The exposure
At 11:20 UTC on November 18, 2025, Cloudflare fell over, and our stack fell over with it. Every dashboard we owned threw HTTP 500, 522, and 530. The detail that reframed the whole morning: when we tried to log into Cloudflare to disable a WAF rule and route around the problem, the Cloudflare dashboard itself was down. We were locked out of the controls that could have saved us.
It is worth stating the exposure in security terms, not just operational ones, because "the vendor had a bad day" is the wrong lesson. Availability is a security property — it sits alongside confidentiality and integrity — and a multi-CDN failover posture is the control that protects it against a single-provider failure. What the outage actually revealed was that our "resilient" architecture had exactly one point of failure, and it was the vendor whose entire job was resilience. The event hit an estimated 20% of all HTTP requests, roughly 7 million websites, and 30% of the top 1,000 sites; per Cloudflare's own post-mortem, a database permissions change caused a Bot Management feature file to double in size and blow past a hardcoded limit, crashing the traffic-routing software across the network and dragging the control plane down with it. I kept that post-mortem in one tab and a thorough third-party writeup of how one team scrambled and rebuilt afterward → in another while reworking our own single points of failure.
