Developing: Cloudflare goes down again, taking the internet with it

Outage is fixed, but shines a light on the internet’s vulnerability - again

Just weeks after a Cloudflare outage took down services like ChatGPT, Spotify and Computing, a similar problem has struck again.

Several websites – including ours – have experienced access issues this morning, although the problem seems to have been fixed faster than last time.

Sites like LinkedIn, SubStack and, ironically, Down Detector have all suffered major errors today, displaying the same ‘500 Internal Server Error’ message.

Notably several of the sites caught up in the outage at the end of November, including ChatGPT, have not been affected.

That implies that the sites have moved to make themselves less reliant on Cloudflare, although it could also be that the root cause was different.

Last month’s outage was not caused by a cyberattack but a technical issue – though it was related to DDoS attacks. The root cause was linked to the company’s Bot Management system, which is used to protect against threats like DDoS.

A change to a data system’s permissions meant a database was outputting multiple data entries, causing a specific file to double in size. That larger-than-expected file was propagated to all the machines in Cloudflare’s network. Because the software had a limit on the expected file size, it then failed.

Today’s outage was down to “issues with Cloudflare Dashboard and related APIs,” according to the company’s status page.

Cloudflare said in a post on X that the fault was down to “a change made to how Cloudflare's Web Application Firewall parses requests,” which “impacted the availability of Cloudflare's network for several minutes.”

The ongoing effects actually lasted several hours for some websites, but hours are comprised of minutes so the statement is technically correct.

Cloudflare added, “This was not an attack; the change was deployed by our team to help mitigate the industry-wide vulnerability disclosed this week in React Server Components.”

Tim Wright, Technology Partner at law firm Fladgate, said the latest outage is “another reminder that much of the internet runs through just a few hands.

“Businesses betting on 'always-on' cloud resilience are discovering its single points of failure. Repeated disruptions will draw tougher scrutiny from regulators given DORA, NIS2, and the UK’s emerging operational resilience regimes.

“Dependence on a small set of intermediaries may be efficient but poses a structural risk the digital economy cannot ignore. We can expect regulators to probe the concentration of critical functions in the cloud and edge layers — while businesses rethink whether convenience has quietly outpaced control.”

Computing says:

None of the recent mass outages – at AWS and Azure in October, and Cloudflare in November and today – have been caused by malicious incidents, but throw the internet’s fragility into stark relief.

Although built as a secure, distributed architecture, the internet’s modern reliance on giant companies means they act as a single point of failure; and clearly, they need to do more to protect their own resilience.

We talked about the issue this week on Computing Wrapped, now available on demand, where I discussed whether these outages have increased the chances of a cyberattack against one of these companies.