Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave

Welcome to the 25th edition of Cloudflare's DDoS Threat Report. This is the first half-year edition in the series: rather than publishing separate reports for the first and second quarters of 2026, we have combined our coverage of Q1 and Q2 into a single volume covering January through June 2026. The analysis is produced by Cloudforce One, Cloudflare’s Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network.

Key insights

  1. The 1 Tbps club grew. Cloudflare mitigated a combined 935 network-layer DDoS attacks exceeding 1 Tbps in the first half of 2026 and a +519% quarter-over-quarter surge between Q1 and Q2. 
  2. The attack-vector center of gravity shifted from botnet floods to reflection and amplification. DNS-based attacks accounted for 34.3% of all network-layer activity in the first half of 2026, with DNS Floods alone climbing from 25.7% to 40.0% of network-layer attacks quarter-over-quarter. CLDAP Floods surged +580% quarter-over-quarter to become the #3 vector in Q2.
  3. Geopolitics and global events influence the landscape. Media, Production & Publishing held the #1 most-attacked industry crown in both quarters at 14.2% of all Continue reading

SONiC Deep Dive: Interface State Change Pipeline

Enable Interface Ethernet0

After creating VLAN 10, the next step is to enable interface Ethernet0. The baseline configuration for Ethernet0 already exists in the PORT table of CONFIG_DB. This configuration is populated during the SONiC switch startup process using the platform configuration and configuration files, including config_db.json. When the switch boots, the configuration from config_db.json is loaded into CONFIG_DB, which is implemented as a Redis database.

 

GONFIG_DB and APPL_DB


The SONiC command config interface startup Ethernet0 does not create the complete PORT|Ethernet0 entry to the CONFIG_DB. Instead, it changes the administrative state of the existing port configuration. In this example, the admin_status field of PORT|Ethernet0 is changed to up (1).

 

After admin_status is changed, Redis generates a notification for applications subscribed to the PORT table in CONFIG_DB (2). The Redis notification indicates that the configuration entry has changed. It identifies the affected key and the operation that occurred rather than containing the complete PORT|Ethernet0 configuration. portmgrd, running in the SWSS container, is one of the SONiC components involved in processing port configuration. portmgrd uses the notification to identify the changed key and retrieves the current field/value data from CONFIG_DB. It then processes the configuration and prepares Continue reading

Worth Reading 081026


There is an interesting fight within the leadership of U.S. AI companies. It is between the supporters of open-source AI and those driven to oppose open-source AI.

 


A Chinese man accused by the communist authorities of having committed “economic crimes” figured that he could evade the long reach of the country’s police state by hiding out in plain view: in a stadium packed with 60,000 people listening to a pop concert.

 


The J2SW Prefix Advertisement Checker, my 3rd application in the network series, checks the exact prefix against live routing data and reports the origin ASN seen by RIPE RIS collectors.

 


A growing number of drivers are pushing back against increasingly tech-heavy vehicles, saying they prefer the simplicity of a

 


The IETF does not launch rockets, or design spacecraft, or even work on radio systems and spectrum assignment, but it has been engaged in the standardisation of communications protocols used to communicate with these spacecraft. Here’s a few topics that were presented at IETF 126.

You’ve Been Running a Kubernetes Security Model in NSX and Didn’t Even Know It

One of the blockers to moving VMs off vSphere and onto Kubernetes is losing NSX and the protection it provides. Security teams that have spent years building out distributed firewall policy look at Kubernetes and are, quite understandably, alarmed by the flat network and the fact that any workload can reach any other by default.

How will they enforce east-west traffic controls? Will they be able to replicate NSX distributed firewall rules with the same granularity? What about security groups, tiered policy, and rules that travel with the workload when it moves? These are important questions that must be answered before migration can begin.

Migrate vSphere to Kubernetes with microsegmentation intact

Calico addresses vSphere to Kubernetes security concerns with a network policy model that maps directly to key features of the NSX distributed firewall (NSX DFW). Every property NSX DFW users rely on has a direct Calico equivalent: tiered governance, workload-identity enforcement, distributed kernel-level inspection, and dynamic workload grouping. Teams coming from vSphere will recognise the pattern quickly.

Let’s walk through each one in detail.

Distributed Enforcement

Enforcement on the host means better performance and automatic scaling
Enforcement on the host means better performance and automatic scaling

Traditional firewalls sit at the edge of the network. Traffic between workloads inside Continue reading

Everything we launched during Agents Week

At the beginning of Agents Week, Rita shared that agents represent the next evolution of computing: not only as a new application of AI but also as a new class of software that’s shaping how people interact with technology, and how software interacts with the Internet. Over the last year or so, we set out to explore what this shift means for developers and customers building AI-native apps and the infrastructure needed to support them. As agents become more capable and autonomous, the challenges extend beyond the models themselves — to identity, communication, orchestration, memory, observability, and security.

Over the past week we’ve shared how we’re bringing those pieces together across the Cloudflare platform to serve an Agentic Internet. Each day we presented new tools, products, and ideas toward building for an Internet where humans and agents cooperate instead of collide.

Monday, August 3

Monday focused on the foundations for building and running intelligent, autonomous apps — the runtime and infrastructure agents rely on.

Tuesday, August 4

Tuesday introduced the Agent Development Lifecycle (ADLC) and the primitives that take agentic software from prototype to production.

Wednesday, August 5

Wednesday extended Zero Trust from users and devices to agents themselves — Continue reading

Serving the most critical missions: Cloudflare for Government achieves FedRAMP Class D (High) Certified status

We believe the Internet must be a force for good, and that it requires a foundation of trust. Nowhere is that trust more critical than in public service. Government agencies are the stewards of a nation’s most sensitive data. They protect national security, critical infrastructure, and the personal information of every citizen. 

Cloudflare’s mission is to help build a better Internet. A key part of that mission is giving public sector agencies the best technology to stay secure, fast, and reliable. That means meeting the highest possible standards.

Today, we are proud to announce a major milestone: Cloudflare for Government has achieved FedRAMP Class D (High) certification status. We are honored to take this step with our sponsoring agency, the National Institute of Standards and Technology, whose global mission demands the highest level of security.

We are also very excited to announce that we are using the new systems we developed for FedRAMP High as the foundation of our commitment to pursuing U.S. Department of Defense Impact Level 4 (DoD IL4) authorization. IL4 is the department’s cybersecurity standard for systems handling controlled, unclassified data. We are confident that bringing our global network to this space will change Continue reading

New Financial Tools Section (Retirement Planner Is the Big One)

I mentioned in the WordPress-to-Hugo migration post that this site was going to start drifting a bit toward retirement and financial planning content alongside the usual networking stuff. Here’s the first real piece of that: a new Financial Tools section, same browser-only, nothing-sent-to-a-server philosophy as the Network Tools I’ve been building for years.

Retirement & Social Security Planner

This is the one that actually matters. It’s a full retirement dashboard — portfolio projections, Social Security claiming strategy (including spousal/survivor benefits), RMDs, a Roth conversion planner, Medicare/IRMAA cost estimates, and a Monte Carlo simulation that runs a thousand random market paths against your numbers instead of just assuming a flat return every year. I’ve been building and using a private version of this for a while now; this is that tool, cleaned up for public use. Find it at fryguy.net/financial-tools/retirement-planner.

Retiring WordPress – How I Migrated fryguy.net to Hugo (With an AI Pair Programmer)

This site has run on WordPress since basically forever. As of this week, it doesn’t anymore. Everything you’re reading is now a static Hugo site, built from Markdown, served by nginx, with no PHP and no database anywhere in the stack. Here’s why I did it, what actually moved, and how I used Claude Code as a pair programmer for most of the heavy lifting.

Why bother

Let’s be honest about how it got this bad: I didn’t keep up with it. I know. Servers don’t rot on their own — you stop patching them, stop upgrading them, and a few years later you’re staring at a stack that’s aged out from under you. The old droplet had quietly rotted underneath a site that still worked fine. Ubuntu 18.04 — EOL since 2023. PHP 7.4 — EOL since 2022, with no apt-upgrade path to anything newer (the PPA I’d have needed was frozen). MySQL 5.7 — also EOL. WordPress itself was current; everything under it wasn’t, and there was no clean patching path left, just a slow accumulation of risk on a box facing the public internet.

Worth Reading 080826


Would you work differently if you knew every keystroke was being saved, every website logged, every idle minute counted against you?

 


Everything I read about the AI industry leads me to think there will be an AI crash.

 


I designed this to help with different BGP communities and configuring them on your routers.

 


It’s commonly believed that when selecting between a number of routes for the same address prefix, a BGP speaker will select the route with the shortest AS Path.

 


There is an interesting fight within the leadership of U.S. AI companies. It is between the supporters of open-source AI and those driven to oppose open-source AI.

Hedge 315: Engineering Psychology

We often talk about “human infrastructure” in network engineering–but what does this mean, and how do we help engineers “produce” while helping them to flourish as individuals? Catherine Hicks joins Tom and Russ to discuss the psychology of software engineering, and how the lessons learned apply to network engineering.

download

You can find Catherine’s new book on the psychology of software engineering here.
If you would like to follow Catherine’s writing in this area, including the impact of AI on work, you can find her blog here.
You can connect with Catherine on LinkedIn.

Unveiling good and bad behaviors on the Agentic Internet

The Internet isn’t a single lane of traffic. For a long time, the rule of thumb in web security was that bots are bad, while humans are good. Of course, we’re far past this generalization. Humans can be fraudulent, and bots can be helpful at different levels. Site owners actively want some automated traffic to interact with our sites to make the Internet functional and discoverable.

To complicate things further, the line between "human" and "bot" is blurring more and more. Now, we have a type of “hybrid” traffic where a single session shifts from human to agentic and back again. (Think of a user browsing a store, and then handing off the checkout process to an automated shopping assistant.)

So, how do website owners manage this kind of complexity? What matters here is assessing behaviors. Is this behavior abusive? Malicious? What’s the risk presented here, and can I trust this visitor based on their actions? Solving this requires moving beyond static, point-in-time checks. It requires analyzing continuous behaviors to evaluate Trust.

In this post, we’ll share an inside look into the strategy of the Web Integrity & Trust team (covering the bots and fraud problem spaces) around detecting Continue reading

Introducing Radar Researcher: An AI tool for exploring Internet data in plain language

Since launching in 2020, Cloudflare Radar has provided one-of-a-kind insight into Internet traffic on a global scale. The open data that Radar publishes from our global network is used by a variety of experts in different domains: human rights advocates, journalists, academic researchers, network operators, and more.

Today, as part of Agents Week, Radar is beta-launching a new tool: Radar Researcher. 

Now, if you want to answer a question with Radar’s data, you can just ask in plain language and get an answer back with real, interactive charts, all built on Cloudflare's developer platform. You no longer need to find the right page, choose the right filters, or read the API documentation to write a query. 

Why we built Radar Researcher

Over the past six years, the Radar team has worked to provide clear, accessible, reliable data visualizations of complex datasets. This is not without its challenges: our user base is vast and ranges from curious novices to technical network experts. Even so, we publish as much insight into the Internet as seen from our network as we can: DNS queries from our public resolver 1.1.1.1, HTTP traffic from across our global network, Continue reading

1 2 3 … 3,894