Cloudflare explains what caused the Internet outage

A major internet disruption on 18 November was caused by Cloudflare, one of the world’s largest hosting and security providers.

“I won’t mince words: earlier today we failed our customers and the broader Internet when a problem in the Cloudflare network impacted large amounts of traffic that rely on us,” Cloudflare CTO Dane Knecht wrote on X, apologising for the incident.

The outage affected many major websites, including X and Spotify, and some users also reported issues accessing ChatGPT.

Cloudflare immediately launched an investigation, published an official incident report, and Knecht outlined the root cause of the failure.

“In short, a latent bug in a service underpinning our bot mitigation capability started to crash after a routine configuration change we made. That cascaded into a broad degradation to our network and other services. This was not an attack,” he wrote.

According to the company, the issue stemmed from an incorrect configuration file tied to Cloudflare’s Bot Management system. The platform stores bot-related data in an internal analytics database. During a recent update, access settings were modified, but an additional validation step for service metadata was overlooked, causing table entries to duplicate.

The configuration file quickly grew beyond acceptable limits, ballooning several times in size and triggering failures on Cloudflare’s main proxy server. As a result, customer systems using bot filtering began blocking all traffic by mistake.

In its write-up, Cloudflare also highlighted that the outage was worsened by the use of the unwrap() method with a Result type in production code — a practice generally discouraged outside of testing and debugging. Its presence triggered a “panic!” macro, leading to an immediate shutdown of the affected service.