[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fY4_E5YZiEaFhBZ7SozvqXX33djU3mgvFR_YssjDrMJM":3},{"article":4,"iocs":33,"watch_terms":34,"solutions":35,"lesson":94},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"82e9f3f4-f1e0-408e-a27b-f2c6d6a9d84a","Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%","cloudflare-reports-18-2-million-network-layer-ddos-attacks-in-q3-up-38-293569","Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44","Cloudflare's Q3 2026 report indicates a significant surge in network-layer DDoS attacks, with threat actors launching an average of 8,226 attacks per hour. The company mitigated 18.2 million such attacks and 14.4 trillion HTTP DDoS requests during the quarter, highlighting an escalating threat landscape.","Cloudflare reports 18.2M network-layer DDoS attacks in Q3, a 38% increase.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcloudflare-reports-182-million-network.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEi9-PGmRcZy9OvjKNOWHrGVMpF2DhnvIrHU6mOwyroU7CeoEKMkrjCt8HxCKBzAOia6ZpDEvTuQcF2Xg_50vE_W8DdjmLJjxMXPUUm5Ryfym8GBhm74Z6jwZCeXSKgxuK6A57rVsM-Z1G8nfEF3Mn8QgoD77Nbqxakkj_ZxbBNDtp0ljvTKrXydLYm1BFZR\u002Fs1600\u002Fcf.jpg","2026-10-31T04:56:12+00:00","2026-10-31T06:00:17.207086+00:00",7,[17],{"name":18,"type":19},"Cloudflare","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":20,"icon":22,"name":23,"slug":24},null,"Threat Intelligence","threat-intelligence",[26,31],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":36,"vendors":90},[37,62],{"slug":24,"name":38,"problem":39,"products":40},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[41,49,54],{"vendor_slug":42,"vendor_name":43,"vendor_logo":44,"product_slug":45,"product_name":46,"url":47,"description":48},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":42,"vendor_name":43,"vendor_logo":44,"product_slug":50,"product_name":51,"url":52,"description":53},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":63,"name":64,"problem":65,"products":66},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[67,74,82],{"vendor_slug":68,"vendor_name":18,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",[91],{"slug":68,"name":18,"logo_path":69,"roles":92},[93],"reported_by",{"slug":95,"title":96,"body":97,"framework_refs":98,"framework_notes":106},"ddos-attacks-surge-38-in-q3-2026-averaging-8226-attacks-per-hour","DDoS Attacks Surge 38% in Q3 2026, Averaging 8,226 Attacks Per Hour","Cloudflare's Q3 2026 report reveals an alarming escalation in volumetric DDoS attacks, with 18.2 million network-layer attacks and 14.4 trillion HTTP requests mitigated in a single quarter. The sheer scale — over 8,000 attacks per hour — demonstrates that threat actors are leveraging automated tooling, botnets, and amplification techniques to overwhelm unprotected infrastructure. Organizations without dedicated DDoS mitigation services or traffic-scrubbing capabilities risk complete service disruption, impacting availability, revenue, and customer trust. This trend underscores that DDoS resilience is no longer optional — it must be a foundational element of any organization's availability and incident response strategy.",[99,100,101,102,103,104,105],"NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","DORA Article 9","CIS Control 13: Network Monitoring and Defense",{"DORA Article 9":107,"NIS2 Article 21(2)(b)":108,"NIST SP 800-53 SI-2: Flaw Remediation":109,"CIS Control 17: Incident Response Management":110,"CIS Control 13: Network Monitoring and Defense":111,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":112,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":113},"DORA mandates that financial entities protect the availability and integrity of their ICT systems, requiring documented DDoS resilience capabilities and tested continuity arrangements against network-layer threats.","NIS2 explicitly requires operators of essential services to implement measures ensuring availability and business continuity, making DDoS mitigation a regulatory obligation for covered entities.","While focused on flaws, SI-2's broader availability controls require organizations to maintain service resilience; DDoS preparedness is a core system integrity concern that should be addressed through formal protective controls.","An 8,226-attacks-per-hour rate demands a pre-planned, rehearsed DDoS incident response playbook; without one, organizations will struggle to coordinate mitigation, escalation, and recovery in real time.","Continuous monitoring of network traffic for volumetric anomalies is essential to detect and respond to DDoS attacks quickly; CIS Control 13 calls for exactly this type of real-time network defense capability.","Maintaining awareness of infrastructure exposure to volumetric attacks and applying protective controls (scrubbing, rate limiting) aligns with the requirement to manage technical vulnerabilities before they result in availability loss.","Restricting which traffic sources can reach critical services — through allowlists, rate limiting, and traffic filtering — directly reduces the attack surface exploitable by DDoS actors."]