Loading…
Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave
CloudflareCloudforce One
Summary
In the first half of 2026, network-layer DDoS attacks exceeding 1 Tbps surged by 519% quarter-over-quarter, with 935 mitigated attacks recorded across the period. Threat actors shifted their focus toward reflection and amplification methods, making DNS-based floods and CLDAP floods the dominant vectors. Despite the rise in hyper-volumetric traffic, 96.62% of network-layer attacks remained under 500 Mbps and 90.60% ended in under 10 minutes. Geopolitical conflicts and international events heavily influenced target selection, pushing the Media, Production & Publishing industry to the top position. Because brief multi-gigabit bursts trigger downstream routing instability and application timeouts before analysts can respond, automated, always-on edge mitigation has become critical.
Context
DDoS attacks are rapidly escalating in volume and shifting toward amplification techniques such as DNS and CLDAP floods, while geopolitical tensions and major global events drive targeted surges against government and media organizations.
Approach / What changed
Cloudflare deploys automated, unmetered DDoS mitigation across 330+ edge locations with 500 Tbps of network capacity and distributes a free DDoS Botnet Threat Feed to over 800 service provider networks to facilitate botnet takedowns.
Takeaways
- Network-layer DDoS attacks surpassing 1 Tbps jumped 519% quarter-over-quarter in H1 2026, totaling 935 hyper-volumetric mitigations.
- DNS-based attacks accounted for 34.3% of network-layer activity in H1 2026, while CLDAP reflection floods grew 580% quarter-over-quarter.
- Although hyper-volumetric attacks increased, 96.62% of network-layer attacks stayed below 500 Mbps and 90.60% finished within 10 minutes.
Related reading
Unveiling good and bad behaviors on the Agentic Internet
Web traffic increasingly shifts between human interaction and automated agents, rendering point-in-time security checks ineffective against sophisticated automation. Cloudflare addresses this shift through continuous behavioral analysis designed to evaluate trust across entire user sessions rather than relying on static point-in-time hurdles. Its CDN-injected client-side system, Precursor, tracks continuous behavioral indicators like cursor movements to catch mid-session automated takeovers. To counter rapid bot adaptation, Cloudflare is introducing self-adjusting machine learning models under Adaptive Intelligence and non-deterministic defenses such as the AI Labyrinth. These tools allow site owners to poison scraper training data, trap crawlers in synthetic webs, or queue legitimate agents while dynamically penalizing abusive traffic.
Jin-Hee LeeA revisit of remote Spectre attacks on Cloudflare Workers
Cloudflare reassessed remote Spectre attack feasibility within Cloudflare Workers production workloads to evaluate defenses against modern stabilization techniques. The experimental proof of concept bypassed Dynamic Process Isolation (DyPrIs) by keeping invocations alive using WebSocket traffic, which also diluted hardware performance counter ratios below detection thresholds. By combining branch mistraining, cache line eviction, and speculative type confusion, researchers transiently accessed out-of-bounds memory via raw 64-bit TypedArray backing store pointers. This attack demonstrated cross-tenant data leakage reaching up to 12 bit/s with over 99% accuracy in production. In response, Cloudflare mitigated the vulnerability by integrating the V8 memory sandbox, deploying Memory Protection Keys for hardware-assisted in-process isolation, and redesigning DyPrIs to monitor active long-lived executions.
Martin SchwarzlBGP Role model: tracking the adoption of RFC 9234
Border Gateway Protocol route leaks occur when routing announcements propagate beyond their intended customer-provider or peer relationships, causing traffic misdirection and performance degradation. RFC 9234 embeds relationship awareness directly into BGP by establishing negotiated BGP Roles and attaching an Only to Customer (OTC) transitive path attribute to prevent unauthorized route propagation. To assess real-world adoption, Cloudflare monitored OTC attribute transmission across peer networks and discovered that 33.1 percent of IPv4 and 17 percent of IPv6 paths were missing the OTC attribute. Investigation revealed that Tier-1 transit providers AS1299 and AS3257 were stripping the attribute due to legacy defensive BGP error-handling configurations. Following direct engagement, AS1299 updated its configurations to preserve OTC propagation, whereas AS3257 continued stripping it, highlighting the necessity of broader vendor and carrier support across the Internet.
Bryton HerdesIntroducing Radar Researcher: An AI tool for exploring Internet data in plain language
Cloudflare launched the beta of Radar Researcher, an AI tool designed to let users explore global Internet traffic data using plain-language queries. Built entirely on Cloudflare's developer platform, the system uses the Cloudflare Agents SDK within a Cloudflare Worker, maintaining conversation state and SQLite databases inside Durable Objects. The inference layer relies on Workers AI running models like Kimi K2.7 through an ordered fallback chain across three model families to prevent outages, routed via AI Gateway for logging, caching, and guardrails. Radar's frontend renders retrieved data using its existing native interactive charts, while smaller dedicated models generate conversation titles and follow-up suggestions asynchronously. Additionally, Radar introduced support for the WebMCP standard, exposing imperative and declarative tools to allow external browser agents to navigate and interact with the platform directly.
Lai Yi Ohlsen