Millions face disruption as Cloudflare experiences technical failure

New Delhi: Millions of internet users were affected on Tuesday as a technical failure at Cloudflare disrupted major websites, including OpenAI, Elon Musk’s X (formerly Twitter) and Spotify, leaving some services inaccessible for around three hours. The outage bore similarities to disruptions experienced by Amazon (AWS) and Microsoft cloud services last month.

Cloudflare operates a global network of servers that provides security, performance and reliability services for websites and online applications, acting as an intermediary between users and website servers.

According to its website, “Cloudflare is one of the world's largest networks. Today, businesses, non-profits, bloggers, and anyone with an Internet presence boast faster, more secure websites and apps thanks to Cloudflare.”

Its services include caching website data on global servers through a Content Delivery Network (CDN), protection from malicious traffic via DDoS protection, directing users to correct IP addresses with DNS services, and filtering harmful requests through security and firewall measures.

The incident, which began around 12:00 UTC, affected services that rely on Cloudflare’s CDN, DDoS protection and DNS systems. Cloudflare has since resolved the issue and is monitoring for errors.

The company initially reported that it had been affected by a “latent bug.” Dane Knecht, Cloudflare’s Chief Technology Officer, explained that “the bug was in a service supporting bot mitigation, triggered by a routine configuration change. This caused a broad degradation of Cloudflare's network and services.”

I won’t mince words: earlier today we failed our customers and the broader Internet when a problem in @Cloudflare network impacted large amounts of traffic that rely on us. The sites, businesses, and organizations that rely on Cloudflare depend on us being available and I…

— Dane Knecht 🦭 (@dok2001) November 18, 2025

“Sharing an update on the recovery of our services. We were able to resolve the impact to traffic flowing through our network at approximately 14:30 UTC, which was our first priority, but the incident required some additional work to fully restore our control plane (our dashboard and the APIs our customers use to configure Cloudflare),” Knecht added.

Matthew Prince, Co-founder and CEO of Cloudflare, clarified that the outage was not caused by a cyber attack or malicious activity. He said the problem arose from “a change to one of the database systems' permissions, which caused the database to output multiple entries into a 'feature file' used by the Bot Management system. That feature file, in turn, doubled in size. The larger-than-expected feature file was then propagated to all the machines that make up our network.”

Prince added, “After we initially wrongly suspected the symptoms we were seeing were caused by a hyper-scale DDoS attack, we correctly identified the core issue and were able to stop the propagation of the larger-than-expected feature file and replace it with an earlier version of the file. Core traffic was largely flowing as normal by 14:30. We worked over the next few hours to mitigate increased load on various parts of our network as traffic rushed back online. As of 17:06 all systems at Cloudflare were functioning as normal.”