Loading story…
Cloudflare experienced a significant outage that caused widespread 500 Internal Server Errors across numerous major websites, including LinkedIn, Zoom, Canva, and X. The disruption was traced to a change in Cloudflare's web application firewall (WAF), which was updated to mitigate a newly disclosed industrywide vulnerability in React Server Components. The outage also impacted Cloudflare's own dashboard and APIs, with users and service trackers like DownDetector reporting thousands of connection issues. Cloudflare confirmed that the incident was not the result of a cyberattack but rather an internal deployment intended to enhance security against potential exploitation of the React flaw.
The outage, which began around 8:47 GMT, was quickly investigated and a fix was implemented, allowing affected services to come back online. This event underscores the risks associated with rapid security mitigations in complex, widely used infrastructure, as even well-intentioned updates can inadvertently disrupt global internet services. Cloudflare noted that this was the second outage in a month, though the causes were unrelated, highlighting the challenges faced by major service providers in balancing security and availability.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
After the disruption, Cloudflare confirmed the outage was caused by the WAF deployment made to address the React Server Components vulnerability and stated it was not the result of a cyberattack. This clarified the cause of the incident and distinguished it from malicious activity.
Early on December 5, 2025, Cloudflare suffered a brief outage that caused 500 Internal Server Errors and disrupted access to major websites including X, LinkedIn, Zoom, and Canva. Services were restored quickly after the incident.
Cloudflare deployed a web application firewall change intended to mitigate a newly disclosed industrywide vulnerability affecting React Server Components. The change was an internal security response rather than a reaction to a cyberattack.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A major outage at Cloudflare led to widespread internet disruptions, impacting numerous high-profile services including X (formerly Twitter), ChatGPT, Spotify, League of Legends, and Downdetector. Users around the world reported being unable to access these platforms, with outage tracking sites themselves also affected due to their reliance on Cloudflare's infrastructure. Cloudflare confirmed the issue as a global network problem and stated that they were actively investigating and working to restore services, though no immediate resolution timeline was provided. The outage was notable for its global reach and the number of critical internet services affected, highlighting the central role Cloudflare plays in web infrastructure. The incident drew comparisons to previous large-scale outages involving Cloudflare and other cloud service providers, raising concerns about the resilience of the internet's backbone services. As of the latest updates, Cloudflare teams continued efforts to remediate the issue and restore normal operations for all impacted customers.
Jun 29, 2026
A widespread internet outage disrupted access to major online services including **Google Home**, **Spotify**, **Snapchat**, and **OpenAI**, with reports indicating that tens of thousands of users were affected. Coverage described broad service failures and error messages appearing across the internet, pointing to infrastructure problems that cascaded across multiple consumer and enterprise platforms rather than an isolated application failure. Reporting tied the disruption to **Cloudflare-related** infrastructure issues, underscoring how outages at a major internet delivery and security provider can quickly ripple across dependent services. The incident echoed other large-scale technology disruptions that have knocked major apps offline, highlighting the operational risk created when widely used digital platforms rely on a small number of critical backend providers.
Jul 12, 2026
**React** maintainers disclosed that earlier mitigations for denial-of-service issues in **React Server Components** were **incomplete**, leaving multiple DoS conditions still exploitable as **CVE-2026-23864** (CVSS **7.5**). The issue affects the `react-server-dom-*` packages used by bundlers—`react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`—across versions **19.0.0–19.2.3**. An attacker can send **specially crafted HTTP requests** to **Server Function endpoints** to drive resource exhaustion, potentially causing **server crashes**, **out-of-memory** conditions, or **excessive CPU usage**; applications that do not use a server-side React Server Components/Server Functions setup (e.g., purely client-side SPAs) are not impacted. **Vercel** reported the vulnerabilities were responsibly disclosed and emphasized they **do not enable RCE**, but can still materially impact availability for affected deployments, including those using **Next.js** and other frameworks/bundlers that embed React Server Components. Vercel deployed new **WAF rules** to provide automatic mitigation for projects hosted on its platform, while warning that WAF protections are not a substitute for patching. Recommended remediation is to upgrade to patched releases: **React** `19.0.4`, `19.1.5`, `19.2.4`, and updated downstream framework versions (including multiple **Next.js** fixed releases) as provided by maintainers.
Jun 29, 2026