Rolled out to all points of presence on 14 December 2021. No action is required.
- Security: updated TLS library to address Android WebView.
- Faster rule propagation: median 18 seconds to all PoPs.
- Fixed a race in origin health checks that could mark a healthy origin as down for up to 7 seconds.
- Managed WAF: 30 new signatures for recently disclosed CVEs.
- New dashboard widget: challenged vs. dropped traffic by ASN.
- Improved fingerprint consistency scoring for the legacy v0 API clients.
Thanks — sharing this with our on-call team.
Verified good bots and allow-listed partners bypass challenges entirely.
Do you publish the edge IP ranges in a machine-readable format?
Interesting that most attacks are under ten minutes. Our experience is similar.
Our auditors asked for exactly this kind of incident evidence under DORA.
Great write-up. We saw almost the same pattern on our login endpoint last month.
How does the proof-of-work challenge behave on older Android devices? Any numbers below Android 10?
Carpet bombing is nasty. Good to see a clear explanation of it.
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.