Cloudflare Logs 18.2 Million DDoS Attacks in Q3 2026

En bref

• Cloudflare mitigated roughly 18.2 million DDoS attacks in Q3 2026.
• HTTP floods accounted for 14.4 trillion requests.
• The rate averaged 8,226 hourly and 197,400 daily, a 38% rise.
• No CVE is associated; the activity is volumetric and resource-exhaustion traffic.
• K-12 teams should treat the aggregate data as a readiness warning.

Cloudflare's quarterly DDoS report, released Thursday, points to a sustained rise in disruptive traffic during Q3 2026. The company says its systems absorbed roughly 18.2 million attack events in the period, while HTTP request floods accounted for 14.4 trillion requests. That works out to about 8,226 incidents every hour, or nearly 197,400 over a full day, and represents a 38 percent climb from the prior comparison period.

Both major categories feature in the totals: network-layer floods that aim to saturate bandwidth and connection state, and HTTP floods that try to exhaust application resources. Cloudflare frames the numbers as evidence of mitigation work rather than a list of victims. No CVE or specific software defect is tied to the activity; these are volumetric and resource-exhaustion campaigns waged by threat actors against exposed services.

Who is affected? Any organization that depends on internet-facing services, including school divisions, portals, and remote-learning platforms, can feel the same pressure when attack volume spikes. The aggregate figures do not identify sectors or regions, so they should be read as a baseline warning, not a confirmed incident report for New Brunswick.

Why it matters: a 38 percent jump in attack frequency raises the chance that mitigation capacity, upstream scrubbing, and on-call staff are tested at the same time. For K-12 IT teams, the practical risk is not just outage; it is degraded access to learning tools and administrative systems during peak hours.

What to watch: continuing quarterly changes in HTTP versus network-layer shares, whether hourly peaks cluster around school hours, and any shift from short bursts to longer campaigns. Cloudflare's Thursday disclosure is a reminder to validate DDoS runbooks and upstream contacts before the next flood arrives.

À faire maintenant

1. Confirm which public-facing district services are covered by managed DDoS protection at both the network and application layers, and close any gaps.
2. Set and tune rate limits, connection caps, and request thresholds on web tiers using recent traffic baselines rather than defaults.
3. Document escalation paths to your ISP, scrubbing provider, and Cloudflare contact, including who can activate emergency mitigation.
4. Run a DDoS tabletop exercise with network, application, and communications staff; assign decision rights for failover and status updates.
5. Instrument alerts for sudden request-volume and connection-rate anomalies, especially during school-hour peaks.
6. Review caching, static asset offload, and failover capacity so learning portals remain usable when mitigation is active.
7. Since no CVE applies, prioritize exposure reduction and operational readiness over patch response for this specific report.

Source originale

The Hacker News