Massive Cloudflare glitch hits ChatGPT, X, and major websites worldwide

Key topics:Cloudflare outage disrupted major websites globally for hours.Cause was a config file error, not a cyberattack.Highlights global reliance on few internet infrastructure firms..Sign up for your early morning brew of the BizNews Insider to keep you up to speed with the content that matters. The newsletter will land in your inbox at 5:30am weekdays. Register here.Support South Africa’s bastion of independent journalism, offering balanced insights on investments, business, and the political economy, by joining BizNews Premium. Register here.If you prefer WhatsApp for updates, sign up to the BizNews channel here..By Lynn Doan and Rose Henderson.A major outage on the network of cybersecurity firm Cloudflare Inc. was resolved after disrupting websites ranging from X to ChatGPT around the globe for several hours on Tuesday.The problem also affected websites for the chief US energy regulator and the New Jersey transit authority. Many services were back online by 10 a.m. in New York.Cloudflare observed a “spike in unusual traffic” to one of its services around 6:20 a.m. New York time, causing some traffic passing through its network to experience errors, a company spokesperson said. The issue, caused by a configuration file that is automatically generated to manage threat traffic, took less than four hours to fix, Jackie Dutton, a Cloudflare spokesperson, said in a statement.“The file grew beyond an expected size of entries and triggered a crash in the software system that handles traffic for a number of Cloudflare’s services,” said Dutton. There was no evidence of a cyberattack or malicious activity, the statement said. .Read more:.AI threatens online publishers' survival, says Cloudflare CEO.Internet usage around the world has been hobbled on several occasions in recent memory due to glitches at companies that provide the digital infrastructure that keeps websites running. Problems at Amazon.com Inc.’s cloud service, CrowdStrike Holdings Inc. and Microsoft Corp. have caused similar issues, underscoring the extent to which the world relies on a small number of firms to remain online. Anthropic PBC said its Claude AI chatbot was affected on Tuesday. The website for the Federal Energy Regulatory Commission, which oversees US electricity markets, utilities, power traders and other energy-related matters, was also down. A host of companies, attorneys and regulators depend on the site to access regulatory cases and filings. The websites of global food and agricultural giants including Cargill Inc. and Louis Dreyfus Co. also went down.New York City’s transit system was also affected by Cloudflare’s outage, according to a spokesperson for the Metropolitan Transportation Authority. The agency’s website on Tuesday urged riders to use its apps — MTAapp or TrainTime — for real-time transit status and trip planning because of a third-party issue affecting many websites. The MTA is the largest public transportation network in the US and runs the city’s subways, buses and commuter rails.New Jersey Transit similarly said its website and its mobile app were affected and warned that services were temporarily unavailable or slow. Cloudflare Chief Technology Officer Dane Knecht apologized for the incident in a post on X on Tuesday. “That issue, impact it caused and time to resolution is unacceptable,” he wrote. “Work is already underway to make sure it does not happen again, but I know it caused real pain today. The trust our customers place in us is what we value the most and we are going to do what it takes to earn that back.” The company has experienced several outages over the past few years. In July 2019, a bug in Cloudflare’s software caused one part of its network to suck up computing resources, leading thousands of websites including that of Discord, Shopify Inc., SoundCloud and Coinbase around the world to go offline for as long as 30 minutes. In June 2022, Cloudflare suffered an outage that affected traffic in 19 of its data centers, also essentially shutting down major websites and services in an incident that lasted about an hour and a half.Cloudflare’s software is used by hundreds of thousands of companies globally, acting as a buffer between their websites and end users and working to protect their sites from attacks that might overload them with traffic.Last year, a faulty software update from the cybersecurity firm CrowdStrike Holdings Inc. crashed millions of devices operating on Microsoft Corp.’s Windows systems, disrupting a wide range of industries, including air travel, banks and health care.CrowdStrike’s outage was the result of an error in a product that operates at the deepest levels of customers’ computers. By contrast, Cloudflare protects internet infrastructure such as websites and platforms, which is why many popular websites go down or are unreliable during Cloudflare outages. Cloudflare largely focuses on keeping websites online and fast, while CrowdStrike focuses on keeping computers and servers safe from attacks. .Read more:. FT: What caused the huge global IT outage?.The downtime Tuesday is the latest example of the internet’s reliance on “relatively few players,” Alan Woodward, professor of cybersecurity at the University of Surrey, said, describing Cloudflare as the “biggest company you’ve never heard of.”“People have no choice but to depend on relatively few big names,” said Woodward.A similar outage at Amazon.com Inc.’s cloud service last month stretched for about 15 hours, disrupting operations at major firms including Apple Inc., McDonald’s Corp., and Epic Games Inc. According to the company, the problem stemmed from a fault in a digital directory tied to a critical database system. That glitch triggered a chain reaction, preventing software dependent on the database from accessing essential information.While addressing the malfunction, Amazon’s engineers discovered that additional subsystems had also been affected, including one crucial for enabling customers to spin up new rented servers..© 2025 Bloomberg L.P..Read Cloudflare's statement below.Hello,Beginning around 11:20 UTC today, Cloudflare experienced widespread degradation to traffic in our network. We deeply apologize for this disruption. We have published a blog detailing exactly what happened. The majority of the impact was resolved by 14:30 UTC, with all remaining downstream impacted services being fully operational at 17:06 UTC.In short, this incident occurred due to a latent bug related to a configuration file for our bot management service. There is no evidence of an attack or malicious activity causing the issue.Bot management detection sits in the critical path for traffic flow. When any request hits our network, the bot management module should load, but due to the bug, the configuration file grew beyond an expected size of entries. This triggered a crash in the software system that handles traffic for a number of Cloudflare's services. Customers experienced HTTP 500 status code errors as many of Cloudflare's services suffered an outage.The Cloudflare team diagnosed the issue and reverted to an earlier version of the bot detection module configuration that was below the limits. We also modified the core proxy service so it would not fail in this way if limits are reached again.For a more detailed description and timeline of the incident, and the steps we took to address it, please review our blog.Sincerely,Cloudflare Team

Massive Cloudflare glitch hits ChatGPT, X, and major websites worldwide

Related Stories

Kenneth Rogoff on BizNews: AI gold rush has winners and losers — Africa not in the running

Is the AI arms race about to outrun human judgment? The Economist thinks so

Dell takes aim at Apple with a $699 touch-screen laptop

AI’s reality check: The “never-ending utility bill” bites