Customers and the broader internet ecosystem faced a significant outage this week when Cloudflare’s network issues impacted traffic. The disruption caused sites and businesses that rely on the company’s service to be unavailable, which created significant impact worldwide.

From the outset, Cloudflare sought to rectify the issue. It told Capacity on Tuesday: “We are all hands on deck to make sure all traffic is served without errors. After that, we will turn our attention to investigating the cause of the unusual spike in traffic.”

Capacity’s coverage on the incident:

Cloudflare down as parts of the internet grind to a halt

Cloudflare issues an update to address outage

Dane Knecht, CTO at Cloudflare, shared via a LinkedIn post: “Transparency about what happened matters … That issue, impact it caused and time to resolution is unacceptable. Work is already underway to make sure it does not happen again, but I know it caused real pain today.

“The trust our customers place in us is what we value the most and we are going to do what it takes to earn that back.”

So, what actually happened?

The root cause of the Cloudflare outage was a configuration file that is automatically generated to manage threat traffic.

This file, according to Cloudflare, grew beyond its expected size and triggered a crash in the software system that handles traffic for a number of Cloudflare’s services.

“The issue was not caused, directly or indirectly, by a cyber-attack or malicious activity of any kind,” co-founder & CEO of Cloudflare, Michael Prince, said via his blog post about the incident.

“The software running on these machines to route traffic across our network reads this feature file to keep our Bot Management system up to date with ever changing threats. The software had a limit on the size of the feature file that was below its doubled size. That caused the software to fail.”

He added: “On behalf of the entire team at Cloudflare, I would like to apologise for the pain we caused the Internet today.”

The urgent need for digital resilience

Accountability and transparency are essential for cloud and cybersecurity companies to build and maintain trust with its customers. However, for many, this latest incident is another thorn in the internet’s side, which has recently seen multiple significant IT outages – including companies like AWS, Microsoft, Optus and Space X’s Starlink.

“This latest incident shows that online services are far more vulnerable to IT disruption that we might think,” said Martin Nilsson, chief product officer at ITRS. “I hope that businesses of all sizes are reviewing their IT and operational resilience strategies to mitigate the impact of future disruption.

“The truth is that most organisations only discover their blind spots during an outage and having full visibility across hybrid-cloud environments is now absolutely vital.”

The outages this year perhaps also highlight how the internet relies on only a small number of major content delivery networks (CDNs) – a market concentration the Internet Society said is only increasing.

“CDNs offer clear advantages: they improve reliability, reduce latency and lower transit demand. However, when too much Internet traffic is concentrated within a few providers, these networks can become single points of failure that disrupt access to large parts of the Internet,” explained the Internet Society’s director of policy, Ryan Polk.

In a world that prioritises connectivity, even brief disruptions can have overwhelming economic and operational consequences. Now, some industry analysts are calling for businesses to build greater network resilience and be proactive, rather than reactive, to challenges.

Polk added: “Organisations should assess the resilience of the services they rely on and examine their supply chains. Which systems and providers are critical to their operations? Where do single points of failure exist? Companies should explore ways to diversify to reduce risk and improve overall resilience.”

Related stories

AMD, Cisco, HUMAIN: Partnering to advance AI infrastructure

Outage, outrage and no plan B, AWS failure shows Europe is flying without a safety net

The impact of delaying the EU AI Act