The Scale of the Flood Is the Warning: DDoS Is Spreading Across More Layers
Cloudflare’s latest threat figures point to a familiar but escalating problem: attack traffic is growing in both volume and intensity, and defenders have to absorb it before real services feel the strain.
Introduction
Cloudflare says it mitigated 23.2 million network-layer DDoS attacks and blocked 29.64 trillion HTTP DDoS requests in the first half of 2026, while 1 Tbps attacks rose 519%. Those numbers do not describe one incident. They describe a pressure pattern that security teams see again and again: internet-facing systems are being tested at multiple layers, and the biggest risks often come from whichever layer is easiest to saturate.
Fast Facts
- 23.2 million network-layer DDoS attacks were mitigated in the first half of 2026.
- 29.64 trillion HTTP DDoS requests were blocked in the same period.
- 1 Tbps attacks reportedly increased by 519%.
- The figures were published in a DDoS threat report produced by Cloudflare’s Cloudforce One team.
- Large mitigation events can consume defensive capacity even when they succeed.
Body
The useful technical takeaway is not just that the numbers are large. It is that DDoS pressure now spans both the network edge and the application path. A network-layer flood tries to overwhelm the pipes carrying traffic. An HTTP flood targets the web layer, where requests may be cheap to send but more expensive to process. That means a defender can have enough bandwidth and still face strain higher up the stack.
The 1 Tbps figure matters because it marks the kind of traffic volume that forces defenders to think about absorption, filtering, and capacity management at scale. In general, high-volume mitigation can create operational noise even when it works well, but the available information here does not quantify those side effects for any specific target.
Large attack counts may be consistent with automated or repeatable tooling, but the report excerpt does not identify the means used. It also does not establish a baseline period for the 519% increase, so that figure should be read as a directional indicator rather than a complete technical picture.
For defenders, the broader lesson is straightforward: DDoS is rarely one-dimensional. Traffic floods can move between layers, and resilience depends on how well an organization can separate legitimate demand from hostile volume under pressure.
Conclusion
The real story is not that the internet keeps getting louder. It is that defenders have to protect more than links and routers. When attack traffic grows this fast, the security problem becomes a question of where the first bottleneck appears, and how quickly it can be isolated before users feel it.
TECHCROOK
Hardware firewall appliance: A small firewall or router appliance can help segment networks, filter unwanted traffic, and give administrators more control over exposed services. It will not replace a DDoS protection platform, but it is a practical layer for homes, offices, and small businesses that need better edge management and basic traffic visibility.
WIKICROOK
- DDoS: Distributed denial-of-service, an attack that uses many sources to overwhelm a target.
- HTTP DDoS: A flood of web requests meant to stress the application layer.
- Network-layer attack: Traffic aimed at bandwidth, routing, or transport capacity.
- Mitigation: Defensive action that reduces the impact of hostile traffic.
- 1 Tbps: One terabit per second, a unit used to describe extremely large traffic volumes.
