Cloudflare has published the 26th edition of its DDoS Threat Report, covering the third quarter of 2026 (July through September) and returning the series to its quarterly cadence after a combined H1 2026 volume. The analysis comes from Cloudforce One, Cloudflare's Threat Intelligence organization, and draws on data from the Cloudflare network.
The headline shift is a move away from giant floods toward numerous, smaller bursts. Attacks lasting under 10 minutes and staying under 1 Gbps surged by 208%. At the same time, hyper-volumetric attacks exceeding 1 Tbps dropped by nearly 69% from Q2 — possibly reflecting law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. Cloudflare notes that variants keep emerging, so IoT botnets remain a durable, high-volume threat. Attackers also changed their reflection and amplification tactics abruptly.
- Short-burst, low-bandwidth attacks (under 10 minutes, under 1 Gbps) rose 208% quarter-over-quarter.
- Hyper-volumetric attacks above 1 Tbps fell nearly 69% versus Q2.
- CLDAP reflection floods collapsed by 99.5% quarter-over-quarter, abruptly abandoned by threat actors.
- Attackers pivoted to other connectionless protocols, driving a 215% surge in DNS amplification.
The pivot away from CLDAP toward DNS amplification is a reminder that mitigation rules tuned to last quarter's dominant vector can miss the next one. Short, low-bandwidth bursts are also harder to separate from legitimate traffic by volume alone, so rate limiting and per-endpoint behavioral thresholds matter more than raw pipe capacity. For developers running edge-exposed services, the report reinforces reviewing amplification-exposed UDP protocols, validating request patterns rather than payload size, and keeping DDoS protections current as attack tooling rotates between vectors.
Source: https://blog.cloudflare.com/ddos-threat-report-2026-q3/