Loading story…
Cloudflare has made Python Workers generally available on its WebAssembly-based Workers runtime, adding Python as a fully supported platform language alongside JavaScript and TypeScript. The release provides native Developer Platform bindings without Python-to-JavaScript object conversion, WSGI and ASGI connectors for frameworks including FastAPI, Django, and Flask, and TCP socket support for Hyperdrive connections to PostgreSQL and MySQL through standard Python drivers. It also enables networking-dependent AI tooling, including OpenAI, LangChain, and MCP libraries, and builds on Pyodide and the newly accepted PEP 783 PyEmscripten packaging standard.
The rollout relies on a syscall-level socket bridge and upstream HTTP-client modifications that send networking through JavaScript fetch. Developers should assess runtime constraints before production adoption: community feedback cited cold-start latency, memory consumption, version coupling to embedded Python and Pyodide components, and the sustainability of required upstream maintenance. urllib3 characterizes its Emscripten networking backend as experimental and outside its security-policy scope; a reported issue, CVE-2025-50182, affects redirect-control behavior when requests use the fetch backend. Cloudflare said memory snapshots have improved cold starts, compatibility flags cover Python 3.12 through 3.14, and further performance and memory-efficiency work is planned.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Community discussion following the release highlighted experimental urllib3 Emscripten/fetch-backend support, including redirect-control behavior associated with CVE-2025-50182, as well as questions about upstream maintenance, cold starts, memory use, and runtime-version coupling. Cloudflare said memory snapshots had improved cold starts and that it intended further performance and memory-efficiency work.
Cloudflare announced general availability of Python Workers on its Developer Platform, making Python a fully supported Workers-runtime language. The release includes native platform bindings, ASGI/WSGI connectors, socket bridging for Hyperdrive database connectivity, and WebAssembly/Pyodide package ecosystem improvements.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare has introduced **Kitesurf**, an experimental lightweight browser engine built for automated workflows and AI agents, designed to run browser components inside isolated **WebAssembly** and **Rust** environments on **Cloudflare Workers**. The platform supports the **Chrome DevTools Protocol** and is aimed at tasks such as page rendering, screenshot capture, and HTML extraction while using fewer resources than a full **Chromium** deployment. Kitesurf draws on components from the Rust-based **Blitz** rendering engine and Firefox’s **Stylo** CSS parser, but Cloudflare says it is not yet a full replacement for Chromium. Current limitations include missing support for video, **WebGL**, realistic **TLS**-based bot challenges, and long-lived authenticated sessions. The announcement has also prompted discussion about Cloudflare’s position as both a provider of browser automation tooling and a vendor of anti-bot and cybersecurity services, while the company has said it plans to open source the project in the future.
Aug 22, 2026
Check Point Research disclosed five vulnerabilities in `workerd`, the open-source runtime behind Cloudflare Workers and Cloudflare Code Mode, describing two primary attack paths: cross-tenant memory exposure in the managed Workers environment and a sandbox escape in Code Mode that can lead to native code execution on the host in self-hosted deployments. The researchers said the issues stem from native C++ glue code and the `tcmalloc` heap operating outside core V8 isolation protections, creating exploitable conditions even where V8 sandboxing and memory protection keys are enabled. Cloudflare rated two of the flaws **Critical** and said fixes have already been deployed in the managed Workers production environment. Organizations running self-hosted deployments were advised to upgrade to `workerd v1.20260619.1`, while Check Point said it has released proof-of-concept code alongside its Black Hat USA 2026 presentation, increasing the urgency for defenders to validate patch status and review exposure in any self-managed `workerd` instances.
Aug 7, 2026
Cloudflare has introduced **agent tracing** as the first component of its new **Cloudflare Agents** platform, giving developers deeper visibility into AI agents running on Workers. The feature extends beyond infrastructure-level telemetry by adding spans for agent invocations, model calls, tool execution, approvals, and subagent activity, and it also supports session replay of recorded conversations, tool calls, and results. Cloudflare said the capability is intended to help teams observe and debug agent behavior, but early coverage highlighted several operational caveats. Reported limitations include inconsistent default payload-recording behavior between **Think** and **Flue**, truncation that can make replay non-lossless, and pricing tied to total observability events rather than only the events surfaced in the Agents dashboard. The company said tracing is free during beta and will transition to **Workers Observability** pricing on **October 1, 2026**.
Aug 15, 2026