Cloudflare Down On February 20, 2026, Cloudflare suffered a major six-hour worldwide service outage that caused significant disruptions for its Bring Your Own IP (BYOIP) customers This article explores cloudflare byoip enabled. . During the six hours and seven minutes of the incident, which started at 17:48 UTC, customer BGP routes were inadvertently removed from the Internet, making many services and applications unavailable.

The company verified that the disruption, which affected 25% of all BYOIP prefixes worldwide and resulted in HTTP 403 errors on the 1.1.1.1 public recursive DNS resolver website, was solely due to an internal configuration update rather than a cyberattack or malicious activity.

Technical Dissection of the Resolving API Error The outage's primary cause was identified as an internal bug in Cloudflare's addressing an API that was added during the deployment of an automated cleanup subtask. As part of the company's "Code Orange: Fail Small" resilience initiative, this task was created to replace manual removal procedures for BYOIP prefixes. To check and eliminate pending objects from the network on a regular basis, engineers implemented a system.

The server interpreted the empty string as a command to queue all returned BYOIP prefixes for deletion rather than just those scheduled for removal because the system ran an API query that passed the pending_delete flag with no assigned value.

Before an engineer manually ended the process, this coding error systematically removed about 1,100 BYOIP prefixes and their dependent service bindings. The affected connections instantly entered a state called BGP Path Hunting, in which end-user connections keep looking for destination routes until they fail and time out. Several core products that depend on BYOIP configurations for online advertising were included in the blast radius.

Impact Description of a Service or Product Security Services and Core CDN Advertised websites experienced connection timeouts as a result of traffic failing to route to Cloudflare. BYOIP-enabled Spectrum applications were unable to proxy traffic at all. Committed Egress It was not possible for users using dedicated IPs or BYOIP to send outbound traffic to their destinations.

Magic Transit End users encountered timeouts and total connection failures when attempting to access protected applications. Recovery Efforts and Planned Remediation Due to the impact of the mass withdrawal on customer prefixes, which necessitated extensive and diverse data recovery operations, recovery was significantly delayed. About 300 prefixes had their service bindings completely removed, but some users were still able to self-correct by turning their ads back on through the Cloudflare dashboard.

Engineers had to manually restore these severely damaged accounts by pushing global configuration updates to reapply settings on each edge network machine. As part of its Code Orange mandate, Cloudflare is expediting a number of crucial architecture changes to avoid future disastrous deployments.

The engineering team intends to create health-mediated operational state snapshots to isolate customer configurations from production rollouts, standardize the API schema to avoid flag interpretation errors, and install circuit breakers to identify unusually rapid BGP prefix deletions. Time zone (UTC) Description of the Incident Event: 17:56 The outage is caused by the broken sub-process running and removing prefixes. 18:46 An engineer finds the problematic task, stops it from being executed normally, and starts the mitigation process.

19:19 Some customers are able to restore service when dashboard self-remediation becomes available. 23:03 The deployment of the global machine configuration is finished, and the remaining deleted prefixes are fully restored. With a direct apology to its users and the international internet community for the February 20 disruption, Cloudflare wrapped up its official incident report.

The widespread outage compromised the company's core promise of providing a highly resilient network, as the company publicly acknowledged. X, LinkedIn, and LinkedIn for daily ZeroOwl. To have your stories featured, get in touch with us.