Cloudflare Logs 18.2 Million DDoS Attacks in One Quarter as Short-Burst Assaults Spike
Cloudflare reports blocking 18.2 million network-layer DDoS attacks in the third quarter of 2026, an average of 8,226 assaults an hour, with short-burst and DNS amplification attacks more than doubling compared with the previous quarter.
Cloudflare says its systems blocked 18.2 million network-layer distributed denial-of-service attacks in the third quarter of 2026, a rate of 8,226 attacks every hour.
The company reports that this is a 38% increase over the previous quarter, pointing to a sharp rise in both the frequency and intensity of attempts to disrupt online services. DDoS attacks work by flooding targets with traffic so that legitimate users can’t get through. When they hit the network layer that routes data, they can affect multiple services at once.
Cloudflare’s figures highlight rapid growth in two specific techniques. Short-burst attacks rose 208%, with adversaries sending very intense but brief waves of traffic. These can be harder to catch because many defenses are tuned to longer events. DNS amplification attacks increased by 215%. In these, attackers exploit misconfigured Domain Name System servers to magnify their traffic, directing far more data at a victim than they could send alone.
For users, the consequences show up as banking apps that hang, government sites that fail to load, or trading platforms that time out. Behind the scenes, administrators work to reroute traffic and filter out malicious requests fast enough to keep services running. The trend toward short, sharp spikes makes that job more difficult because outages can start and end quickly.
Cloudflare’s summary doesn’t list specific victims, but past targeting patterns point to financial firms, gaming platforms, government agencies, cryptocurrency services, and politically sensitive organizations as frequent recipients of DDoS campaigns.
On a broader level, numbers on this scale indicate that DDoS activity has become part of the constant background of running any significant online service. Attack tools and rented botnets give relatively small groups the ability to hit large infrastructures, while defenders must keep investing in bandwidth and specialized protection.
Key developments to watch are whether other major providers report similar jumps, whether regulators start to treat DDoS resilience as a minimum standard for critical infrastructure, and whether law enforcement moves more aggressively against botnet operators and the services that facilitate for-hire attacks.
Sources
- OSINT