Critical

Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

The Hacker News

October 31, 2026 at 4:56 AM

Actively Exploited

Overview

Cloudflare reported a significant increase in network-layer DDoS attacks in the third quarter of 2026, with a staggering 18.2 million attacks mitigated over the three-month period. This translates to an average of about 8,226 attacks every hour, or roughly 197,400 attacks daily. The scale of these attacks is alarming, especially as they include a massive 14.4 trillion HTTP DDoS requests. This surge in activity indicates that threat actors are becoming more aggressive and sophisticated in their methods. Such attacks can disrupt services for businesses and individuals alike, making it crucial for organizations to bolster their defenses against these persistent threats.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Action Required: Organizations should enhance their DDoS mitigation strategies and consider using services like Cloudflare for automated protection against such attacks.
Timeline: Ongoing since Q3 2026

Original Article Summary

Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44

Impact

Not specified

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since Q3 2026

Remediation

Organizations should enhance their DDoS mitigation strategies and consider using services like Cloudflare for automated protection against such attacks.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to DDoS.

Read Original Article

Related Coverage

New Android SMS of Death exploit can remotely crash unpatched phones

BleepingComputer

A security researcher has demonstrated a new exploit for an Android vulnerability known as 'SMS of Death,' identified as CVE-2026-58882. This exploit allows attackers to remotely crash unpatched Android devices or disrupt their cellular service by sending a specially crafted text message. Users of Android devices that haven’t been updated with the latest security patches are at risk. The proof-of-concept exploit has raised concerns about the potential for widespread disruption, particularly as text messaging is a fundamental communication method for many. It underscores the necessity for users to keep their devices updated to safeguard against such vulnerabilities.

Oct 31, 2026

Reddit to lock content behind logins to fight scrapers

BleepingComputer

Reddit is taking a significant step to combat content scraping by transitioning to a model that will require users to log in to access most of its content. Co-founder Steve Huffman announced that this change will gradually limit access for visitors who do not have accounts. The move is aimed at protecting the site's data and ensuring that the community's content is not misused by scrapers. This change affects all users, particularly those who frequently browse Reddit without logging in. By restricting access, Reddit hopes to foster a more secure environment for its users and content creators, ultimately preserving the integrity of its platform.

Oct 31, 2026

Chainalysis discloses data breach from "offensive agentic techniques"

BleepingComputer

Chainalysis, a blockchain analytics firm, has reported a data breach that allowed attackers to exploit internal systems using what they described as 'offensive agentic techniques.' This breach has led to the exposure of sensitive customer information, including names, email addresses, user IDs, and organizational roles. Affected customers include individuals and organizations that rely on Chainalysis for blockchain data and analytics. The incident raises concerns about the security measures in place at firms handling sensitive data, emphasizing the need for robust security protocols to protect customer information. As the investigation unfolds, users are advised to monitor their accounts and be vigilant for any unusual activity.

Oct 31, 2026

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data

The Hacker News

Chainalysis, a blockchain analysis firm, confirmed that it experienced a cybersecurity incident where an external actor accessed some non-sensitive customer data. The company reassured its clients that the breach did not compromise sensitive information such as investigation content, authentication credentials, or session tokens. This incident raises concerns about the security of customer data in the blockchain industry, highlighting the need for firms to strengthen their defenses against unauthorized access. While the exposure of non-sensitive data is less severe than a full breach, it still poses risks, particularly regarding customer trust and potential phishing attempts. Companies in similar sectors should remain vigilant and review their security protocols to prevent similar incidents.

Oct 31, 2026

Syrian Hacker Gets Prison Time in US After Over a Decade on the Run

SecurityWeek

Ahmad Umar Agha, a Syrian hacker, has been sentenced to 42 months in prison by a U.S. court after being on the run for over a decade. Agha was involved in cyberattacks that targeted media outlets, businesses, and government entities, all in support of the Assad regime. His activities included various forms of digital harassment and disruption aimed at silencing dissent and promoting pro-government propaganda. This case is significant not only for the legal repercussions for Agha but also for the broader implications it has on international cybercrime and the accountability of individuals engaged in politically motivated hacking. The sentence underscores the U.S. government's commitment to addressing cyber threats and holding perpetrators accountable, regardless of where they operate from.

Oct 31, 2026

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities catalog due to reports of active exploitation. One of the vulnerabilities, identified as CVE-2026-111357, has a CVSS score of 8.8 and involves a lack of authentication for a critical function, which could allow attackers to gain unauthenticated root access. This is particularly concerning for organizations using Ivanti's services, as it poses significant risks to their security infrastructure. Companies relying on Ivanti Connect Secure should take immediate action to assess and mitigate these vulnerabilities to protect their systems from potential breaches.

Oct 31, 2026