blog.cloudflare.com

Cloudflare has released EmDash v0.1, a full-stack serverless CMS written in TypeScript atop the Astro framework it acquired in January, promising sandboxed plugin isolation, AI-native management via MCP, and MIT licensing as a direct challenge to the 42.5 percent of the web still running WordPress.

Cloudflare's new isolate-based runtime starts AI agent sandboxes in milliseconds with megabytes of memory, replacing containers and pairing with Code Mode to cut LLM token usage by 81 percent.

Cloudflare's 2026 Threat Report documents a pivotal shift: attackers now log in rather than break in, using stolen session tokens and AI-assisted credential theft to bypass MFA, as DDoS volumes doubled and nation-state pre-positioning inside critical infrastructure intensifies.