AI Weekly Malaysia

Node.js creator Ryan Dahl unveiled celld, a self-hosted, distributed implementation of Cloudflare's Durable Objects and Workers that is API-compatible with Cloudflare's JavaScript APIs but claims to be significantly cheaper to run on your own infrastructure. Durable Objects co-locate compute with per-object SQLite storage and use single-threaded execution to simplify concurrency, making them well-suited for real-time collaborative apps, multiplayer games, and AI agents.

Why: If you're building real-time or stateful serverless apps on Cloudflare Durable Objects, celld gives you a migration path off Cloudflare's infrastructure without rewriting your code, which matters for cost control and avoiding vendor lock-in. Malaysian founders running collaborative or AI agent workloads should evaluate whether self-hosting celld reduces their cloud bill compared to Cloudflare's per-request pricing, especially if they already have server capacity or use a cheaper regional cloud provider.

Cloudflare now lets you attach Access authentication policies directly to a Worker or across an entire account, so every preview URL, custom domain, workers.dev subdomain, and route is behind company login by default—no per-hostname configuration needed. You can scope protection to preview URLs only or all hostnames, and authenticated user identity (email, name, groups) is injected directly into your code without JWT validation.

Why: If your team is deploying AI-generated or vibe-coded Workers apps that may accidentally expose internal data, you can now enforce auth at the account or Worker level instead of trusting each developer to configure it per domain. This removes the gap where adding a new custom domain left a Worker unauthenticated until you manually updated policy.

Cloudflare announced new Cloudflare One capabilities to detect and control MCP (Model Context Protocol) traffic on corporate networks. The core problem: employees can connect AI agents (Claude Code, Codex, Cursor, VS Code) to arbitrary MCP servers with a single line of config, and the resulting HTTPS traffic has no distinguishing hostname or path pattern, making 'shadow MCP' usage hard to spot. Cloudflare Gateway now uses protocol signals to identify this traffic and enforce routing through approved MCP Server Portals.

Why: If you are shipping or using AI agents that connect to MCP servers, your existing permission models were designed for humans who pause on unexpected results and act at human speed. Agents act non-deterministically and can repeat a bad tool call thousands of times before anyone notices. You should decide now whether your team needs network-level visibility into which MCP servers agents are calling, especially if employees can self-configure connections without approval.

Cloudflare's Certificate Transparency Monitoring is now generally available after being in beta since 2019, covering over 650,000 domains. The GA release fixes a major noise problem by filtering out alerts for certificates Cloudflare issues and renews on your behalf, so you only get notified about unexpected external certificates.

Why: If you previously disabled CT Monitoring because of spam from routine Cloudflare certificate renewals, you should re-enable it now; the GA version only alerts you to certificates issued outside Cloudflare, which is critical as certificate lifespans shrink to 47 days by 2029 and renewal frequency increases.

Cloudflare's H1 2026 DDoS report covers Jan-Jun, mitigating 23.2M network-layer attacks and 29.64T HTTP DDoS requests (~5,343 attacks/hour). 935 attacks exceeded 1 Tbps with a 519% QoQ surge in Q2, DNS floods rose to 40% of network-layer attacks, and Operation PowerOFF targeted 75,000 DDoS-for-hire users across 21 countries.

Why: If you run any public-facing infrastructure, DNS-based amplification attacks are now the dominant vector at 40% of network-layer attacks—review your DNS resolver exposure and upstream rate-limiting. The 1 Tbps attack volume means self-hosted mitigation is increasingly impractical; evaluate whether your CDN/WAF provider's DDoS tier covers hyper-volumetric attacks before you need it.

Cloudflare's Agents Week roundup announces several infrastructure pieces for building AI agents on their platform: a new @cloudflare/computer runtime that selects execution environments, cross-language Workers RPC between Python and JavaScript, inbound TCP/gRPC support on Workers and Containers, a Billable Usage API for cost tracking, and Cloudflare Agents with production tracing, replay, and human-in-the-loop approvals. They also introduce the 'Agent Development Lifecycle' (ADLC) as a framing for shipping agentic software.

Why: If you're building agents on edge/serverless infrastructure, the TCP/gRPC inbound support on Workers and Containers directly enables real-time voice AI backends without leaving Cloudflare, and cross-language Python/JS RPC removes a real friction point for mixed-language agent projects. The Billable Usage API matters if you need programmatic cost visibility across self-serve Cloudflare products — check whether it covers your current spend before building custom tracking.

Cloudflare's 2026 H1 data shows media, production, and publishing was the most DDoS-targeted sector at 14.2% of all attacks, driven by wars in Ukraine and Iran plus the FIFA World Cup. Media saw nearly 4x the attacks of the second-most-targeted sector (gambling), with government entities jumping from 29th to 9th most targeted after the US-Iran war began.

Why: If you run any availability-critical service (news, events, payments, government portals), this data confirms DDoS protection is non-optional during geopolitical events. Malaysian builders serving real-time content or running election/civic platforms should verify their CDN/WAF DDoS mitigation tier now, not during a crisis window when a 2-hour outage is the entire attack goal.

Cloudflare Radar data shows HTTP request volume dropped 15-30% in regions along the path of totality during the August 12, 2026 solar eclipse across Iceland, Spain, and Portugal, with traffic troughs aligning almost perfectly with maximum solar obscuration. Countries experiencing only shallow partial eclipses (Sweden, Denmark, Poland, Switzerland) saw little to no traffic change. Traffic rebounded within minutes of maximum coverage as people returned to their screens.

Why: For SaaS teams serving European audiences, this is a concrete data point that predictable real-world events can cause double-digit traffic swings in specific geographies within minutes—useful if you model capacity, autoscaling thresholds, or anomaly-detection alerts that might fire on sudden regional dips. For most builders, though, there is no action to take here; it is observational infrastructure analytics, not a change requiring response.

Cloudflare for Government has achieved FedRAMP Class D (High) certification, sponsored by NIST, marking a step up from its 2022 Moderate authorization. Cloudflare also announced it is pursuing DoD Impact Level 4 (IL4) authorization for handling controlled unclassified data, using the same systems developed for FedRAMP High.

Why: This is a US federal compliance milestone with little direct impact on Malaysian or SEA builders. It only matters if you are selling into US government or defense contracts and need a CDN/edge provider with FedRAMP High status; otherwise no action required.