The floods
The month's three largest floods came from one tool. It opens HTTP/2 connections from hundreds of thousands of home and mobile connections, poses as Safari on an iPhone, and asks for the same page as fast as it can.
- 19 October, 13:49 UTC. More than 260 million requests in six minutes, from more than 900,000 addresses, at our own website shieldify.ee. Every website we protect kept answering.
- 20 October, 22:07 UTC. 118 million requests in 3 minutes 29 seconds, 1,015,237 of them in the busiest second, from about 889,000 addresses in 52 countries. The full measurements are in Anatomy of a One-Million-Request-a-Second Flood.
- 23 October, 02:49 UTC. The same tool turned to the login page of a website we protect: 96.8 million requests in just under 12 minutes, from about 1.07 million addresses in 58 countries. About half of them had flooded us two days earlier. Read The Flood Came Back for a Login Page.
Each of those floods came from ordinary home connections spread across the world, a few addresses per network. That is why blocking countries, networks or lists of addresses does not stop a flood like this; our guide explains what does.
On 31 October a different tool came for shieldify.ee: 2.6 million requests in under two minutes, up to 144,776 a second, from about 88,000 addresses in 58 countries. It posed as Chrome. The same day we shipped changes that stop tools like it much sooner; the changelog has them.
A PHP flaw a day early, a kernel flaw before the fix
On 20 October the details of two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, leaked a day before their fix. Both can let anyone run code on a server with crafted requests, no login needed. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them. Shieldify's firewall refused the leaked attack path 5 hours 44 minutes before PHP's advisory. What to check and what to update: php2shell: What Happened and What to Do Now.
On 29 October a flaw in the Linux kernel's TCP handshake, CVE-2026-98432, became public: anyone who can reach an open TCP port can trigger it, and not every Linux distribution has a fix yet. Shieldify's network has been protected since 29 October, 23:38 UTC: our edge drops the packets the attack needs before they reach the kernel. Who is affected and what to do until your kernel is patched: CVE-2026-98432.
New in October
- Breakwave (6 October): once an attacker is caught, it is turned away at the very edge of our network, before any other layer of protection.
- A new TLS engine (10 October): about twice as many new HTTPS connections per second on the same servers.
- Pinpoint Bans (12 October): on a shared address, such as a mobile network or an office, only the device that attacks is stopped.
- Strict Mode (15 October): bots posing as ordinary browsers get a CAPTCHA; real visitors go straight through.
- Analytics and Caching (16 October): visitors, pages and referrers in the console, cache rules by path, and an alert when your server stops answering.
- Our own web server (18 October): every website we protect now runs on software we built for attacks.
- Our own CAPTCHA (20 October): the visitor ticks "I'm a person" and the browser does a short piece of work, usually under a second.
- New pricing (21 October): from €4.90 a month, tax included, one subscription for every website on your account.
- A public status page (23 October): status.shieldify.ee.
- Firewall (30 October): a tool that keeps probing your website for weaknesses is stopped for a while.
- Attackers and IP details (30 October): see who Breakwave shut out of your website and what it stopped of each, and everything Shieldify knows about an address in one place.
- Plain HTTP (30 October): visitors who type http:// are sent to https:// by the network edge itself in most cases, and tools that attack over http:// are stopped one by one, as over https://.
- Bot protection (31 October): bots that pretend to be a browser, even close copies of one, are stopped much sooner.
Every change, with the details, is in the changelog.
What we measure, in public
This month we started Shieldify Research: two attack reports, two vulnerability watches, four guides, from the first fifteen minutes under attack to how an origin's address leaks, and where a flood goes inside our network. New articles arrive in the Atom feed.