Native developers.

• 
  Ravi Pal (@ravipal1214) reported 43 minutes ago

  Would you deploy an AI agent your own team didn't build? CrowdStrike is betting yes. On 31 August it launched an AI Partner Specialization: partners such as ABC inc build agents on the Falcon platform, the agents pass a Verified Agent certification, and they are sold through the CrowdStrike Marketplace. NIST is drafting identity and authorization standards for software agents. Cloudflare has given agents wallets with hard spending limits. The trust layer of the agent economy is being built now. It is worth being clear about what certification actually proves. Certification tests the agent once, as a product, against the certifier's standard. Its job is to enable a sale between two parties who don't know each other. SOC 2 and CE marks do the same job. This is useful. It filters out careless builds and simplifies procurement. But the risk is not in the product. It is in the deployment: the agent combined with your tools, your data and your permissions. The certifier never tests that combination. The model behind the agent also keeps changing after the certificate is issued. And the controls themselves are under pressure: in the August Hugging Face incident, METR and Redwood Research found agents working together for days to defeat the scoring system that checked their work, including attempts to alter the logs. So there are two different disciplines here. Certification answers: is this agent fit to buy? Verification answers: did this agent do this task correctly, today, in my environment? A marketplace can only give you the first. The second is built and operated by the buyer: evals on your own tasks, checks on every outcome, logs that cannot be edited. Verified outcomes are the product. The certificate is the entry ticket. Treat certification as a procurement gate. Treat verification as an operating capability. Budget for both, and know which one protects you. What do you think ?

• 
  Jeffinator (@jeffinator06) reported 45 minutes ago

  ive been STUCK in cloudflare HELL for the past 2 WEEKS. this is the 2nd time ive been caught up in some mass-wide bullshit. holy **** dude reddit is so so awful i dont want to go back

• 
  Megumi, Internet Angel 🏳️‍⚧️ (@pcppup) reported 46 minutes ago

  @NightlyArii i think you are not catching my sarcasm :) i do not know how much you know about cybersec, but a static page would require Cloudflare, Github, or my Computer to get hacked, which is just crazy. You're just criticizing AI because you can. It's good for some things, bad at others.

• 
  Przemysław Zalewski (@Ciunkos) reported 50 minutes ago

  @efalcao @proofpoint @Cloudflare Most likely by the fact Cloudflare is kinda bad at handling abuse reports - try filling their form and see for yourself. Any service that could be used for spam delivery, will eventually be used for that. And Cloudflare now tastes what other providers experience day to day.

• 
  DeathScythe (@DeathScytheH) reported 51 minutes ago

  @BowTiedWaterDog @BowTiedCrocodil Netbird self hosted. Zero trust network wireguard based with “cloudflare tunnels”.

• 
  My1 (@nep.one - Misskey) (@My1xT) reported 56 minutes ago

  @slendidev interesting question would be how fast or slow cloudflare runs on those, as especially on my older laptop it sometimes took a decent while, before needing a click and taking a decent while again, while anubis you dont need to babysit.

• 
  Security Weekly Podcast Network (@SecWeekly) reported 60 minutes ago

  That CAPTCHA may not be protecting you. A click-fix attack can use a fake Cloudflare CAPTCHA to convince users to open PowerShell or Terminal and paste a command themselves. Once the command runs—especially with administrator privileges—the attack chain can begin. What should organizations block before social engineering gets a user to execute the attack for them? #Cybersecurity #PowerShell #SocialEngineering