Cloudflare says it mitigated a 26M-requests-per-second DDoS attack, the largest HTTPS DDoS attack detected to date, targeting a customer using its Free plan
Internet infrastructure firm Cloudflare said today that it mitigated a 26 million request per second distributed denial-of-service …
Context & Ripple Effects
Cloudflare had already reported stopping a 17.2M-rps DDoS attack and, more recently, a 15.3M-rps HTTPS attack against a crypto customer. The new incident raises its disclosed HTTPS benchmark while extending that protection to a customer using the Free plan.
The record did not stand for long: related coverage later shows Google Cloud blocking a 46M-rps attack, while Cloudflare subsequently reported dozens of attacks whose largest exceeded 71M rps. The sequence makes attack-handling scale a visible point of competition among infrastructure providers.
First-order effects
- Cloudflare's Free-plan customer avoided the immediate availability impact of a 26M-rps HTTPS flood, demonstrating that Cloudflare applied its mitigation capacity beyond paid tiers.
- Cloudflare gains a new public performance benchmark for its HTTPS DDoS defenses, following its earlier disclosed 15.3M-rps event.
Second-order effects
- Google Cloud and other infrastructure providers face a more explicit benchmark for high-volume HTTPS attack mitigation; Google Cloud's later 46M-rps disclosure shows that scale claims quickly became comparative.
- Customers evaluating DDoS protection receive evidence that Cloudflare's entry-level service can absorb an attack volume previously associated with major targeted incidents, sharpening the distinction between baseline protection and premium service features.
Third-order effects
- The later progression to dozens of hyper-volumetric attacks exceeding 71M rps indicates that record-setting request floods are becoming a recurring capacity test rather than isolated events.
- If this escalation continues, DDoS resilience will increasingly be determined by the size and automation of an infrastructure provider's mitigation network, concentrating the advantage with providers able to operate protection at scale across customer tiers.
The trend: Application-layer DDoS attacks are escalating in disclosed request rates, turning large-scale automated mitigation into a competitive capability for cloud and edge providers.