Internet concentration risk

Overview

Updated May 29

On February 16, 2026, a misconfigured routing update at Cloudflare's Ashburn data center cascaded across the internet, taking down X for three hours and degrading AWS's largest region. Thousands of other websites went down too. The error took 40 minutes to identify but four hours to fix because corrupted routing tables spread to upstream providers.

The outage exposed a structural vulnerability built over two decades: a handful of companies control the pipes through which most internet traffic flows. Cloudflare handles 20% of global web requests, and AWS commands 31% of cloud infrastructure. When these giants fail, the effects ripple globally.

The Cybersecurity and Infrastructure Security Agency is now reviewing the incident, and transatlantic policymakers are debating whether these providers should be regulated as critical infrastructure.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

20%

Global Web Traffic via Cloudflare

Cloudflare processes roughly one-fifth of all internet requests worldwide

31%

AWS Cloud Market Share

Amazon Web Services leads cloud infrastructure, with US-East-1 as its largest and oldest region

43,000

Peak User Reports During X Outage

Downdetector reports during the February 16, 2026 incident

~4 hours

Outage Duration

Time required to coordinate with upstream providers and flush corrupted routing caches

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

People Involved

Matthew Prince

Chief Executive Officer and Co-Founder, Cloudflare

Leading post-incident response and policy discussions

Jennifer Rexford

Professor of Computer Science, Princeton University

Expert commentator on internet architecture

Mark Warner

United States Senator (D-VA), Chair of Senate Intelligence Committee

Calling for regulatory review of cloud concentration

Organizations Involved

Cloudflare, Inc.

Internet Infrastructure Company

Origin point of February 2026 cascading outage

Content delivery network and web security company that processes approximately 20% of all global internet traffic.

Amazon Web Services (AWS)

Cloud computing provider (Amazon subsidiary)

US-East-1 region affected by February 2026 cascade

The world's largest cloud computing provider, commanding approximately 31% of global cloud infrastructure market share.

X (formerly Twitter)

Social media and technology company

Experienced three-hour outage during February 2026 incident

Social media platform with hundreds of millions of users, owned by Elon Musk since 2022.

Cybersecurity and Infrastructure Security Agency (CISA)

US federal cybersecurity agency

Reviewing February 2026 incident as critical infrastructure matter

United States federal agency responsible for cybersecurity and critical infrastructure protection.

Timeline

February 2008 February 2026

8 events Latest: February 16th, 2026 · 7 months ago

Tap a bar to jump to that date

February 2026
Cloudflare Routing Error Triggers Cascading Internet Outage
Latest Cascading Failure

A routine configuration update at Cloudflare's Ashburn data center introduced a BGP routing error that cascaded to upstream providers. X went down for three hours, AWS US-East-1 experienced degradation, and thousands of websites globally were affected. Recovery required coordinating with over a dozen upstream providers to flush corrupted routing caches.
February 16th, 2026 • 13:15 ET
November 2025
Cloudflare Bot Management Bug Causes Global Outage
Infrastructure Failure

A database permissions change caused Cloudflare's Bot Management system to generate an oversized feature file, exceeding the core proxy's hard-coded limit. X, ChatGPT, Spotify, and thousands of sites went offline for over two hours.
November 18th, 2025 • 11:20 UTC
October 2025
AWS US-East-1 Suffers 14-Hour Outage
Infrastructure Failure

DynamoDB API DNS resolution issues cascaded to affect 140 AWS services and global features dependent on US-East-1 endpoints. The outage lasted over 14 hours and affected Slack, Atlassian, Snapchat, and numerous other services.
October 20th, 2025
August 2025
Traffic Surge Through Cloudflare Disrupts AWS Connectivity
Cascading Failure

Insufficient congestion management during an unusual traffic surge from a single customer caused connectivity issues for AWS services accessed through Cloudflare.
August 21st, 2025
October 2021
Facebook Disappears from Internet for Six Hours
Infrastructure Failure

A maintenance command inadvertently disconnected Facebook's backbone network, withdrawing all BGP routes and making Facebook, Instagram, WhatsApp, and Messenger completely unreachable globally for six hours.
October 4th, 2021 • 15:39 UTC
June 2021
Fastly CDN Outage Takes Down Major Websites
Infrastructure Failure

A customer configuration change triggered a dormant bug in Fastly's edge network, causing 85% of their infrastructure to fail. Reddit, Amazon, the New York Times, and UK government sites went offline for about an hour.
June 8th, 2021 • 09:50 UTC
February 2017
Mistyped Command Causes Major AWS S3 Outage
Infrastructure Failure

A debugging command with a typo took down Amazon S3 in US-East-1, causing widespread internet disruption and hundreds of millions of dollars in losses. The incident remains one of the most cited examples of cloud concentration risk.
February 28th, 2017
February 2008
Pakistan Accidentally Takes Down YouTube Globally
Historical Incident

Pakistan Telecom's attempt to block YouTube domestically propagated via BGP to global networks, taking down YouTube worldwide for about two hours. The incident demonstrated how BGP trust assumptions could allow local routing changes to cascade globally.
February 24th, 2008

Scenarios

Major CDN Providers Designated Critical Infrastructure

Possible

Discussed by: Atlantic Council digital sovereignty reports, EU policymakers discussing DORA compliance, Senator Mark Warner

Following the February 2026 outage and growing regulatory concern on both sides of the Atlantic, major content delivery networks and cloud providers could be formally designated as critical infrastructure. This would subject them to mandatory resilience standards, regular stress testing, and potentially redundancy requirements similar to those imposed on financial institutions and utilities. The EU is already examining whether to classify major CDN providers under the Digital Operational Resilience Act.

Market Forces Drive Multi-Provider Redundancy

Likely

Discussed by: Enterprise IT analysts, DevOps community, cloud architecture consultants

Without regulatory intervention, enterprises increasingly adopt multi-cloud and multi-CDN architectures to avoid single-provider dependencies. Insurance companies begin requiring redundancy provisions for cyber liability policies. The market self-corrects as the cost of concentration becomes clearer with each outage, though smaller organizations lacking resources for redundancy remain vulnerable.

Status Quo Persists Despite Recurring Outages

Possible

Discussed by: Industry incumbents, efficiency-focused enterprise buyers

The convenience and cost savings of consolidated providers outweigh the episodic costs of outages. Each incident triggers temporary concern but no lasting structural change. Cloudflare and AWS continue growing market share as the most reliable and feature-rich options, even as their dominance increases systemic risk. Outages remain periodic nuisances rather than catalysts for architectural change.

Major Outage Triggers National Security Response

Unlikely

Discussed by: CISA officials, Senate Intelligence Committee, national security analysts

A future outage coincides with or is mistaken for a cyberattack, triggering emergency response protocols and potential international tensions. This forces a fundamental reassessment of internet architecture as a national security concern, potentially leading to government-mandated redundancy requirements, domestic routing preferences, or investment in alternative infrastructure. The February 2026 CISA review could be a precursor.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

February 2008

Pakistan YouTube Hijacking (2008)

Pakistan Telecom attempted to block YouTube domestically by advertising false BGP routes. Its upstream provider PCCW Global propagated these routes globally, causing YouTube traffic worldwide to be misdirected to Pakistan. YouTube was unreachable for approximately two hours until the erroneous routes were withdrawn.

Then

YouTube traffic gradually recovered over two hours as correct routes propagated. The incident prompted calls for BGP security improvements.

Now

The incident became a foundational case study for internet routing vulnerabilities. It accelerated work on Resource Public Key Infrastructure (RPKI), though adoption has remained incomplete nearly two decades later.

Why this matters now

The 2008 incident demonstrated that BGP's trust-based architecture makes the entire internet vulnerable to local misconfigurations. The February 2026 Cloudflare outage shows this fundamental vulnerability persists, now amplified by traffic concentration through a handful of major providers.

June 2021

Fastly CDN Outage (2021)

A customer pushed a valid configuration change that triggered a dormant bug in Fastly's edge network, causing 85% of their infrastructure to return errors. The New York Times, Reddit, Amazon, the UK government portal, and numerous other major sites went offline simultaneously for approximately one hour.

Then

Fastly engineers identified and disabled the problematic configuration within 50 minutes. Services recovered rapidly once the fix propagated.

Now

The incident intensified scrutiny of CDN concentration and prompted some enterprises to implement multi-CDN strategies, though the additional complexity and cost limited widespread adoption.

Why this matters now

Like the February 2026 Cloudflare incident, a single configuration change brought down a significant portion of the internet. Both cases illustrate how the efficiency gains of centralized infrastructure create systemic fragility.

October 2021

Facebook BGP Withdrawal (2021)

During routine maintenance, a command intended to assess Facebook's backbone capacity accidentally disconnected all backbone routers. A bug in an audit tool failed to stop the command. Facebook's BGP routes were withdrawn, making Facebook, Instagram, WhatsApp, and Messenger completely unreachable for six hours worldwide.

Then

Recovery required physical access to data centers because remote management tools were also offline. The company's badge systems failed, reportedly delaying technician access.

Now

Facebook implemented additional safeguards against backbone-level failures and improved audit tool reliability. The incident demonstrated how dependent billions of users had become on a single company's infrastructure.

Why this matters now

The Facebook outage showed how a single company's internal error could affect billions of users simultaneously. The February 2026 Cloudflare incident extends this pattern: now infrastructure companies that other services depend on can cascade failures even to services that don't directly use their products.