DDoS Suspected, Internal Bug Found: Cloudflare Outage Caused by Bot Management Config File

Cloudflare CEO Matthew Prince has issued a detailed explanation regarding the recent large-scale outage that took numerous websites offline. He noted that although the incident initially appeared to resemble a DDoS attack, subsequent investigation confirmed it was an internal misdiagnosis. He emphasized that the disruption was not caused by any network attack or malicious activity, but rather by a change in permissions within an internal database system, which corrupted a critical file used by Cloudflare’s Bot Management system.

In an extensive technical breakdown published on the official blog, Prince explained that Cloudflare’s Bot Management platform relies on machine-learning models to score incoming network requests and determine whether they originate from automated bots. These models depend on a configuration file containing “features” that is regenerated and updated every few minutes.

The failure occurred when a modification to the underlying generation mechanism changed the size of this configuration file, inadvertently triggering a system error. Prince wrote: “HTTP 5xx error codes were returned by the core proxy system that handles traffic processing for our customers, for any traffic that depended on the bots module.”

Cloudflare has described this incident as the company’s most severe service disruption in years. According to its statement, Cloudflare has not experienced an outage capable of halting “a majority of core traffic flowing through our network” since 2019. Prince also issued a formal apology on behalf of the entire team.

The report further notes that Cloudflare’s bot-scoring mechanism is critically important for customers, who frequently rely on it to block undesirable automated access — including bots used by AI companies to crawl websites for training large language models (LLMs). In July, Cloudflare introduced a related experimental initiative known as pay-per-crawl, enabling site owners to monetize or control automated content retrieval.

Related Posts:

• Prince Ransomware Hits UK and US via Royal Mail Phishing Scam
• DOJ Files Record $15 Billion Bitcoin Seizure Against Prince Group Chairman Over Pig Butchering Scams
• Zero-Day Attack Alert: Corrupted Files Weaponized in New Attacks
• High-severity flaw (CVE-2025-8069) in AWS Client VPN for Windows Allows Privilege Escalation
• High-severity flaw (CVE-2025-8069) in AWS Client VPN for Windows Allows Privilege Escalation