2 min read
Updated with additional information on Monday, 08 December, 2025.
Internet infrastructure provider Cloudflare has issued a public apology after a widespread outage on Friday morning disrupted major global platforms, including LinkedIn, Zoom, Canva and Shopify. The company described the incident as its second major disruption in under a month, prompting renewed concerns over the reliability of centralised internet infrastructure.
Cloudflare said the outage stemmed from a firewall configuration change made to address a newly disclosed software vulnerability. The disruption affected roughly 28 percent of its global HTTP traffic and lasted about twenty five minutes before services were restored at around 0912 UTC. According to the company, the issue did not involve a cyberattack.
In a follow-up blog, Cloudflare said:
Unfortunately, in our FL1 version of our proxy, under certain circumstances, the second change of turning off our WAF rule testing tool caused an error state that resulted in 500 HTTP error codes to be served from our network.
We made an unrelated change that caused a similar, longer availability incident two weeks ago on November 18, 2025. In both cases, a deployment to help mitigate a security issue for our customers propagated to our entire network and led to errors for nearly all of our customer base.
We know it is disappointing that this work has not been completed yet. It remains our first priority across the organization.
Although this outage was shorter and less severe than the one in November, which knocked offline a wide range of digital services, it has renewed debate over how heavily the internet depends on a small group of providers for critical operations.
Cloudflare admitted that it had let the internet down again and pledged to share more details about the steps it plans to take to prevent similar disruptions in the future.
The outage impacted nearly 28% of Cloudflare’s global traffic and lasted about 30 minutes, wrapping up shortly after 9am GMT. The company also mentioned that there was a separate API issue reported, but it was not connected to the firewall change.
