What broke in the 2026 cloud outages: AWS, Microsoft, Cloudflare, and the rest

The status pages blurred together. The write-ups do not. A handful of them are enough to see the year.

Control Plane’s tracker lists 18 major AWS, Azure, Google Cloud, and Cloudflare incidents dated 2026, through its 21 October update. Why that feels like more than the per-site trend is in Why major companies are seeing more outages in 2026. These are the documents behind the feeling.

Cloudflare deleted the prefixes it meant to filter

On 20 February, customers on Cloudflare’s Bring Your Own IP service lost routes. The postmortem says a change in how the network manages those addresses withdrew them. The change was an automation meant to replace a manual cleanup, part of Cloudflare’s work to make every config push small and health-checked.

The task requested /v1/prefixes?pending_delete and passed no value. The API took the “pending deletion” branch only when that parameter was a non-empty string. An empty string fell through to the normal response: every BYOIP prefix. The task deleted those prefixes and their service bindings until an engineer stopped it.

Of 6,500 prefixes advertised to one peer, 4,306 were BYOIP. About 1,100 were withdrawn between 17:56 and 18:46 UTC, a quarter of the BYOIP set. Roughly 800 came back around 20:20. About 300 could not be toggled on in the dashboard, because the bindings were gone, and waited on a config push that finished at 23:03. The introduction says 6 hours 7 minutes from 17:48. The event table runs 17:56 to 23:03, which is 5 hours 7 minutes. Both figures are in the same post.

Visitors to one.one.one.one saw HTTP 403. Resolution on 1.1.1.1 kept working. Products that needed those prefixes to attract traffic, including the CDN and Magic Transit, failed with them.

Source: Cloudflare outage on February 20, 2026, Cloudflare.

Cloudflare says the tests covered the journey a customer would click, and missed a task runner changing user data with nobody at the keyboard. The change merged on 5 February and deployed on 20 February.

Microsoft’s safety check passed

On 23 July, from 14:44 to 19:41 UTC, traffic entering or leaving Azure West US failed. Traffic inside the region did not. PIR ZJV6-SGG says a break-fix on one optical device was expanded by a blast-radius defect to every optical device leaving a datacenter.

The safety check is supposed to keep one of two redundant paths up. It ran, and it passed, because it judged each device alone. The tool had never been built to receive a whole datacenter in one request. Automated recovery then retried against the connectivity it had removed. Engineers tied the anomaly to the break-fix at 17:19, rolled back by hand at 17:45, and cleared services at 19:41.

Two other Microsoft clocks that May belong in the same year. On 29 May, Azure OpenAI tracking ID LYXT-C1Z, in Axis Intelligence’s log of Microsoft’s review, was an internal Microsoft 365 client retrying capacity errors with no backoff, up to 48 extra attempts, exempt from customer rate limits. A quiet period in Australia East looked like a fix. Sweden Central showed it was not. The same week, West US 2 ran 22 hours 6 minutes after lightning locked cooling out (PIR GHRP-84G in that log). Cooling returned in about two hours. Storage checks took the rest of the day.

Three milliseconds in the Netherlands, and a hot hall in Virginia

On 15 July, europe-west4-a took a 3 millisecond sag on the utility feed. Breakers on both sides tripped. One diesel rotary backup took the load. The other did not. Two server rows moved to the surviving feed. The third went dark. The chiller controller dropped offline, the pumps stayed stopped, and the spare chiller was out for construction. Google’s report says the hall reached 44°C and that staff shut reachable machines down. VMware Engine, Bare Metal Solution, and NetApp Volumes were interrupted for 14 hours 55 minutes. The cause was plain. The hours were restoration.

AWS’s May event in us-east-1 is the same family, with a thinner document. Control Plane, citing AWS status history, records a thermal event on 7–8 May and 21 hours 30 minutes to majority recovery after automatic shutdowns. CRN said Coinbase was affected for roughly seven hours. AWS had published no 2026 Post-Event Summary as of Axis’s 9 August check. On 19–20 October, Google reported a power event in one London zone that ran 7 hours 52 minutes. A full analysis was still unpublished on 21 October.

Regions that are still down, and cables you do not own

The longest 2026 outages have no rollback.

On 1 March, a strike and fire hit AWS in the UAE region me-central-1, and the fire department cut power. AWS’s later update, reported by Data Center Knowledge, said drone strikes hit two UAE facilities directly and that a strike near the Bahrain region, me-south-1, caused physical damage, lost power, and water damage from suppression. A health update mirrored by AWSDown says data hosted only in mec1-az2 cannot be restored. Control Plane’s 21 October log still lists both regions as disrupted since March.

The other failures were a name system and a cable. On 5–6 May, DENIC published invalid DNSSEC signatures for .de. Axis’s log of DENIC’s final report says the bug was in new in-house signing software, shipped after testing and an external audit. Validating resolvers returned SERVFAIL, including for names that do not use DNSSEC, because the bad signatures sat on NSEC3 records. Service was back in about three hours. On 22 June, The National reported user-report spikes for X, Reddit, Teams, Zoom, and Discord. Cloudflare then said it was investigating a fiber cut in eastern North America. Traffic engineering cleared most of the congestion. X also had its own API errors that day. Several causes, one afternoon.

Source: Annual Outage Analysis 2026, Uptime Institute. Figure 6. Fiber leads the 2025 public set.

The same shape, four write-ups

• Cloudflare’s filter was empty, so the API returned every prefix, and the job deleted them.
• Microsoft’s check looked at each optical device, so a request that named all of them looked safe.
• An internal inference client retried without jitter, and skipped the limits customers get.
• DENIC’s signer shipped after an audit, and the records that prove a name is absent took .de down with them.

The physical incidents fit in one line. A few milliseconds of bad voltage, a cooling lockout, a hot zone, a strike on a building. Recovery waits on people and parts.

If you ship the job that withdraws routes, the review is the control. ThinkReview reads that pull request on GitHub, GitLab, Azure DevOps, and Bitbucket, and the question to ask is the one these postmortems answered in public: what happens when the input is empty, or when it names every device at once?

What the write-ups imply for the next few years is The future of internet outages.