(Bloomberg)—CloudFlare Inc., an internet service meant to protect websites from going down, faced its own network issues on Tuesday, leading to several prominent sites, including those on Shopify’s ecommerce platform and blogging platform Medium, being unavailable for some time.
CloudFlare said it “experienced a global outage across our network that resulted in visitors to Cloudflare-proxied domains being shown 502 errors (“Bad Gateway”).” That stemmed from a single misconfigured rule within the Cloudflare Web Application Firewall during a routine deployment of new Cloudflare WAF Managed rules caused the outage.
The new rules were intended to improve Cloudflare’s ability to block attacks that could bring a website down by overloading it. However, rather than deploy a simulated testing mode that would enable it to identify and log false positives, one of its rules contained a regular expression that caused its system to become overwhelmed, leading to the 502 errors.
The “network performance issues” began around 9:50 a.m. in New York, just as social media users began complaining that sites around the internet weren’t working. Twenty minutes later, CloudFlare said it had made a fix and was monitoring the situation. It’s unclear just how many sites were hit, but the episode underscores how many services have come to rely on CloudFlare. The system works by effectively acting as a buffer between a website and the end user, making sure to block attacks that could bring a website down by overloading it.
https://t.co/W5KAzedBHF internet infrastructure under attack again 😡😡
— Tobi Lütke (@tobi) July 2, 2019
Matthew Prince, CEO of CloudFlare, said in a tweet that an overload in computer usage caused backup systems to fail and affect CloudFlare’s services. “No evidence yet attack related. Shut down service responsible for CPU spike and traffic back to normal levels. Digging in to root cause.” He later tweeted additional details.
Additional technical details on the outage @Cloudflare experienced earlier today will be posted here. We are committed to being fully transparent: https://t.co/N9Uk0dCnWp
— Matthew Prince 🌥 (@eastdakota) July 2, 2019
Zak Stambor contributed to this story.