{"schema_version":"onlylabs.public_signal.v1","title":"Cloudflare (Workers AI) Writing: Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","description":"Cloudflare (Workers AI) writing signal with public source context, captured evidence pages, related signals, and category-scoped analysis context.","url":"https://onlylabs.fyi/signals/843e036d-384d-47a7-a18d-53098061a602","json_url":"https://onlylabs.fyi/signals/843e036d-384d-47a7-a18d-53098061a602/signal.json","generated_at":"2026-10-29T18:23:56.209Z","evidence_latest_fetched_at":"2026-10-29T16:02:52.526483+00:00","signal_first_seen_at":"2026-10-29T16:00:53.158928+00:00","org":{"slug":"cloudflare","name":"Cloudflare (Workers AI)","category":"neocloud","category_label":"Neocloud","dossier_url":"https://onlylabs.fyi/labs/cloudflare","dossier_json_url":"https://onlylabs.fyi/labs/cloudflare/dossier.json"},"related_urls":{"signal":"https://onlylabs.fyi/signals/843e036d-384d-47a7-a18d-53098061a602","signal_json":"https://onlylabs.fyi/signals/843e036d-384d-47a7-a18d-53098061a602/signal.json","source":"https://blog.cloudflare.com/ddos-threat-report-2026-q3/","lab_dossier":"https://onlylabs.fyi/labs/cloudflare","lab_dossier_json":"https://onlylabs.fyi/labs/cloudflare/dossier.json","analysis":"https://onlylabs.fyi/analysis/cloudflare","analysis_json":"https://onlylabs.fyi/analysis/cloudflare/analysis.json","analysis_evidence_json":"https://onlylabs.fyi/analysis/cloudflare/evidence.json","category":"https://onlylabs.fyi/neoclouds","category_json":"https://onlylabs.fyi/neoclouds.json","category_feed":"https://onlylabs.fyi/neoclouds/feed.xml","category_signals_json":"https://onlylabs.fyi/signals.json?category=neocloud","topic":"https://onlylabs.fyi/topics/talking","topic_signals_json":"https://onlylabs.fyi/topics/talking/signals.json?category=neocloud","topic_feed":"https://onlylabs.fyi/topics/talking/feed.xml?category=neocloud","data_business":null},"answer_pack":{"answer":"Cloudflare (Workers AI) published Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants. This talking signal gives public context for research themes, product direction, policy, or launch framing. High-signal details: Routine security report, not AI-related. · Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants | Cloudflare Blog Skip to content Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This.... onlylabs links this event to 1 captured evidence page and 6 related writing signals.","signal_desk":"talking","source_context":{"source_url":"https://blog.cloudflare.com/ddos-threat-report-2026-q3/","source_host":"blog.cloudflare.com","occurred_at":"2026-10-29T12:55:00+00:00","first_seen_at":"2026-10-29T16:00:53.158928+00:00","date_source":"rss.item_date","context":null},"context_markers":[{"label":"Lab","value":"Cloudflare (Workers AI)","source":"signal"},{"label":"Signal desk","value":"talking","source":"signal"},{"label":"Source host","value":"blog.cloudflare.com","source":"source"},{"label":"Author","value":"Cloudforce One","source":"source"},{"label":"Notability","value":"Routine security report, not AI-related.","source":"signal"},{"label":"Watch term","value":"Infrastructure","source":"evidence"},{"label":"Watch term","value":"Safety and alignment","source":"evidence"},{"label":"Watch term","value":"Agents and tool use","source":"evidence"}],"evidence_coverage":{"target_pages":1,"captured_pages":1,"readable_pages":1,"capture_methods":["plain"],"missing_page_urls":[],"failed_page_urls":[],"blocked_page_urls":[],"page_urls":["https://blog.cloudflare.com/ddos-threat-report-2026-q3/"],"related_signals":6,"has_source_url":true,"latest_page_fetched_at":"2026-10-29T16:02:52.526483+00:00"},"data_business":{"matches":false,"lanes":[],"matched_terms":[],"score":null,"reason":null},"agent_handoff":{"signal_json":"https://onlylabs.fyi/signals/843e036d-384d-47a7-a18d-53098061a602/signal.json","dossier_json":"https://onlylabs.fyi/labs/cloudflare/dossier.json","analysis_json":"https://onlylabs.fyi/analysis/cloudflare/analysis.json","analysis_evidence_json":"https://onlylabs.fyi/analysis/cloudflare/evidence.json","topic_signals_json":"https://onlylabs.fyi/topics/talking/signals.json?category=neocloud","topic_feed":"https://onlylabs.fyi/topics/talking/feed.xml?category=neocloud","category_signals_json":"https://onlylabs.fyi/signals.json?category=neocloud","data_radar_json":null,"opportunities_json":null},"analysis_playbook":{"objective":"Turn public writing and discussion into a readable map of research themes, product framing, policy posture, launch narratives, and market attention.","evidence_focus":["post title","source URL","captured page text","HN traction","linked model or paper references","publication date"],"extraction_questions":["Which themes are labs choosing to explain publicly?","Which posts are attracting outside discussion?","Which writing reframes a recent release, model, hiring wave, or policy stance?","Which posts mention data, evals, infrastructure, safety, or deployment workflows?"],"signal_questions":["What public theme, launch framing, or research direction does this writing signal expose?","Which themes are labs choosing to explain publicly?","Which posts are attracting outside discussion?","Do the 6 related writing signals show a repeated pattern?"],"output_fields":["org","theme","public_framing","traction","evidence_url"],"data_business_relevance":"Data-business lane extraction is scoped to frontier labs; for this category, keep conclusions tied to category-specific strategy, source evidence, and follow-up questions.","required_sources":[{"label":"signal_json","url":"https://onlylabs.fyi/signals/843e036d-384d-47a7-a18d-53098061a602/signal.json","required":true},{"label":"source","url":"https://blog.cloudflare.com/ddos-threat-report-2026-q3/","required":true},{"label":"dossier_json","url":"https://onlylabs.fyi/labs/cloudflare/dossier.json","required":true},{"label":"analysis_evidence_json","url":"https://onlylabs.fyi/analysis/cloudflare/evidence.json","required":true},{"label":"topic_signals_json","url":"https://onlylabs.fyi/topics/talking/signals.json?category=neocloud","required":false},{"label":"data_radar_json","url":null,"required":false}],"expected_output":["one-paragraph source-grounded interpretation","category-specific implication","confidence and missing evidence","recommended next source to inspect"],"prompt_seed":"Using only the linked onlylabs JSON, captured source context, and cited evidence, analyze Cloudflare (Workers AI)'s writing signal \"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants\" for neocloud strategy."},"semantic_triples":[{"subject":"Cloudflare (Workers AI)","predicate":"published","object":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","text":"Cloudflare (Workers AI) published Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"is classified as","object":"writing signal","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants is classified as writing signal."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"belongs to","object":"talking desk","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants belongs to talking desk."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has evidence coverage","object":"1 captured evidence page","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has evidence coverage 1 captured evidence page."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has captured page count","object":"1","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has captured page count 1."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has readable page count","object":"1","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has readable page count 1."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has related signal count","object":"6","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has related signal count 6."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has analysis playbook objective","object":"Turn public writing and discussion into a readable map of research themes, product framing, policy posture, launch narratives, and market attention.","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has analysis playbook objective Turn public writing and discussion into a readable map of research themes, product framing, policy posture, launch narratives, and market attention.."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has source host","object":"blog.cloudflare.com","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has source host blog.cloudflare.com."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has lab","object":"Cloudflare (Workers AI)","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has lab Cloudflare (Workers AI)."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has signal desk","object":"talking","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has signal desk talking."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has source host","object":"blog.cloudflare.com","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has source host blog.cloudflare.com."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has author","object":"Cloudforce One","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has author Cloudforce One."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has notability","object":"Routine security report, not AI-related.","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has notability Routine security report, not AI-related.."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has watch term","object":"Infrastructure","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has watch term Infrastructure."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has watch term","object":"Safety and alignment","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has watch term Safety and alignment."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has watch term","object":"Agents and tool use","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has watch term Agents and tool use."}]},"intelligence":{"signal_desk":"talking","answer":"Cloudflare (Workers AI) published Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants. This talking signal gives public context for research themes, product direction, policy, or launch framing. High-signal details: Routine security report, not AI-related. · Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants | Cloudflare Blog Skip to content Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This.... onlylabs links this event to 1 captured evidence page and 6 related writing signals.","semantic_triples":[{"subject":"Cloudflare (Workers AI)","predicate":"published","object":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","text":"Cloudflare (Workers AI) published Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"is classified as","object":"writing signal","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants is classified as writing signal."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"belongs to","object":"talking desk","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants belongs to talking desk."},{"subject":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","predicate":"has evidence coverage","object":"1 captured evidence page","text":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants has evidence coverage 1 captured evidence page."}]},"signal":{"id":"843e036d-384d-47a7-a18d-53098061a602","url":"https://onlylabs.fyi/signals/843e036d-384d-47a7-a18d-53098061a602","json_url":"https://onlylabs.fyi/signals/843e036d-384d-47a7-a18d-53098061a602/signal.json","source_url":"https://blog.cloudflare.com/ddos-threat-report-2026-q3/","title":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","summary":"Cloudflare (Workers AI) published a writing signal. onlylabs watches public writing for research themes, product direction, and model-launch context.","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"cloudflare","name":"Cloudflare (Workers AI)","category":"neocloud"},"occurred_at":"2026-10-29T12:55:00+00:00","first_seen_at":"2026-10-29T16:00:53.158928+00:00","date_source":"rss.item_date","evidence_coverage":{"target_pages":1,"captured_pages":1,"readable_pages":1,"capture_methods":["plain"],"missing_page_urls":[],"failed_page_urls":[],"blocked_page_urls":[],"page_urls":["https://blog.cloudflare.com/ddos-threat-report-2026-q3/"]},"facets":{},"traction":{"github_stars":null,"hn_points":1,"hn_comments":0,"hn_story_id":"50289526","hf_downloads":null,"hf_likes":null},"data_radar":null},"primary_evidence_page":{"is_primary":true,"source_match":true,"url":"https://blog.cloudflare.com/ddos-threat-report-2026-q3/","final_url":"https://blog.cloudflare.com/ddos-threat-report-2026-q3/","title":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants","http_status":200,"content_type":"text/html","capture_method":"plain","fetched_at":"2026-10-29T16:02:52.526483+00:00","bytes":301136,"raw_path":"93dde8cc7b16e73253cc02b0c36d5bb80c45dac5aacfb06bc2e8bdadf6fb0087.html","content_hash":"6d15c3298103696578c548d381c2177ebb8c95eff571f89e90bcf3d51919f2a4","excerpt_chars":1200,"truncated":true,"excerpt":"Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants | Cloudflare Blog Skip to content Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One , Cloudflare's Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network . Key insights Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. However, variants continue to emerge, proving that IoT botnets remain a durable, high-volume threat to network infrastructure. Threat actors dramatically shifted their reflection and amplification tactics, abruptly abandoning CLDAP floods, which collapsed by 99.5% quarter-over-quarter. Instead, attackers..."},"evidence_pages":[],"related_signals":[{"id":"018fb5cb-e085-4155-97e7-a6f7c3724a8d","url":"https://onlylabs.fyi/signals/018fb5cb-e085-4155-97e7-a6f7c3724a8d","source_url":"https://blog.cloudflare.com/php-ctf/","title":"Introducing the Cloudflare PHP Capture the Flag challenge","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"cloudflare","name":"Cloudflare (Workers AI)","category":"neocloud"},"occurred_at":"2026-10-27T13:00:00+00:00","first_seen_at":"2026-10-27T16:00:55.245952+00:00","date_source":"rss.item_date"},{"id":"1a92f8bd-5367-42d4-b10e-4dec39d40ed2","url":"https://onlylabs.fyi/signals/1a92f8bd-5367-42d4-b10e-4dec39d40ed2","source_url":"https://blog.cloudflare.com/q3-2026-internet-disruption-summary/","title":"What took the Internet offline in Q3 2026","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"cloudflare","name":"Cloudflare (Workers AI)","category":"neocloud"},"occurred_at":"2026-10-27T13:00:00+00:00","first_seen_at":"2026-10-27T16:00:55.245952+00:00","date_source":"rss.item_date"},{"id":"9c9d357b-b379-4de0-ab2c-30764ba08632","url":"https://onlylabs.fyi/signals/9c9d357b-b379-4de0-ab2c-30764ba08632","source_url":"https://blog.cloudflare.com/origin-range-requests/","title":"Origin Range Requests: Serving large files without range-request tuning","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"cloudflare","name":"Cloudflare (Workers AI)","category":"neocloud"},"occurred_at":"2026-10-23T18:22:59+00:00","first_seen_at":"2026-10-23T20:00:52.925659+00:00","date_source":"rss.item_date"},{"id":"36b8c4da-4f96-4abc-8a89-7ff3e47942cd","url":"https://onlylabs.fyi/signals/36b8c4da-4f96-4abc-8a89-7ff3e47942cd","source_url":"https://blog.cloudflare.com/post-quantum-geo-key-manager/","title":"Bringing post-quantum cryptography to geographically fenced key management","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"cloudflare","name":"Cloudflare (Workers AI)","category":"neocloud"},"occurred_at":"2026-10-23T18:06:56+00:00","first_seen_at":"2026-10-23T20:00:52.925659+00:00","date_source":"rss.item_date"},{"id":"d9e0cfd4-b38f-4c15-bd9e-81cfe0ac8dfb","url":"https://onlylabs.fyi/signals/d9e0cfd4-b38f-4c15-bd9e-81cfe0ac8dfb","source_url":"https://blog.cloudflare.com/k-isms/","title":"Localizing compliance at scale: achieving South Korea’s ISMS certification","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"cloudflare","name":"Cloudflare (Workers AI)","category":"neocloud"},"occurred_at":"2026-10-22T13:00:00+00:00","first_seen_at":"2026-10-22T16:00:54.670606+00:00","date_source":"rss.item_date"},{"id":"c4eae839-a0c9-41eb-ac57-dc20e86fb050","url":"https://onlylabs.fyi/signals/c4eae839-a0c9-41eb-ac57-dc20e86fb050","source_url":"https://blog.cloudflare.com/kv-cache-exposure-remediation/","title":"Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"cloudflare","name":"Cloudflare (Workers AI)","category":"neocloud"},"occurred_at":"2026-09-08T00:00:00.000Z","first_seen_at":"2026-10-27T00:00:52.753914+00:00","date_source":"page.visible_date"}]}