Cloudflare Outage Takes Down ChatGPT, Uber, X, More. Here's What Happened

Cloudflare suffered a major outage beginning around 6:15 a.m. ET on Nov. 18 that disrupted traffic for many third-party services—OpenAI’s ChatGPT, X, Canva, DoorDash, Uber, Zoom and others—with Downdetector logging over 2.1 million reports (about 453K from the U.S.). Company executives said the outage, the worst since 2019, was not a cyberattack but caused when a permissions change to a database caused duplicate entries to be written into a Bot Management “feature file,” which doubled in size, exceeded a software limit and cascaded into service failures; traffic flow was resolved around 9:30 a.m. ET and control-plane/dashboard/APIs were restored later. Cloudflare’s CEO and CTO apologized, committed to technical changes including more global kill switches and a full postmortem, and the incident highlights concentrated operational and reputational risk in internet infrastructure that could spur customers and investors to reassess vendor resilience.

Analysis

Cloudflare experienced a major outage beginning at approximately 6:15 a.m. ET on Nov. 18 that disrupted traffic for a broad set of third-party services including OpenAI's ChatGPT, X, Canva, DoorDash, Uber, Zoom and Spotify; Downdetector recorded more than 2.1 million reports globally and roughly 453K from the U.S. Company executives labeled it the worst outage since 2019 and publicly acknowledged widespread 500 errors across customer sites. The company traced the failure to a permissions change that caused duplicate entries to be written into a Bot Management "feature file," which doubled in size, exceeded a software size limit and cascaded into broader network and control-plane failures; Cloudflare said this was not a cyberattack. Traffic flow was resolved by about 9:30 a.m. ET and control-plane/dashboard/APIs were restored later, while CEO Matthew Prince and CTO Dane Knecht committed to technical changes (including more global kill switches) and a full postmortem. The incident underscores concentrated operational and reputational risk in internet infrastructure—echoing a recent AWS outage—and likely drives near-term negative sentiment for Cloudflare (NET) and temporary credit or counterparty concerns for dependent app companies until remediation is verified.

Key Decisions for Investors

• Consider reducing or hedging exposure to NET until Cloudflare publishes a detailed postmortem and independent verification of implemented safeguards is available,
• Monitor the post-incident walkthrough for concrete timelines on global kill switches, testing protocols and control-plane hardening before reestablishing full exposure,
• Review holdings with operational dependency on Cloudflare (e.g., app/API-driven names noted in the outage) for vendor-concentration risk and press management for SLA/contingency disclosures,
• Avoid event-driven additions to positions in impacted consumer/API names until operational telemetry (Downdetector reports and vendor confirmations) show sustained stability over multiple business cycles