As organizations adopt Microsoft AKS at scale, they need to enforce namespace or even workload-based isolation for better security and compliance. This isolation, often referred to as microsegmentation, can help prevent the lateral movement of threats inside Kubernetes clusters, achieve compliance by limiting communication across workloads or namespaces, and enable multi-tenancy by limiting communication.

Starting on Aug 25, 2023, we started to notice some unusually big HTTP attacks hitting many of our customers. These attacks were detected and mitigated by our automated DDoS system. It was not long however, before they started to reach record breaking sizes — and eventually peaked just above 201 million requests per second. This was nearly 3x bigger than our previous biggest attack on record.

Earlier today, Cloudflare, along with Google and Amazon AWS, disclosed the existence of a novel zero-day vulnerability dubbed the “HTTP/2 Rapid Reset” attack. This attack exploits a weakness in the HTTP/2 protocol to generate enormous, hyper-volumetric Distributed Denial of Service (DDoS) attacks.

Modern cloud applications are made up of thousands of distributed services and resources that support an equally large volume of concurrent requests. This level of scale makes it more challenging for engineers to identify system failures before they lead to costly outages. System failures are often difficult to predict in cloud environments, and security threats add another layer of complexity.

One of the major concerns of multi-cloud companies is security. 69% of organizations admitted to experiencing data breaches or exposures due to multi-cloud security configurations.

Between the time it takes to stand up a new security tool in an IT environment, the resources needed to continually train personnel to effectively use each tool, and the raw cost of the solution itself, enterprise security teams invest quite a lot when introducing new security controls. Solutions that have been in place for a long time have likely grown with the team’s needs, and are well trusted within the organization.

At Cloudflare, we're constantly vigilant when it comes to identifying vulnerabilities that could potentially affect the Internet ecosystem. Recently, on September 12, 2023, Google announced a security issue in Google Chrome, titled "Heap buffer overflow in WebP in Google Chrome," which caught our attention. Initially, it seemed like just another bug in the popular web browser. However, what we discovered was far more significant and had implications that extended well beyond Chrome.