Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants
Cloudflare has published the 26th edition of its DDoS Threat Report, covering July through September 2026 and produced by its Cloudforce One threat intelligence team from data across the Cloudflare network.
The headline trend is "more swarms, fewer giants." Short-burst, low-bandwidth attacks lasting under 10 minutes and under 1 Gbps jumped 208%, while hyper-volumetric attacks above 1 Tbps fell nearly 69% from the second quarter. Cloudflare suggests that drop may reflect law enforcement action against four major IoT botnets earlier in the year, though new variants keep appearing.
Attackers also changed reflection and amplification tactics: CLDAP floods collapsed by 99.5% quarter over quarter, while DNS amplification rose 215% and general UDP floods rose 122%.
Key points
- Small, short attacks up 208%
- Attacks over 1 Tbps down ~69% from Q2
- DNS amplification up 215%; CLDAP floods down 99.5%
Summary written by Readthrough from the original article. The full story, with photos and any updates, is at Cloudflare Blog.
