Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Cloudflare WAF parsing change outage

Service Disruption
First reported
Last updated
Happening score
H score 1
1 unique sources, 1 articles

Summary

Hide ▲

Cloudflare suffered a temporary network outage after a Web Application Firewall parsing change caused availability problems for several minutes. The disruption mattered because it affected a major internet infrastructure provider and coincided with outages reported by Zoom, LinkedIn, Coinbase, DoorDash, and Canva. Cloudflare said the fix was rolled out quickly and that the event was not an attack.

Related Happenings

2025 DDoS surge targets telecommunications, service providers, and carriers

Trend
H score34 First: 05.02.2026 19:25 Last: 05.02.2026 19:25 Sources 1

About this happening: Cloudflare reports that the 2025 DDoS surge has continued into Q3 2025, with the Aisuru botnet driving more than 1,300 attacks in three months and a record pea...

Open Happening

AISURU/Kimwolf hyper-volumetric DDoS botnet activity

Malware Activity
H score23 First: 05.02.2026 19:25 Last: 05.02.2026 19:25 Sources 1

About this happening: The AISURU/Kimwolf botnet is a malware activity cluster tied to hyper-volumetric DDoS attacks and large-scale device conscription. On 2025-12-04, Cloudflare said i...

Latest development: 20.03.2026 08:25

The U.S. Department of Justice disrupted command-and-control infrastructure used by AISURU, Kimwolf, JackSkid, and Mossad in a court-authorized law-enforcement operation, with support from Akamai, Amazon Web Services, Cloudflare, DigitalOcean, Google, Lumen, Nokia, Okta, Oracle, PayPal, SpyCloud, Synthient, Team Cymru, Unit 221B, and QiAnXin XLab.

Open Happening

Aisuru/Kimwolf botnet record DDoS campaign against telecommunications and IT companies

Campaign
H score60 First: 29.01.2026 16:55 Last: 29.01.2026 16:55 Sources 1

About this happening: The Aisuru/Kimwolf botnet campaign expanded in late 2025 with Kimwolf, a DDoS botnet compiled using the NDK, and evidence linking it to AISURU through shar...

Latest development: 20.03.2026 02:49

The U.S. Justice Department, with authorities in Canada and Germany, dismantled infrastructure behind Aisuru, Kimwolf, JackSkid and Mossad, seized U.S.-registered domains and virtual servers used in DDoS attacks against DoD Internet addresses, and said the action was intended to prevent further infections and future attacks.

Open Happening

Cloudflare BGP route leak from router policy misconfiguration disrupts IPv6 traffic

Service Disruption
H score3 First: 26.01.2026 19:50 Last: 26.01.2026 19:50 Sources 1

About this happening: Cloudflare experienced a 25-minute BGP route leak that disrupted IPv6 traffic, causing congestion, packet loss, and about 12 Gbps of dropped traffic. The issue ext...

Open Happening

Cloudflare ACME HTTP-01 WAF bypass security flaw

Vulnerability
H score6 First: 20.01.2026 13:12 Last: 20.01.2026 13:12 Sources 1

About this happening: Cloudflare's ACME HTTP-01 validation flaw let requests to `/.well-known/acme-challenge/*` bypass WAF protections and reach origin servers. Cloudflare said it fixed...

Open Happening

Timeline

  1. 05.12.2025 17:12 2 articles · 7mo ago

    Cloudflare WAF parsing change outage

    Initial Disclosure

    Cloudflare began investigating the outage on December 5, 2025 at 08:56 UTC after a WAF parsing change disrupted network availability. The disruption was brief but broad enough to produce reports from several major internet services.

    Show sources
    Open in new tab