Cloudflare suffered a major outage on November 18, 2025, rendering millions of websites worldwide, including X and ChatGPT, inaccessible for about three hours. The company confirmed the issue stemmed from an old bug triggered by a routine configuration change, not a cyber attack. Cloudflare apologized for the global impact on customers.
The outage began around 6:20 a.m. local time in the United States on Tuesday, November 18, 2025, when Cloudflare detected unusual traffic on one of its services. About 30 minutes later, the company posted a status update on its official site, noting an internal service degradation. Services recovered around 9:30 a.m. after lasting about three hours, though sites like X, ChatGPT, Spotify, and Down Detector flickered back online before failing again.
Cloudflare, a San Francisco-based internet infrastructure company founded in 2009 by Matthew Prince, Lee Holloway, and Michelle Zatlyn, provides services such as Content Delivery Network (CDN) for faster access, protection from DDoS attacks, Web Application Firewall (WAF), DNS 1.1.1.1, and SSL/TLS encryption. Its network spans hundreds of global data centers processing billions of daily requests.
The cause was an automatically generated configuration file for managing threat traffic that grew beyond expected size, damaging the software. A Cloudflare spokesperson confirmed, "There is no evidence that this was the result of an attack or caused by malicious activity." Chief Technology Officer Dane Knecht admitted the failure in an X post: "Today we failed to serve customers... I apologize for the impact." He explained an old bug in the bot mitigation service crashed after a routine configuration change, leading to network performance degradation.
Cloudflare pledged to share a full technical explanation via its blog and implement fixes to prevent recurrence. The incident highlights the global internet's reliance on infrastructure like Cloudflare, where one failure can trigger widespread domino effects. The outage coincided with scheduled maintenance at data centers in Atlanta and Los Angeles, though no direct link was confirmed.
