Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants
- ID
- 40711
- Status
- summarized
- Published
- 29 Oct 2026, 8:55 PM
- Fetched
- 29 Oct 2026, 11:23 PM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/ddos-threat-report-2026-q3/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 4.0
- Created
- 29 Oct 2026, 11:24 PM
- Tags
- Audience
- developerssaas_startup_founders
What happened
Cloudflare's 26th DDoS Threat Report covers Q3 2026 and says Cloudflare mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests — about 8,226 network-layer attacks per hour, or one every 0.44 seconds. Short-burst attacks under 10 minutes and under 1 Gbps rose 208%, while attacks over 1 Tbps fell nearly 69%; CLDAP floods collapsed 99.5%, DNS amplification rose 215%, and general UDP floods rose 122%. The report also says 96% of mitigated network-layer attacks ended in under 10 minutes and 98% stayed under 1 Gbps.
Why it matters
If you run public APIs or sites, the report's modal attack is a short sub-10-minute, sub-1Gbps burst, so monitoring, alerts, and rate limits need to catch brief traffic spikes rather than only giant floods. The shift away from CLDAP toward DNS amplification (+215%) and UDP floods (+122%) makes connectionless DNS/UDP exposure the more likely reflection vector to check. The excerpt has no Malaysia-specific data, so local impact is indirect.
Discussion angle
Most attacks in this data are short and small: would your current alerting and rate limits catch a 5-minute 500 Mbps burst, or would it blend into normal traffic?