What caused the Cloudflare outage that disrupted half of the world’s internet?

Several of the world’s biggest online platforms, including X, Spotify, ChatGPT and countless other websites that rely on internet infrastructure giant Cloudflare for protection and traffic management, were hit by a major outage on Tuesday, sending large parts of the internet into chaos.

Users across the globe complained about pages refusing to load, apps slowing to a crawl, strange error screens and, in many cases, complete shutdowns. These are services that usually process billions of requests a day, so even a short interruption felt huge.

As the confusion grew, Cloudflare’s Chief Technology Officer, Dane Knecht, took to X to explain what had gone wrong. In a detailed post, he broke down how an internal failure, not a cyberattack, spiralled into a worldwide disruption.

More from Explainers

Cloudflare is down. Why this internet service provider you’ve never heard of is so important A double standard? What the US condolence message on Delhi blast reveals

Here’s what happened

A ‘latent bug’ triggered the Cloudflare outage

Cloudflare’s CTO, Dane Knecht, said the disruption was caused by a “latent bug”, sharing an apologetic explanation on X.

In his post, Knecht wrote, “In short, a latent bug in a service underpinning our bot mitigation capability started to crash after a routine configuration change we made. That cascaded into a broad degradation to our network and other services. This was not an attack.” The issue had stayed hidden during testing and had never caused trouble before — until now.

Knecht admitted that Cloudflare “failed its customers and the broader internet” with this outage and said the team is already working to ensure “it does not happen again.”

Editor’s Picks

1

Cloudflare is down. Why this internet service provider you’ve never heard of is so important 2

Half of the internet was down on Monday. Here’s why

“I know it caused real pain today,” he added, promising a detailed explanation of the incident “in a few hours.”

In a status page, later Cloudflare claimed that it has fixed the issue and is continuing to monitor for errors.

“A fix has been implemented and we believe the incident is now resolved. We are continuing to monitor for errors to ensure all services are back to normal.” the company wrote.

What is a ’latent bug’?

A latent bug is basically a hidden flaw in a system. It can sit quietly for months or even years without causing any visible problems. These bugs are extremely hard to catch because they don’t show up during regular testing or everyday use.

Usually, they only reveal themselves when a very rare combination of conditions comes together. When that happens, the bug suddenly surfaces and can trigger unexpected, sometimes widespread, issues.

In Cloudflare’s case, the dormant flaw was buried inside a service linked to the company’s bot-mitigation tools, which are used to block abusive automated traffic. Under normal circumstances, the bug didn’t interfere with anything. But during a routine configuration update, Cloudflare unknowingly created the exact conditions needed to activate it.

Once the service began crashing, the problem quickly spread. The failure did not stay limited to the bot-mitigation subsystem, it transcended into other interconnected systems across Cloudflare’s network, affecting multiple services.

Why is the Cloudflare outage a big deal

Cloudflare works behind the scenes to make the internet faster and safer.

Information technology professor at the University of Notre Dame’s Mendoza College of Business, Mike Chapple, says that Cloudflare is a “content delivery network” that takes content from the world’s websites and mirrors them on thousands of servers worldwide.

One of the main services Cloudflare offers customers is protection from Distributed Denial of Service (DDoS) attacks, which are designed to knock websites offline.

“When you access a website protected by Cloudflare, your computer doesn’t connect directly to that site,” Chapple said. “Instead, it connects to the nearest Cloudflare server, which might be very close to your home. That protects the website from a flood of traffic, and it provides you with a faster response. It’s a win-win for everyone, until it fails, and 20 per cent of the internet goes down at the same time.”

The company said it has data centres in 330 cities, and 13,000 networks “directly connect to Cloudflare, including every major ISP, cloud provider, and enterprise.”

With input from agencies