On 18 November 2025, for many, the internet paused. A large outage across Cloudflare’s network pushed major platforms including ChatGPT, X, Canva and several governmental services into error page limbo. Many immediately suspected a cyber attack, but Cloudflare confirmed the disruption was caused by an internal issue rather than anything more dramatic.
The root cause was a permissions change in one of Cloudflare’s database systems that caused a feature file in its Bot Management system to grow far larger than intended. Once that oversized file began propagating worldwide, edge systems were overwhelmed and traffic routing deteriorated. With Cloudflare supporting around a fifth of the internet, the scale of the slowdown was inevitable.
For customers, it meant a sudden run of “internal server error”, “site can’t be reached” and “try again later” messages. Most people assumed their own connection had briefly lost the plot before realising it was rather more widespread. Even outage tracking services struggled, which is always a quiet sign that a morning is about to get complicated.
For businesses, the disruption carried real consequences. Missed transactions, frustrated users, broken portals and delayed announcements. One report noted that financial webcasts and disclosures were affected when their front ends became inaccessible. And when a major infrastructure provider goes down, the workarounds tend to involve extra manual effort and unplanned costs.
There is no confirmed figure on the total financial impact, but given the number of affected platforms and the duration, it will not be insignificant. The incident also highlights a broader truth; even companies built to deliver stability can find themselves undone by a small internal change at the wrong moment.
Cloudflare has called the outage unacceptable and committed to improvements, including better kill switches, fewer single points of failure and stricter change controls. For businesses, the takeaway is clear. Consider how dependent you are on a single provider and what your options are when that dependency is tested.
