Cloudflare Suffers Major Outage, No Definitive Cause Identified

A massive portion of the internet ran into trouble early Tuesday morning when Cloudflare-backed services began displaying a “500 Internal Server Error” code. X, ChatGPT, OpenAI, and League of Legends were among the several affected platforms, including any hosts whose sites rely on Cloudflare’s services.

The issues started around 6:48 AM ET and are still not cleared several hours later. Cloudflare says the downtime was caused by a “spike in unusual traffic to one of Cloudflare’s services beginning at 11:20 UTC,” and warns that users may continue to “observe higher-than-normal error rates.”

As for what caused that unforeseen spike in traffic, nobody knows yet. A DDoS attempt is always on the table, but many folks seem to be pointing at Cloudflare’s routine maintenance windows instead, which had scheduled work overnight in Tahiti, Los Angeles, Atlanta, and Santiago.

It’s an understandable question: When a provider goes down across multiple regions, it doesn’t take much for people to assume it’s a bad actor.

This also comes just one day after Microsoft spent the better half of a day fighting off a major 15.72 terabits per second (Tbps) DDoS attack, peaking at 3.64 billion packets per second (pps).

Microsoft says the flood came from a single public IP in Australia. More specifically, it was powered by the Aisuru botnet, which exploited more than 500,000 devices, including home routers to security cameras.

“These sudden UDP bursts had minimal source spoofing and used random source ports, which helped simplify traceback and facilitated provider enforcement,” Microsoft said in a statement.

Once again, none of this is happening in a vacuum. After AWS went dark for a full day earlier this month, StorMagic’s CPO, Bruce Kornfeld, warned that we’ve built a digital economy around several single points of failure.

“Small edge sites can no longer be 100% dependent on the cloud if uptime, cost, and performance are important to their business,” he told us.

Between Azure’s record-sized attack and Cloudflare’s multi-region outage, the past 48 hours have, without a doubt, been a stress test for any host relying on Azure and Cloudflare.

But even if Cloudflare’s outage wasn’t an attack, the scale and timing of these events are becoming so frequent that it’s time to ask: What can even the most trusted platforms handle?