Skip to content

CLOUDFLARE

Read original ↗

Natural disasters and government interference: examining Q2 2026's major Internet disruption events

Summary

Cloudflare's quarterly Radar-based review of confirmed Internet disruptions for Q2 2026 (April–June). The quarter's events span the full cause taxonomy — severe weather, earthquake, power outage, government-mandated shutdowns, kinetic conflict damage to cloud infrastructure, submarine cable cuts, and a DNSSEC misconfiguration — demonstrating that the Internet depends on a complex set of interrelated physical and digital systems, and a failure in any one of them can sever connectivity.

Key takeaways

  1. Super Typhoon Sinlaku (mid-April) passed just north of Guam, knocking out power and dropping Internet traffic 80% below expected levels for ~24 hours (April 13–14) despite not making a direct landfall hit.

  2. Dual M7.5 earthquakes in Venezuela (June 24, 22:04 UTC) caused immediate sharp drops in HTTP bytes transferred across multiple ISPs — CANTV (AS8048), Fibex Telecom (1.6 M estimated users per APNIC), and VNET (AS263703) — demonstrating how seismic events propagate into network telemetry instantaneously.

  3. Tanzania power outage (June 27) caused a ≥5-hour HTTP traffic drop indistinguishable in user impact from the country's deliberate election-related October 2025 shutdown — "striking how such fundamentally different events leave such similar footprints in the data and user experience."

  4. Iran partial Internet restoration (from May 26) after an 88-day nationwide shutdown beginning February 28. Traffic settled at ~59% of pre-shutdown levels — consistent with the February inter-shutdown baseline, not full normalisation. HTTP traffic reached as high as 90% before settling. The 2026 World Cup analysis showed Iran as a solo traffic outlier dominated by the restoration signal rather than match schedules.

  5. AWS me-central-1 (UAE) remains degraded following the March 2026 drone strikes. Cloud Observatory shows traffic "has remained low" aligning with AWS's April 30 status update: "has suffered damage as a result of the conflict in the Middle East and is currently unable to reliably support customer applications." The decreased traffic is the downstream signature of physical data-center damage — region unusable regardless of individual application availability.

  6. Government-mandated exam shutdowns continued as a seasonal pattern: Iraq (3 shutdowns: June 2, 11, 28; ~90 min each) and Sudan (10 shutdowns April 13–23; consistent 3.5-hour windows 11:45–15:15 UTC daily, timed to exam windows). These are the most frequent disruptions in the quarter.

  7. DENIC .de DNSSEC key-rollover failure (May 5) distributed invalid signatures, causing every DNSSEC-validating resolver worldwide to return SERVFAIL for all .de queries until restoration at 23:15 UTC. Worldwide .de query volume rose during the outage because failed answers are uncacheable (normally-cached lookups had to be re-resolved repeatedly). Previously covered in detail in sources/2026-05-06-cloudflare-when-dnssec-goes-wrong-de-tld-outage.

  8. Karib Cable fiber cut near Saint Lucia (June 21) dropped HTTP traffic to essentially zero for ~20 hours; at the country level Saint Lucia's overall traffic fell ~60% against the prior week — "a familiar hazard for Caribbean networks that depend on a small number of terrestrial and submarine paths to reach the wider Internet."

Operational numbers

Event Traffic drop Duration
Guam — Typhoon Sinlaku 80% below expected ~24h (Apr 13–14)
Venezuela — M7.5 earthquakes Sharp drop across 3 major ISPs Hours (Jun 24)
Tanzania — power outage Sharp drop ≥5h (Jun 27)
Iran — restoration Settled at ~59% of pre-shutdown Ongoing from May 26
AWS me-central-1 Region unreliable Ongoing since March
Iraq — exam shutdowns Near-zero traffic ~90 min each × 3
Sudan — exam shutdowns Near-zero traffic ~3.5h each × 10
Germany — .de DNSSEC failure SERVFAIL for all .de queries ~4h (May 5)
Saint Lucia — cable cut 60% country-level drop ~20h (Jun 21–22)

Concepts extracted

  • concepts/internet-resilience — the article's central theme: building networks with enough redundancy in power, routing, and physical paths to withstand inevitable shocks.
  • concepts/dnssec-key-rollover — the periodic replacement of cryptographic keys used to sign DNS zone records; failure during rollover produces invalid signatures that cause SERVFAIL cascades.
  • concepts/internet-single-point-of-failure — Caribbean and small-island networks demonstrate how a single fiber path represents a disproportionate amount of capacity.
  • concepts/network-redundancy — the design discipline highlighted by all events; explicitly named in the conclusion.

Patterns extracted

Caveats

  • Summary of notable, confirmed disruptions — not exhaustive; fuller view available at the Cloudflare Radar Outage Center.
  • The article is a Q2 review; individual events (Iran restoration, .de DNSSEC failure) have been covered in depth in separate dedicated Cloudflare posts already on the wiki.
  • No new architectural patterns or novel systems disclosed; this is an observability/resilience framing post, not a deep technical writeup.

Source

Last updated · 598 distilled / 1,814 read