Cloudflare saw 18.2 million network attacks in Q3 2026, but far fewer giant ones. Cheap, short strikes are now the main way sites get knocked offline.
Online attacks are getting smaller and more frequent. Cloudflare, a company that protects a large share of the web, says it blocked about 18.2 million network attacks in the third quarter of 2026. That is roughly one every 0.44 seconds. The very largest attacks, by contrast, dropped sharply.
The attacks in question are called DDoS attacks. They flood a website or service with so much junk traffic that real visitors cannot get through. The 18.2 million blocked is 208% more than the same quarter in 2025. Cloudflare ties the rise to short, mid-sized, high-count bursts. Those are the signature of "booter" services, which let people rent attacks for a fee.
Meanwhile, attacks above 1 Tbps, a measure of raw traffic volume, fell to 251 from 805 the quarter before.
A botnet is a crowd of hijacked internet-connected devices that attackers control. The drop in giant attacks coincides with law enforcement action in early 2026. Police dismantled four of the largest botnets: Aisuru, KimWolf, JackSkid and Mossad.
The threat has not gone away. New variants such as Dysphoria and Evooo1Bot are filling the gap. Attacks linked to a botnet family called Mirai made up 46.5% of blocked network traffic in the quarter, peaking in August. The longest Mirai attack ran 49.7 hours.
Short-burst attacks mainly targeted computer software, gambling and casinos, and information technology companies. Media, Production and Publishing stayed the most-attacked industry. Its share is about a quarter of what it was in Q2, though, as attacks spread across more industries.
Cloudflare notes that most attacks end long before a person could see an alert. That is why automatic defenses matter. Its own protection is free and runs without human help in more than 330 cities. Keep in mind this is Cloudflare's report, based on its own network.
For a small business, the lesson is simple. A cheap, short attack can take a site offline. Ask your website host or provider whether it blocks these attacks automatically, and whether that is included in your plan.
Cheap, short attacks are now the common threat, so confirm your website host blocks them automatically.
AMD's data center sales rose 97% in the third quarter, a sign of heavy demand for AI computing that could affect what businesses pay for tech.
Read more: AMD's data center sales nearly doubled, lifting record quarterA SemiAnalysis site visit found a Chinese AI data center campus built at about a fifth of US cost, with no public backlash. Here is why that matters for AI prices.
Read more: China builds giant AI data centers fast and at a fifth of US costMajor environmental groups now use AI to study climate data and track fires, while warning that the data centers behind AI carry their own environmental cost.
Read more: Environmental groups use AI to fight climate change, despite its energy cost
