Cloudflare Reports 18.2 Million Network‑Layer DDoS Attacks in Q3 2026, Up 38%
What Happened — Cloudflare disclosed that threat actors launched roughly 8,226 network‑layer (L3) distributed denial‑of‑service attacks per hour during the third quarter of 2026. The company’s automated mitigation platform blocked 18.2 million L3 DDoS attacks and 14.4 trillion HTTP‑layer requests, averaging 197,400 attacks per day (one every 0.44 seconds). The surge represents a 38 % increase versus Q2 2026. No breach of Cloudflare’s own infrastructure was reported; the attacks were absorbed and mitigated by its edge network.
Why It Matters for Trust & Control Assurance — The volume underscores the need for robust incident‑response and availability controls that can be continuously evidenced for audit readiness.
Who Is Affected — Cloud service providers, SaaS applications, e‑commerce sites, media streaming platforms, and any organization that relies on public‑facing internet assets.
Recommended Actions
- Review and harden DDoS mitigation controls (rate‑limiting, traffic scrubbing, any‑cast routing).
- Conduct tabletop exercises that simulate high‑frequency attack bursts to validate response playbooks.
- Capture and retain mitigation logs as defensible evidence for frameworks such as NIST CSF 2.0.
Technical Notes — The attacks were purely network‑layer (L3) floods, complemented by massive HTTP‑layer request spikes. Cloudflare’s autonomous mitigation leveraged edge‑node scaling, traffic profiling, and rate‑based filters. No specific CVE or vulnerability was disclosed. Source: The Hacker News