Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave

Cloudflare's H1 2026 report details a dramatic increase in large-scale network-layer DDoS activity — including a combined 935 attacks exceeding 1 Tbps and an average of 5,300 DDoS attacks per hour — with a notable shift from botnet floods to reflection/amplification vectors (DNS and surging CLDAP floods). The report also links attack patterns to geopolitical events, identifies Media and Publishing as the most-targeted industry, and highlights country- and sector-level shifts in targeting during the period.