What Took the Internet Offline in Q3 2026

Cloudflare Radar's review of the 49 Internet disruptions it recorded in Q3 2026: government-directed shutdowns (including 18 exam shutdowns in Iraq), grid failures in Cuba, Honduras, Guam and Ukraine, natural disasters from Nepal to Colombia, and outages tied to political events and conflict in Ethiopia's Tigray region.

Research · Internet · Networking

Turning IPv6 tunnels into programmable delay lines for pulsing DoS

An APNIC Blog guest post summarising the USENIX Security 2026 paper on TED, a pulsing denial-of-service technique that abuses permissive tunnel decapsulation and inconsistent IPv6 Extension Header handling to focus low-rate traffic into short high-rate bursts, with measurements and mitigations.

Research · Networking · Security · Research

Header Accordions: QPACK amplification attacks against HTTP/3 servers

FoxIO research showing a remote, unauthenticated client can make HTTP/3 servers allocate tens to thousands of times more memory than it sends via QPACK header decoding; seven of ten tested implementations were vulnerable, with CVEs and fixes listed.

Research · Security · Networking · Research

One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux

Long-form version of Quentin Kaiser's Hexacon 2026 talk: a WPS EAP reassembly overflow in Broadcom's proprietary 802.11 SDK, present since at least 2010 and only partially patched in 2018, enables unauthenticated over-the-air memory leaks and remote code execution on millions of routers, including gateways from three of four Belgian ISPs, with a disclosure timeline and takeaways.

Research · Security · Vulnerability Research · Networking · Hardware

Yandex outage: Data shows that instead of going dark, malicious bots went on the move

Cloudflare uses Radar and Bot Management data to show that after reported strikes on Yandex data centers, the traffic drop from Yandex Search was mostly verified crawlers, while malicious automation on Yandex.Cloud largely migrated to other hosting providers, a reminder that ASN traffic volume is a poor proxy for bot behavior.

Research · Security · Networking · Infrastructure · Data Analysis

From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities

SEC Consult's Timo Longin, known for SMTP smuggling, details two From-header smuggling flaws in Apple iCloud's email infrastructure (line-break parsing and dot-peeling) that allowed sending mail as arbitrary icloud.com addresses, plus detection and defense advice and the responsible disclosure timeline through Apple's fix.

Research · Security · Research · Networking · Privacy

Android NAT-T Keepalive Offload Bypasses VPN Lockdown: Device-Class Exposure Across Most Android 12+ DevicesTechnical report on Android VPN lockdown bypass via NAT-T keepalive offload.

Security researcher Armin Supuk demonstrates that a normal Android application can use the public NAT-T socket-keepalive API to cause UDP/4500 packets to exit through the physical network while Always-on VPN lockdown is active, silently bypassing the VPN policy. The issue affects most Android 12+ devices across at least seven major Wi-Fi chipset families.

Research · Android · Security · VPN · Networking

When Submarine Cables Go Dark: Understanding and Preparing for the Risks of Taiwan's International Internet Disconnection

Irvin Chen's Open Culture Foundation report measures how 2,179 websites commonly used in Taiwan would fare if international submarine cables were cut. It finds 39.3% depend directly on foreign-hosted resources and another 49.6% rely on local nodes of multinational clouds or CDNs with uncertain availability, and offers a reproducible method for tracking resilience.

Research · Internet Infrastructure · Research · Networking