Natural disasters and government interference: examining Q2 2026's major Internet disruption events¶
Summary¶
Cloudflare's quarterly Radar-based review of confirmed Internet disruptions for Q2 2026 (April–June). The quarter's events span the full cause taxonomy — severe weather, earthquake, power outage, government-mandated shutdowns, kinetic conflict damage to cloud infrastructure, submarine cable cuts, and a DNSSEC misconfiguration — demonstrating that the Internet depends on a complex set of interrelated physical and digital systems, and a failure in any one of them can sever connectivity.
Key takeaways¶
-
Super Typhoon Sinlaku (mid-April) passed just north of Guam, knocking out power and dropping Internet traffic 80% below expected levels for ~24 hours (April 13–14) despite not making a direct landfall hit.
-
Dual M7.5 earthquakes in Venezuela (June 24, 22:04 UTC) caused immediate sharp drops in HTTP bytes transferred across multiple ISPs — CANTV (AS8048), Fibex Telecom (1.6 M estimated users per APNIC), and VNET (AS263703) — demonstrating how seismic events propagate into network telemetry instantaneously.
-
Tanzania power outage (June 27) caused a ≥5-hour HTTP traffic drop indistinguishable in user impact from the country's deliberate election-related October 2025 shutdown — "striking how such fundamentally different events leave such similar footprints in the data and user experience."
-
Iran partial Internet restoration (from May 26) after an 88-day nationwide shutdown beginning February 28. Traffic settled at ~59% of pre-shutdown levels — consistent with the February inter-shutdown baseline, not full normalisation. HTTP traffic reached as high as 90% before settling. The 2026 World Cup analysis showed Iran as a solo traffic outlier dominated by the restoration signal rather than match schedules.
-
AWS me-central-1 (UAE) remains degraded following the March 2026 drone strikes. Cloud Observatory shows traffic "has remained low" aligning with AWS's April 30 status update: "has suffered damage as a result of the conflict in the Middle East and is currently unable to reliably support customer applications." The decreased traffic is the downstream signature of physical data-center damage — region unusable regardless of individual application availability.
-
Government-mandated exam shutdowns continued as a seasonal pattern: Iraq (3 shutdowns: June 2, 11, 28; ~90 min each) and Sudan (10 shutdowns April 13–23; consistent 3.5-hour windows 11:45–15:15 UTC daily, timed to exam windows). These are the most frequent disruptions in the quarter.
-
DENIC .de DNSSEC key-rollover failure (May 5) distributed invalid signatures, causing every DNSSEC-validating resolver worldwide to return SERVFAIL for all
.dequeries until restoration at 23:15 UTC. Worldwide.dequery volume rose during the outage because failed answers are uncacheable (normally-cached lookups had to be re-resolved repeatedly). Previously covered in detail in sources/2026-05-06-cloudflare-when-dnssec-goes-wrong-de-tld-outage. -
Karib Cable fiber cut near Saint Lucia (June 21) dropped HTTP traffic to essentially zero for ~20 hours; at the country level Saint Lucia's overall traffic fell ~60% against the prior week — "a familiar hazard for Caribbean networks that depend on a small number of terrestrial and submarine paths to reach the wider Internet."
Operational numbers¶
| Event | Traffic drop | Duration |
|---|---|---|
| Guam — Typhoon Sinlaku | 80% below expected | ~24h (Apr 13–14) |
| Venezuela — M7.5 earthquakes | Sharp drop across 3 major ISPs | Hours (Jun 24) |
| Tanzania — power outage | Sharp drop | ≥5h (Jun 27) |
| Iran — restoration | Settled at ~59% of pre-shutdown | Ongoing from May 26 |
| AWS me-central-1 | Region unreliable | Ongoing since March |
| Iraq — exam shutdowns | Near-zero traffic | ~90 min each × 3 |
| Sudan — exam shutdowns | Near-zero traffic | ~3.5h each × 10 |
| Germany — .de DNSSEC failure | SERVFAIL for all .de queries | ~4h (May 5) |
| Saint Lucia — cable cut | 60% country-level drop | ~20h (Jun 21–22) |
Concepts extracted¶
- concepts/internet-resilience — the article's central theme: building networks with enough redundancy in power, routing, and physical paths to withstand inevitable shocks.
- concepts/dnssec-key-rollover — the periodic replacement of cryptographic keys used to sign DNS zone records; failure during rollover produces invalid signatures that cause SERVFAIL cascades.
- concepts/internet-single-point-of-failure — Caribbean and small-island networks demonstrate how a single fiber path represents a disproportionate amount of capacity.
- concepts/network-redundancy — the design discipline highlighted by all events; explicitly named in the conclusion.
Patterns extracted¶
- patterns/quarterly-internet-disruption-review — Cloudflare's recurring blog cadence: draw on Radar traffic data to document, confirm, and contextualise quarterly Internet disruptions.
Caveats¶
- Summary of notable, confirmed disruptions — not exhaustive; fuller view available at the Cloudflare Radar Outage Center.
- The article is a Q2 review; individual events (Iran restoration, .de DNSSEC failure) have been covered in depth in separate dedicated Cloudflare posts already on the wiki.
- No new architectural patterns or novel systems disclosed; this is an observability/resilience framing post, not a deep technical writeup.
Source¶
- Original: https://blog.cloudflare.com/q2-2026-internet-disruption-summary/
- Raw markdown:
raw/cloudflare/2026-07-28-natural-disasters-and-government-interference-examining-q2-2-c309d751.md
Related¶
- sources/2026-04-28-cloudflare-q1-2026-internet-disruption-summary — Q1 2026 quarterly review (predecessor)
- sources/2026-05-06-cloudflare-when-dnssec-goes-wrong-de-tld-outage — Dedicated deep-dive on the .de DNSSEC outage mentioned here
- sources/2026-05-27-cloudflare-irans-internet-is-partially-restored-cloudflare-radar-data-shows — Iran restoration deep-dive