How to evaluate LLMs before production
These are the lessons we learned evaluating LLMs for real-world secret scanning. The post How to evaluate LLMs before production appeared first on The GitHub Blog.
Web technology watch
The changes shaping the Web, in one place.
Browsers, standards, development, AI, cybersecurity, CMS, search and infrastructure: a press review built from official feeds published by leading Web organizations.
Newest first
The Web press review
48 publications
Web Authentication: An API for accessing Public Key Credentials Level 3 is now a W3C Recommendation
This specification defines an API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users.
Your alt text passes automated checks. That doesn’t mean it’s any good.
We built a plugin for the GitHub Accessibility Scanner to make sure your alt text is actually accessible. Here's how it works. The post Your alt text passes automated checks. That doesn’t mean it’s any good. appeared first on The GitHub Blog.
The Cloudflare Blog – Brought to you by EmDash
We migrated the Cloudflare Blog to EmDash to prove our stack at massive scale. Here is how we stress-tested performance, safely routed production traffic, and redesigned the frontend experience.
Intent to Ship: JPEG XL
It isn’t often that new image formats land in browsers. In the early 2000s we had JPEG, GIF, and PNG. The 2010s gave us WebP, which was a modest step up from JPEG. But the 2020s have given us two new image formats that are a big step up from…
Patent Advisory Group recommends continuing work on Open Screen Application Protocol
W3C launches a Patent Advisory Group (PAG) to resolve issues in the event a patent has been disclosed that may be essential, but is not available under the W3C Royalty-Free licensing terms.
Say it once: introducing Bot Preference Sync
Cloudflare's new Bot Preference Sync automatically aligns your robots.txt file with your AI bot policies for Search, Agent, and Training. Easily manage which bots access your content without maintaining static files.
The August 17 outage, and the work ahead
An update on the August 17 outage and the steps we're taking to improve reliability. The post The August 17 outage, and the work ahead appeared first on The GitHub Blog.
From all-or-nothing to task-based OAuth consent
Cloudflare OAuth now supports optional scopes, giving users more control over what an app can access and helping developers build secure consent flows around the task at hand.
AI Creates Opportunity While Artists Ship at WordCamp US 2026
WordCamp US (WCUS) 2026 just wrapped up after 4 days at the Phoenix Convention Center in Phoenix, Arizona. Over 1,100 people from around the world registered to attend, and thousands more watched online through livestreams. Contributor Day and…
First Public Working Draft: The Profiles Vocabulary
The Profiles Vocabulary is an RDF vocabulary created to allow the machine-readable description of profiles of specifications for information resources.
WordPress 7.1 “Mary Lou”
WordPress 7.1, “Mary Lou,” is here—celebrating the pioneering jazz pianist, composer, and arranger Mary Lou Williams and her spirit of reinvention and collaboration. This release brings a more flexible, responsive, and collaborative WordPress…
GitHub Copilot app for Beginners: Managing your work
If you’re juggling multiple Copilot sessions, use the My work pane to track what's in flight, what's done, and what's next. The post GitHub Copilot app for Beginners: Managing your work appeared first on The GitHub Blog.
A revisit of remote Spectre attacks on Cloudflare Workers
In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and how new defenses further harden Cloudflare Workers.
BGP Role model: tracking the adoption of RFC 9234
RFC 9234 lets routers reject route leaks on their own, using BGP Roles and the Only to Customer attribute. We measured who has deployed it, and found two Tier 1 networks unexpectedly stripping OTC.
Group Note Draft: Web Sustainability Guidelines (WSG) Impact Ratings
This document describes the impact ratings provided alongside Web Sustainability Guidelines (WSG).
How canvases make agentic workflows visible, steerable, and cost-efficient
Chat is great for intent, but agent work gets lost in the scroll. Here is how I use canvases with my agentic workflows—and why your workflow also deserves a canvas. The post How canvases make agentic workflows visible, steerable, and…
How to bring your software delivery workflow into GitHub with agent apps
See how four GitHub agent apps can help you scope, secure, roll out, and ship a feature across the SDLC–all without leaving GitHub. The post How to bring your software delivery workflow into GitHub with agent apps appeared first on The GitHub Blog.
How Cloudflare detects MCP traffic and helps secure it
Cloudflare Gateway identifies MCP requests using protocol-level heuristics. Security teams can use that signal to find shadow MCP traffic, enforce Portal-only access for approved servers, and block direct connections on managed network paths.
Secure all your internal vibe-coded applications — in one click
Introducing Cloudflare Access for Workers. Attach an Access policy directly to a Worker and it applies everywhere that Worker runs — routes, custom domains, workers.dev, and previews — automatically.
Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal
Cloudflare's data shows a clear impact on Internet traffic from Iceland to Spain and Portugal, following the path of totality of the total solar eclipse that occurred on August 12, 2026.
Your guide to GitHub Universe 2026 is here: The schedule just launched!
The GitHub Universe session catalog is live. Explore interactive workshops, community talks, demos, and panels. Plus, register before August 19 to save $300. The post Your guide to GitHub Universe 2026 is here: The schedule just launched! appeared…
Introducing the WordPress Browser Extension
The official WordPress Browser Extension is now available for Google Chrome and Chromium-based browsers in the Chrome Web Store and for Safari on macOS in the Mac App Store. This new open source extension lets logged-in site users easily hide the…
What 50 open source projects taught us about security in the AI era
See how the open source projects in Session 4 of the GitHub Secure Open Source Fund combined AI-assisted workflows, maintainer expertise, GitHub security tools, expert guidance, and funding to improve project security. The post What 50 open source…
Certificate Transparency Monitoring is now generally available
Cloudflare's Certificate Transparency Monitoring is now generally available. The biggest change: we no longer email you about certificates Cloudflare issued for your domain, so when an alert lands in your inbox, it's worth a look.
GitHub availability report: July 2026
In July, we experienced eight incidents that resulted in degraded performance across GitHub services. The post GitHub availability report: July 2026 appeared first on The GitHub Blog.
GitHub Copilot app for Beginners: Write your first prompt
Learn how to write your first prompt in the GitHub Copilot app, choose the right context and model, and start your first task with confidence. The post GitHub Copilot app for Beginners: Write your first prompt appeared first on The GitHub Blog.
WordPress 7.0.4 Release
WordPress 7.0.4 is now available WordPress 7.0.4 is now available which features a security fix. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.4 by downloading it from…
Updated W3C Recommendation: ARIA in HTML
This specification defines the authoring rules (author conformance requirements) for the use of Accessible Rich Internet Applications (WAI-ARIA) 1.2 and Digital Publishing WAI-ARIA Module 1.1 attributes on [HTML] elements.
Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave
In the first half of 2026, Cloudflare detected a 519% surge in hyper-volumetric DDos attacks across its network. These attacks were driven heavily by DNS and CLDAP reflection vectors. This report breaks down how major geopolitical conflicts reshaped…
Everything we launched during Agents Week
Our latest Agents Week has come to a close. Here’s a recap of all the announcements we made from Wallets to Radar.
Serving the most critical missions: Cloudflare for Government achieves FedRAMP Class D (High) Certified status
Cloudflare for Government achieves FedRAMP Class D (High) Certified status. We also announce our commitment to pursue DoD IL4 authorization. Cloudflare brings world-class security, performance, and developer products to the public sector.
Unveiling good and bad behaviors on the Agentic Internet
Cloudflare is shifting bot mitigation from point-in-time Risk assessment to continuous Trust evaluation. Learn how new good and bad behaviors from bots and agents are assessed by our systems, including BotBase and Precursor — and try out our…
Introducing Radar Researcher: An AI tool for exploring Internet data in plain language
Cloudflare Radar Researcher is a new AI-powered tool that lets you explore global Internet trends and traffic data using plain language. Built entirely on Cloudflare's Developer Platform, it turns natural language queries into real, interactive…
Announcing Cloudflare Ambassadors, Community Engineers, and another $1M in open-source funding
We are launching updated community programs, including Cloudflare Ambassadors and Community Engineers, backed by $1M in open-source funding. Learn how we are supporting maintainers and scaling our developer community.
Unifying Workers AI and AI Gateway into a single AI control plane
Cloudflare is unifying AI Gateway and Workers AI into a single control plane, giving developers observability, billing, and dynamic routing across both managed GPUs and external providers. Learn how unified bindings and model-first routing simplify…
WordPress 7.0.3 release
WordPress 7.0.3 is now available WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.3 by downloading…
Cloudflare AI Search: give your agents a search engine for your data
AI Search makes search easier than ever, with no Cloudflare primitives to stitch together. Point it at your data to create a search for your own files and websites. We're also sharing a preview of our new pricing model.
The next generation of MCP
The next version of MCP has a rewritten, stateless core that just works on Workers. We cover upgrades to the protocol, the new feature lifecycle and SDK migration path, and hear from early adopters already running it in production.
From ranking to recommended: get your site ready to thrive in the age of AI agents
More than half of requests now come from machines, not people. Agent Readiness shows how well agents can discover and read your site, while Answer Engine Optimization tracks how often AI assistants recommend you.
Building an open Agentic Internet: readable, discoverable, callable, and payable
Agents are a new kind of visitor. They don't render CSS or click ads, but they have a paying human on the other end. Block them and you block your customer. We're building the open tools and protocols so publishers and agents can cooperate and not…
W3C invites implementations of Decentralized Identifier Resolution (DID Resolution) v1
This document describes the process of obtaining a DID document and accompanying metadata for a specific DID.
WordPress 7.1 Release Candidate 1
The first Release Candidate (“RC1”) for WordPress 7.1 is ready for download and testing! This version of the WordPress software is still under development. Please do not install, run, or test this version of WordPress on production or…
Group Note: Further Aligning W3C's Program of Technical Work with Human Rights
In this document, the Advisory Board lists examples of how human rights and technical standards setting map to each other, points to existing W3C work in this area, and provides concrete proposals to further the alignment between the W3C’s…
W3C Invites Implementations of WebTransport
This document defines a set of ECMAScript APIs in WebIDL to allow data to be sent and received between a browser and server.
Group Note Draft: Verifiable Credentials Overview v1.1
The family of W3C Recommendations for Verifiable Credentials, described in this overview document, provides a mechanism to express these sorts of credentials on the Web in a way that is cryptographically secure, privacy respecting, and…
Group Note Draft: EPUB Accessibility 1.2 Explainer
The EPUB Accessibility 1.2 Explainer provides information on how to understand and evaluate the accessible publications conformance requirements of EPUB Accessibility 1.2 against reflowable EPUB publications.
WordPress 7.1 Beta 4
WordPress 7.1 Beta 4 is ready for download and testing! This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test…
Web technology watch
International monitoring without artificial translation.
Each edition prioritizes material actually published in its language. Titles and excerpts remain in the source language, and the full story is always read on the publisher’s website.
- 01RSS / Atom
Sources monitored : 18.
- 02English edition
Each edition prioritizes material actually published in its language. Titles and excerpts remain in the source language, and the full story is always read on the publisher’s website.
- 03Cache · 30 min
Automated selection: topic classification may contain errors.
Sources monitored
The GitHub Blog W3C Cloudflare Blog Mozilla Hacks WordPress.org Google Search Central Chrome for Developers web.dev
Automated selection: topic classification may contain errors.