The internet's single points of failure keep introducing themselves

On November 18, Cloudflare knocked out large parts of the internet for nearly six hours, not through an attack but through an internal mistake. A database permissions change at 11:05 UTC caused a query to return duplicate rows, doubling the size of Cloudflare’s Bot Management feature file. The malformed file then cascaded into failures across services that had nothing to do with bot detection, producing widespread errors on sites and apps that most users would not have known ran through Cloudflare at all.

That is the real story here, more than the outage itself. On November 18, 2025, at 11:20 UTC, Cloudflare—a critical content delivery network (CDN) and internet security provider serving 19.3% of all websites—experienced catastrophic service failures that cascaded across the internet for nearly six hours. Cloudflare sits between users and the origin servers of companies that never chose Cloudflare directly but inherited it through whichever vendor or platform they built on. When that layer fails, it does not fail as “Cloudflare is down.” It fails as X, ChatGPT, and Spotify going dark simultaneously, for reasons none of those companies control and few of their users could name.

A handful of infrastructure providers have become load-bearing walls for the entire web, invisible until they crack.

Cloudflare’s own account makes clear this was not sabotage. Cloudflare’s post-mortem makes it clear that the cause was an internal error – a latent bug triggered by a routine update – rather than an external attack. That is arguably more unsettling than an attack would be: it means the fragility is structural, waiting on the next routine deployment, at any one of the small number of firms the internet has quietly decided to depend on.