Original announcement: Cloudflare · 2026-10-29. Read the official announcement.
Summary of Cloudflare’s Q3 2026 DDoS Threat Report
Cloudflare released its 26th quarterly DDoS Threat Report on October 29, 2026, analyzing Distributed Denial of Service (DDoS) activity from July to September 2026. Key findings include a sharp rise in short-duration, low-bandwidth network layer attacks, a decline in massive hyper-volumetric attacks, and changes in attack vectors with a collapse of CLDAP floods and surges in DNS amplification and UDP floods. The United States was the most targeted country, with Canada and Israel also facing significant spikes in attacks. These shifts reflect both the evolving tactics of threat actors and the impact of global botnet takedowns earlier in the year.
What Happened in Q3 2026?
- Cloudflare mitigated approximately 8,200 DDoS attacks per hour, totaling over 18 million network-layer attacks and 14.4 trillion HTTP-layer DDoS requests in the quarter.
- Short-burst attacks under 10 minutes and below 1 Gbps increased by 208% compared to Q3 2025, commonly associated with “booter” services targeting industries like software, gambling, and IT.
- Hyper-volumetric network-level attacks exceeding 1 Tbps dropped nearly 69%, down to 251 attacks from 805 in the previous quarter following law enforcement disruption of major IoT botnets.
- CLDAP reflection and amplification floods collapsed by 99.5%, likely due to the declining availability of exploitable servers and shifting attacker tactics.
- Other UDP-based attacks, including DNS amplification and general UDP floods, increased by over 200%, becoming dominant vectors.
- Attack targets diversified beyond media to include consumer services, internet infrastructure, adult entertainment, and more.
- Geopolitical and domestic events contributed to regional attack spikes, notably in Canada and Israel.
Who Should Care?
Network defenders, security teams, and developers responsible for resilience of web and network services should pay close attention. The rise in short, frequent, moderate-volume attacks means defenses need agility and automation. Infrastructure providers and cloud services must address UDP-based threats, which are becoming increasingly prevalent in DDoS campaigns. Organizations in industries newly targeted or those in geopolitically sensitive regions should review their security postures. Additionally, anyone relying on IoT devices as network endpoints must remain vigilant despite botnet disruptions, as new variants keep emerging.
Recommended Actions for Developers and Security Teams
- Verify Automated DDoS Protections: Ensure DDoS mitigation systems perform autonomous detection and response quickly enough to block attacks lasting under 10 minutes.
- Review UDP Traffic Filtering: Implement monitoring and filtering strategies for UDP traffic, including DNS amplification attempts, given their rise in attack volume.
- Audit IoT Device Security: Strengthen IoT device access and password policies to reduce botnet risk, and stay updated on emerging variants.
- Expand Industry-Specific Defenses: Assess risk exposure beyond traditional sectors like media into consumer services and infrastructure sectors targeted recently.
- Monitor Threat Intelligence Feeds: Integrate updated DDoS threat data such as Cloudflare’s Botnet Threat Feed to stay ahead against abusive IP sources.
Practical Checklist
- Confirm your DDoS mitigation tools auto-detect and mitigate attacks under 10 minutes.
- Implement or tighten UDP flood and DNS amplification traffic controls at the network edge.
- Conduct regular IoT device security assessments and patching.
- Expand monitoring to cover evolving attack vectors and new target industries.
- Subscribe to community threat feeds for timely indicators of compromise.
Editorial Checks
Details such as exact mitigation technologies used by Cloudflare or the precise geographic distribution of all attacks were not disclosed. The report does not specify defensive recommendations outside general observations, so teams should consult detailed security advisories for implementation guidance. The source also lacks granular impact data by company size or exact downtime metrics.
