Cloudflare Q3 DDoS report: short bursts up 208%, terabit attacks down
18.2 million network-layer attacks were mitigated in July to September; CLDAP floods all but vanished while DNS amplification rose 215% and the US again tops the list of targets.
Serguey Asael Shinder
Contributing writer
Software engineer, BSc First Class Honours in Computing and Information Systems. Writes about the JVM, build tooling and the parts of a release note that actually change behaviour.
Signed pieces
Node.js 26 becomes LTS as 'Lithium', supported until the end of April 2029
Version 26.13.0 changes only release metadata from 26.12.1; teams coming from Node 24 or 22 should note that Linux binaries link against libatomic since Node 25.
Ubuntu fixes authd flaw that could map a cloud identity onto another user's account
USN-8957-1: authd did not properly validate identities when matching provider accounts to local users; after updating, authd must be restarted.
systemd allows Rust for new leaf components, likely from v263
Existing C code is not being ported and nothing other components depend on will be written in Rust; dynamic-library limitations block wider use for now.
Laravel 13.39 writes cache files atomically and adds session cleanup command
The 27 October release also stops a deleted model from halting queue:retry, fixes a PostgreSQL cache-lock transaction abort and blocks phar:// in Filesystem::exists().
GPT-6.1 Terra arrived on Bedrock and in Copilot the same day, with different pitches
AWS sells the model on price and agent benchmarks against GPT-6.1 Sol; GitHub sells it on terminal and C# tasks — and both say little about what changes for teams that already pay.
Red Hat's first Security Signals report argues for remediation speed over CVE counts
The Q3 2026 report models one reusable JAXB fix at 285,000 affected Java apps and $712.5 million of avoided work; the figures are Red Hat's own model, tied to its Lightwell service.
Cloudflare will score Verified bots on whether they obey robots.txt and back off on 429
A new system turns observed crawler behaviour into an explainable trust band; scores are due on Radar later, and customers will be able to set their own threshold.
FLUX.3 Image Klein lands in Diffusers: 5.6B open weights with bounding-box layout control
Black Forest Labs' new image model does text-to-image, multi-reference editing and region placement; the distilled checkpoint makes a 1024 x 1024 image in about 2 seconds on an H100.
Ubuntu 26.10 Stonking Stingray: Rust coreutils, post-quantum-ready signing, kernel 7.3
Canonical's interim release arrived on 15 October with Rust-based coreutils, TPM-backed disk encryption, Entra ID login with MFA, GNOME 51 and nine months of maintenance.