Beyond the News
Sign in
Cloud & InfrastructureEdge & CDN Active dossier

Cloudflare’s H1 2026 DDoS report shows hyper-volumetric attacks surging while most attacks stay short

Cloudflare reports a sharp rise in 1 Tbps-plus attacks and DNS amplification activity in the first half of 2026, while most mitigated attacks remained brief and below 500 Mbps—an argument for automated always-on controls rather than manual response.

Reviewed and published by Lars Jansen Updated 4 min read
Comment
First published

Key details

  1. Cloudflare reports 935 network-layer DDoS attacks above 1 Tbps in H1 2026.
  2. The report records a 519% quarter-over-quarter increase in 1 Tbps-plus attacks from Q1 to Q2.
  3. DNS-based attacks were 34.3% of network-layer activity; DNS Floods rose from 25.7% to 40.0% quarter-over-quarter.
  4. CLDAP Floods increased 580% quarter-over-quarter and became the third-largest network-layer vector in Q2.
  5. 96.62% of network-layer attacks were below 500 Mbps and 90.60% lasted under 10 minutes.
  6. Cloudflare says it mitigated 23.2 million network-layer and 29.64 trillion HTTP DDoS requests in H1.
  7. The report is based on Cloudflare network telemetry and is not an independent global census.

What builders should take away

  1. Keep network and application-layer mitigation enabled before an incident; the reported attack durations are shorter than a manual procurement or escalation cycle.
  2. Harden authoritative and recursive DNS paths and monitor for reflection/amplification signatures, not only volumetric bandwidth.
  3. Test origin exposure and failover assumptions against attacks well below 500 Mbps; that threshold is not a survivability guarantee.
  4. Use provider telemetry as one input to capacity and incident planning, and compare it with your own logs and another source where possible.
  5. Document post-attack recovery steps because short attacks can still cause retransmissions, timeouts and downstream degradation after traffic falls.

What changed

Cloudflare’s first H1 DDoS Threat Report combines Q1 and Q2 2026 telemetry and reports 935 network-layer attacks above 1 Tbps, with a 519% quarter-over-quarter increase from Q1 to Q2. DNS-based attacks represented 34.3% of network-layer activity, while DNS Floods rose from 25.7% to 40.0% quarter-over-quarter and CLDAP Floods rose 580% to become the third-largest vector in Q2. At the same time, 96.62% of network-layer attacks remained below 500 Mbps and 90.60% lasted under 10 minutes. Cloudflare says it mitigated 23.2 million network-layer and 29.64 trillion HTTP DDoS requests in the first half of the year.

Why it matters

The operational implication is asymmetric: the largest attacks are becoming more common, but most attacks finish faster than a human response cycle. Teams therefore need preconfigured, continuously active network and application-layer protection, DNS hardening and tested escalation paths rather than relying on on-demand mitigation. The report also suggests that capacity planning based only on headline bandwidth misses shorter reflection/amplification and low-and-slow attack patterns.

The extreme tail is growing

Cloudflare reports 935 network-layer attacks exceeding 1 Tbps in H1 2026 and a 519% increase from Q1 to Q2. It also reports 23.2 million network-layer attacks and 29.64 trillion HTTP DDoS requests mitigated across its network.

DNS and reflection vectors are moving

DNS-based attacks accounted for 34.3% of network-layer activity. DNS Floods rose from 25.7% to 40.0% quarter-over-quarter, while CLDAP Floods increased 580% quarter-over-quarter to become the third-largest vector in Q2.

Most attacks leave little time for intervention

Despite the growth in hyper-volumetric attacks, Cloudflare says 96.62% of network-layer attacks were below 500 Mbps and 90.60% ended in under 10 minutes. A small attack can still overwhelm an unprotected origin, so duration and bandwidth should not be treated as safety thresholds.

The data is directional, not universal

These measurements come from traffic Cloudflare mitigated on its own network. They reveal useful attack patterns and preparedness implications, but should not be read as a complete global incidence rate or as proof that every provider sees the same mix.

What to watch next

  • Whether subsequent quarters confirm the reported rise in hyper-volumetric and DNS-reflection activity.
  • Independent measurements from other network operators and security researchers.
  • Changes in managed DDoS pricing, automatic mitigation defaults and origin-protection requirements.
  • Whether CLDAP and other reflection vectors continue to move up the attack ranking.
  • Post-incident data on recovery time and downstream service degradation after short attacks.

Still unclear

  • Cloudflare’s telemetry reflects attacks reaching or mitigated by Cloudflare and may not represent providers or origins outside its network.
  • The report combines heterogeneous customers, geographies and protection configurations.
  • Quarter-over-quarter percentage changes can be sensitive to a low prior-quarter baseline.
  • The report describes attack traffic, not the fraction of customer incidents that caused user-visible downtime.

Sources

Direct reading behind this dossier.

2 sources
Cloudflare DDoS Threat Report H1 2026
Cloudflare primary_report

First-party H1 2026 report with attack-volume, vector, duration and bandwidth statistics based on Cloudflare network telemetry.

Cloudflare DDoS protection
Cloudflare primary_documentation

First-party product and mitigation context; does not independently validate the report’s global prevalence claims.

Discussion

Discussion is reader-contributed. Comments are not part of the BTN dossier or its editorial evidence.

0 visible comments

Join the discussion

Keep comments useful and relevant. Reader contributions may be moderated and are not BTN editorial evidence.

Sign in to comment
Continue reading
Artificial Intelligence

Cloudflare links AI code scanning to live edge exposure before proposing a fix

The interesting part is not another AI scanner. Cloudflare is connecting source-code evidence to what is actually deployed and being attacked at the edge, validating findings outside the model, then preparing both a code patch and, where appropriate, a narrowly scoped WAF mitigation for customer review.