Cloudflare outage on February 20, 2026
Read Full ArticleSummary
On February 20, 2026, Cloudflare experienced a significant outage affecting customers using its Bring Your Own IP (BYOIP) service due to a misconfiguration in the Border Gateway Protocol (BGP) management. The incident resulted in the withdrawal of approximately 1,100 IP prefixes, rendering services unreachable for many users. The root cause was traced back to a bug in the Addressing API that mishandled a request for prefix deletions, leading to unintended mass withdrawals. Cloudflare's engineers were able to restore service by reverting the changes and guiding customers to re-advertise their prefixes. The incident highlighted the need for improved testing and operational protocols, particularly in the context of the ongoing Code Orange: Fail Small initiative aimed at enhancing the resilience of Cloudflare's network operations.
Key Learnings
- 1Understanding the critical role of BGP in managing IP address advertisements and the potential impact of misconfigurations.
- 2The importance of robust testing environments that accurately reflect production scenarios to catch bugs before deployment.
- 3The necessity of having automated rollback mechanisms and clear separation between operational and configured states to facilitate quick recovery from incidents.
- 4Recognizing the implications of manual processes in automated systems and the risks they pose to production stability.
- 5The value of clear communication and guidance for customers during service outages to mitigate impact and facilitate recovery.
Who Should Read This
Senior Network Engineers and Cloud Architects focusing on incident management and network reliability in cloud services.
Test Your Knowledge
What specific changes were made to the BYOIP service that led to the outage, and how could they have been avoided?
How does the Addressing API function, and what improvements are being proposed to enhance its reliability?
What are the implications of BGP Path Hunting for end-user connections during an outage?
In what ways can Cloudflare's Code Orange: Fail Small initiative improve the resiliency of their network operations?
What lessons can be learned from the incident regarding the balance between automation and manual intervention in network management?
Topics
More articles about AWS
Explore AWS engineering →Complexity is a choice. SASE migrations shouldn’t take years.
The article emphasizes the shift in the cybersecurity landscape regarding SASE migrations, arguing that complexity is a choice rather than an inevitability. It showcases how Cloudflare's SASE...
AWS Weekly Roundup: Amazon Connect Health, Bedrock AgentCore Policy, GameDay Europe, and more (March 9, 2026)
The article provides a comprehensive overview of recent updates and launches from AWS, highlighting innovations such as Amazon Connect Health, which offers AI-driven solutions for healthcare, and the...
Native .NET Buildpack Support is Now Available on App Platform
DigitalOcean has announced native .NET buildpack support on its App Platform, enabling developers to deploy .NET applications directly from a Git repository without the need for Dockerfiles. The...
Introducing OpenClaw on Amazon Lightsail to run your autonomous private AI agents
The article introduces OpenClaw, an autonomous private AI agent, now available on Amazon Lightsail. It details the process of launching an OpenClaw instance, which is pre-configured with Amazon...
See risk, fix risk: introducing Remediation in Cloudflare CASB
The article introduces a significant enhancement to Cloudflare's Cloud Access Security Broker (CASB) by launching a Remediation feature that allows users to directly fix risky file-sharing...
More from Cloudflare Engineering
View Cloudflare engineering blogs →Complexity is a choice. SASE migrations shouldn’t take years.
The article emphasizes the shift in the cybersecurity landscape regarding SASE migrations, arguing that complexity is a choice rather than an inevitability. It showcases how Cloudflare's SASE...
Active defense: introducing a stateful vulnerability scanner for APIs
The article introduces Cloudflare's new stateful vulnerability scanner designed specifically for APIs, addressing the limitations of traditional defensive security measures. It highlights the...
Fixing request smuggling vulnerabilities in Pingora OSS deployments
The article addresses critical HTTP/1.x request smuggling vulnerabilities identified in the Pingora open source framework, particularly when deployed as an ingress proxy. It outlines the nature of...
From the endpoint to the prompt: a unified data security vision in Cloudflare One
The article outlines Cloudflare One's evolution in data security, emphasizing a unified approach that encompasses protection in transit, visibility and control at rest, and enforcement in use. It...
A QUICker SASE client: re-building Proxy Mode
The article outlines the challenges faced by security teams when implementing proxy modes in SASE environments, particularly the performance issues associated with traditional TCP implementations. It...