---
title: DDoS in Q3 2026: swarms of small attacks, far fewer giants
type: Report
---
title: DDoS in Q3 2026: swarms of small attacks, far fewer giants
type: Report
---
DDoS in Q3 2026: swarms of small attacks, far fewer giants
Original ~10 min → 25 sec here
The point
Cloudflare's Q3 2026 DDoS report shows attackers shifting to volume over size. Short, small attacks surged, while hyper-volumetric attacks over 1 Tbps fell by nearly 69 percent from Q2, which Cloudflare links in part to law enforcement taking down four major IoT botnets earlier this year. Vectors rotated hard too: CLDAP floods collapsed, DNS amplification and UDP floods jumped.
Why it matters
If most attacks now end in under 10 minutes, defense has to be automatic. Anything that waits on a human seeing an alert is already too slow.
Key details
- 18.2 million network-layer DDoS attacks mitigated in the quarter, about 8,226 per hour
- 96 percent of attacks ended in under 10 minutes and 98 percent stayed under 1 Gbps
- CLDAP attacks collapsed 99.5 percent quarter over quarter, while DNS amplification surged 215 percent
Source: Cloudflare Blog, Oct 29, 2026