The Internet Walks on a Pegleg Named Cloudflare

The modern web is held up by infrastructure almost no one can name. Illustration: original.

There is a comforting myth about the internet, and it goes like this: the thing was designed to survive a nuclear war. Born of Cold War paranoia, it was supposed to be a hydra — decentralized, redundant, impossible to behead. Sever one path and the packets simply route around the wound.

The myth is half true, which is the most dangerous kind of true. The original blueprint really was built for resilience. But the internet you actually use today — the one streaming your shows, clearing your card, and answering your chatbot — does not run on that elegant mesh. It runs on a tangle of duct tape, legacy code, and a handful of choke points so load-bearing that most people would be alarmed to learn they exist.

Which brings us to the pegleg. A pegleg is a beautiful piece of engineering precisely because you forget it's there. It bears your full weight, takes every step with you, and disappears into the rhythm of walking — right up until the moment it cracks and you discover, mid-stride, exactly how much you'd been leaning on it.

The modern web walks on a pegleg called Cloudflare. It is the internet's immune system, its traffic cop, and — this is the uncomfortable part — its single most catastrophic point of failure, all at once. Strip it away and the digital economy buckles under denial-of-service floods, ruinous bandwidth bills, and latency that would make a 1998 dial-up modem feel snappy. Keep it, and the web hums along faster and safer than it has any right to — at the cost of pouring an almost vulgar amount of power into one company's routing tables.

To understand the web of today, and the AI gold rush trying to eat it, you have to understand the invisible leviathan quietly routing the traffic. So let's go meet it.

The Bouncer at the Door

If the internet were a nightclub, a reverse proxy would be the bouncer — the one checking IDs, turning away troublemakers, and making sure the place doesn't get so crowded nobody can move. In duller terms, a reverse proxy sits in front of a website's actual servers, fields the incoming requests, blocks the bad ones, serves cached copies of the boring static stuff, and shields the origin from the firehose of the open internet.

Cloudflare is the biggest bouncer on Earth. It is not close.

Start with the raw physics. As of spring 2026, Cloudflare's global network passed 500 terabits per second of capacity. That is enough headroom to carry north of a fifth of all web traffic on the planet and still casually swallow the largest cyberattacks ever recorded without breaking a sweat. The company fields well over two trillion requests a day. Its serverless edge platform, Workers, handles something closer to fifty trillion. These are not numbers the human brain is equipped to feel; they are weather, not arithmetic.

The scale of Cloudflare's edge in 2026.

Now the part that should make a regulator's eye twitch. Among all websites whose reverse proxy can be identified, Cloudflare holds roughly 83 percent of the market — which works out to standing guard over nearly a quarter of every website in existence. Its nearest rivals, Amazon's CloudFront and Fastly, scrape along in the single digits. This is not a competitive landscape. This is one very large company and a rounding error.

Reverse-proxy market share. Source: W3Techs, 2026.

What makes that dominance stranger is that Cloudflare didn't just colonize the existing plumbing — it ripped out the pipes and forged new ones. For years it leaned on NGINX, the workhorse open-source web server that powers a huge slice of the internet. But at trillion-request scale, NGINX's memory quirks started to chafe, so Cloudflare's engineers did the thing only a company at that altitude can afford to do: they wrote their own. The result, Pingora, is built in Rust — the memory-safe language the entire industry has been slowly, nervously migrating toward — and now shoulders more than a trillion requests a day on its own.

Sit with that for a second. Cloudflare is no longer merely a tenant of the internet's infrastructure. It is rewriting the foundations the modern web stands on, one protocol at a time. The bouncer now owns the building.

The Planet's Immune System

The company began, fittingly, by hunting spammers. The founding trio — Matthew Prince, Michelle Zatlyn, and Lee Holloway — started with a humble project to track email scammers and somehow talked themselves into "building a better internet." That pitch made its debut at TechCrunch Disrupt in 2010. Fifteen years later, the spam tracker has metastasized into something closer to a planetary immune system.

And the pathogens have evolved. Cloudflare's own threat researchers describe the current moment with a phrase that should keep you up at night: the total industrialization of cyber threats. The lone hacker hunched over a terminal, manually probing for a weak spot, is a quaint historical figure now. Today's attacks are automated, AI-accelerated, and scaled like a factory floor. The barrier to entry has effectively vanished. Why pick a lock when you can have a thousand bots try every door simultaneously, forever, for free?

Because Cloudflare watches a fifth of all traffic, it sees the storms forming before they make landfall. During its 2025 reporting window it flagged 6.2 percent of all web traffic as outright malicious and deemed 5.6 percent of processed email hostile — over half of it freighted with phishing links. (A delightful footnote: the single most spam-prone top-level domain was .christmas. Make of that what you will.)

The headline attacks, though, operate at a scale where the word "attack" feels almost too small. In the winter of 2025–26, the network absorbed hyper-volumetric strikes from state-adjacent botnets — one named Aisuru peaked at a brain-melting 31.4 terabits per second. At those speeds, a human in the loop is a joke. No analyst, however caffeinated, can read a 31-trillion-bit-per-second flood of garbage in real time. The only thing fast enough to stop a machine is another machine. Defense has become autonomous because offense already is.

The Death of the CAPTCHA

For two decades, the internet's idea of asking "are you human?" was to make you squint at a grid of blurry crosswalks and click the squares with traffic lights, like a digital sobriety test administered by a sadist. CAPTCHAs are a tax on the entire species — billions of hours annually surrendered to proving we are not robots, to robots.

Cloudflare's answer is Turnstile, and its ambition is to make the puzzle vanish entirely. Instead of interrogating you, a lightweight script runs invisible challenges in the background of your browser and hands the server a cryptographic token vouching for you. No crosswalks. No traffic lights. No rage.

The clever — and quietly controversial — bit is how it decides you're real. Turnstile leans on Private Access Tokens, a protocol cooked up with Apple and Google. Rather than quizzing your browser, it asks your device's operating system to cryptographically attest that you are a legitimate human on legitimate hardware. Hold an iPhone or a modern Mac, and the device itself signs a little note of vouching, and you sail through untouched. No cookies harvested, no session snooping — a genuine privacy win.

But notice what just happened. The question "are you a person?" has quietly become "are you holding an approved device?" Developers running automated browsers, niche operating systems, or anything off the blessed path increasingly find themselves bounced at the door with cryptic console errors — and site owners often can't switch the requirement off even if they want to. By teaming with hardware makers to define digital personhood, Cloudflare and Apple have nudged themselves into the role of deciding what counts as a legitimate internet user. It is friendlier than a CAPTCHA. It is also a velvet rope, and someone now holds the list.

The Tollbooth Rebellion

Here is where Cloudflare stops playing defense and goes hunting. Its most aggressive move of the decade wasn't about security at all — it was a frontal assault on how the big cloud providers, Amazon Web Services chief among them, actually make their money.

The weapon of choice in this war is a line item called egress. For more than a decade, the hyperscalers have run a beautifully cynical pricing trick: moving your data into their cloud is free, but moving it back out — to the open internet, or worse, to a competitor — costs a small fortune. The effect is a kind of artificial gravity. Your data gets heavier the longer it sits, until the bill for extracting it is so brutal you simply… stay. Lock-in by invoice. Matthew Prince has a name for the practice: "egregious egress," fees he argues are wildly divorced from what bandwidth actually costs at wholesale.

Cloudflare's counterpunch was R2, an object-storage service built to be a drop-in replacement for Amazon's industry-standard S3 — with one detail that reads like a typo. Egress fees: zero. None. Free.

The math is where it gets violent. On a heavy-traffic workload — streaming media, an AI pipeline constantly shuttling model weights — the egress charges routinely dwarf the cost of the storage itself. One illustrative scenario that would run roughly $29,000 a month on S3, almost all of it bandwidth, lands at around $116 on R2. That is not a discount. That is over 99 percent cheaper, and it is the kind of number that makes a CFO put down their coffee.

Storage is cheap. The exit door is where the bill lives.

R2 is not magic, and honesty demands the caveats. It still charges for the millions of tiny API requests a busy app fires off, and it lacks the deep, frozen archival tiers where AWS still reigns — the digital equivalent of a salt mine for "dark data" you're legally required to keep but will never touch again. For cold storage, Amazon wins on price. But for active, liquid, constantly-moving data — which happens to be exactly the kind the generative-AI economy runs on — Cloudflare has done something genuinely subversive. It has commoditized the floor. And once the floor is free, the whole building has to be rethought.

When the Pegleg Snaps

Every paragraph above is an argument for centralization: faster, safer, cheaper, simpler. And every one of them quietly raises the stakes of a single sentence — what happens when it breaks?

Because it does break. And the truly unnerving discovery, when you autopsy Cloudflare's worst days, is that the nation-state hackers are almost never the culprit. The internet's immune system mostly hurts itself. These are autoimmune disorders, not infections.

The canonical example arrived on November 18, 2025. At 11:20 UTC, Cloudflare's global control plane fell over, and huge swaths of the web greeted users with cold error pages. The cause was almost insultingly mundane: a routine database permissions change caused a config file used by the bot-management system to fill with duplicate entries and balloon to twice its expected size. That bloated file propagated out to edge machines worldwide, blew past a hardcoded memory limit, and the software responsible for routing core traffic simply gave up and crashed.

Because Cloudflare is the coupling between the back-end clouds (yes, including AWS and Google) and the actual humans trying to reach them, the failure cleanly severed the internet's front-end from its back-end. League of Legends went dark. So did OpenAI's endpoints. Downdetector logged over 3.3 million reports. A doubled file took down a meaningful fraction of the planet's internet, and not one villain was involved.

It was not a one-off. A forensic timeline of recent incidents reads like a study in how many ways a globally distributed machine can trip over its own feet:

Mostly self-inflicted. The internet's immune system attacks itself.

The January 2026 episode is the most quietly terrifying, because it exposes how much of the internet still runs on trust and vibes. BGP — Border Gateway Protocol — is the postal service that directs data between the internet's vast networks, and it operates on a system of almost touching naivety: networks largely take each other's word for which routes go where. One automated policy change on one router in Miami, plus a software bug, and that router began cheerfully advertising routes it had no business advertising, leaking them sideways to networks that promptly believed it. It took human engineers about twenty-five minutes to find the bad config, halt the automation, and undo the damage. The internet's postal service can be derailed by a single clerk filing the wrong form.

The Reckoning

For a long time the internet was treated as a kind of weather — an inconvenience when it failed, but nobody's responsibility. That fiction is now dead, and it died in the autumn of 2025.

One month before Cloudflare's November stumble, AWS suffered a historic outage of its own, centered on its US-EAST-1 region in Virginia. A DNS fault hit a foundational database service, the failure cascaded upward through everything built on top of it, and — in the cruelest twist — it knocked out the very login system engineers needed to fix it. Locked out of their own house while it burned. Over 17 million reports rolled in. More than 3,500 companies across 60 countries felt it: UK banks froze, Ring doorbells went mute, Snapchat and Roblox blinked out.

Two catastrophic failures, one month apart, at the two companies holding up the most weight. For governments, the lesson finally landed: this is not a vendor problem. This is critical national infrastructure, and it is dangerously consolidated. The European Union began naming major cloud and edge providers as systemic risks rather than ordinary suppliers under its muscular new Digital Operational Resilience Act — DORA — demanding dependency maps, resilience drills, and post-mortem transparency. The UK rolled out a parallel framework for "critical third parties" whose hiccups could threaten financial stability. The age of light-touch, trust-us infrastructure is over. The pegleg is now regulated as a load-bearing limb, because everyone finally noticed they were standing on it.

The Edge of Intelligence

Strip away the keynote music and the AI story is, for now, mostly a story — the thing holding up the valuation multiple rather than the cash flows beneath it. The pitch is seductive: model inference has replaced training as the live problem, inference hates latency, and Cloudflare happens to own latency-killing real estate in 200-plus cities. Geography as destiny.

The edge case for AI: bring the model to the user, not the user to the model.

But interrogate the economics a skeptic actually cares about. Stuffing pricey NVIDIA silicon into hundreds of edge sites is the opposite of the asset-light model investors once rewarded Cloudflare for — it's capex, and scattered GPUs are far harder to keep busy than one centralized cluster. "Pay-per-inference, the idle GPU costs nothing" is a lovely promise to the customer, which is precisely why the provider eats the idle depreciation. Meanwhile the genuinely heavy AI workloads still want centralized fleets of the newest accelerators — and there Cloudflare is a minnow beside hyperscalers who spend more on chips in a quarter than it spends in years. Workers AI may be elegant. Whether edge inference ever becomes a material, high-margin line — rather than a commodity race to zero against Bedrock, Azure, and a swarm of inference startups — is the question the narrative politely skips.

Memory, Middleware, and the Moat

"Moat" is the bull's favorite word, so it's worth poking. The setup is real enough: because models are frozen at their training cutoff, apps bolt on Retrieval-Augmented Generation — embed the question, search a vector database for matching documents, feed those to the model. Cloudflare obligingly sells every link in that chain — Vectorize for the vectors, R2 for the documents, Workers AI for the compute — stitched so the pipeline never leaves its walls.

A Retrieval-Augmented Generation pipeline, entirely inside one vendor's walls.

The bull calls that lock-in. A critic calls it a bundle of individually commoditizing parts. Vector databases are already in a price war (Pinecone, plain Postgres with pgvector, a dozen others); object storage is a knife fight Cloudflare itself started; managed inference is everywhere you look. Stacking thin commodities does not add up to a thick moat.

The AI Gateway — the supposedly "indispensable middleware" — is the softest spot of all. Semantic caching and automatic failover are features, not franchises: a proxy a customer can rip out in an afternoon, and one the model providers are busy rebuilding in-house. A toll layer keeps its pricing power only as long as the road can't be re-paved around it. Sitting between everyone is a wonderful place to stand — right up until everyone routes around you. The durable asset here was always the network and its distribution; the AI SKUs look less like a moat than like customer-acquisition garnish with unproven margins — yet they're carrying an outsized share of the story the multiple is pricing in.

The Switzerland Problem

Neutrality is sold as a virtue; on a risk register it reads rather differently. "Switzerland of the cloud" means hosting everyone — which means a standing queue of reputational landmines (the recurring "should Cloudflare cut off site X" firestorm), plus subpoenas, government data demands, and takedown fights across a hundred-odd jurisdictions. Each is a legal and PR cost with no matching line of revenue.

Project Galileo: the cost of standing in front of a newsroom.

Project Galileo — free protection for newsrooms and rights groups — is genuinely admirable, and in accounting terms it is also marketing: a cost center that buys goodwill and the heartwarming chart above, not cash flow.

The harder problem is what success does to the multiple. The more critical the infrastructure becomes, the more it gets regulated like infrastructure — Europe's DORA and the UK's critical-third-party regime are early drafts of utility-grade oversight, and utilities trade at utility multiples, not hypergrowth-software ones. "Systemic importance" is a re-rating risk dressed as a badge of honor. And neutrality curdles fastest exactly where the growth story lives: deciding what counts as "harmful" in the AI Gateway, or which models earn a place in the catalog, forces the editorial judgments a neutral toll-keeper isn't supposed to make. There is no neutral filter — only a filter whose values, and liabilities, the market hasn't finished pricing.

Cash, Cuts, and the Endgame

For a company that styles itself as critical infrastructure, the most telling event of 2026 wasn't an outage — it was a memo. In May, alongside record quarterly revenue of roughly $640 million (up 34% year over year), Cloudflare announced the first mass layoff in its sixteen-year history: about 1,100 people, roughly a fifth of the company. The stated culprit wasn't the economy. It was AI. Internal use of AI agents had supposedly jumped 600% in three months, and management framed the cuts as a reshaping of work rather than a retreat — promising, in the same breath, that headcount might be higher again by 2027.

A skeptic notices two things. The restructuring carries $140–150 million in severance charges, which is a peculiar way to not cut costs. And "AI made the jobs obsolete" is a conveniently flattering tale for Wall Street — pin the layoff on a tailwind rather than a headwind — for which analysts already have a name: AI-washing. The market wasn't charmed; the stock dropped around 20% on the announcement and softer near-term guidance.

Is the company actually fragile? Financially, no. Cloudflare sits on roughly $4.1 billion in cash and securities, throws off positive free cash flow (about $84 million last quarter), and still grows the top line near 30% a year. The worry is subtler. Gross margins are sliding — from the high-70s toward the low-70s in percentage terms — exactly as the capex-heavy edge-AI push would predict, even while the company posts GAAP operating losses and trades at a nosebleed revenue multiple (one M&A study pegged it near 27×). That is a price tag for flawless execution of a story whose margins are quietly drifting the wrong way.

Which invites the parlor game: could a Google or a Microsoft simply buy it? Don't hold your breath. Cloudflare has spent the era as an acquirer, not a target, swallowing AI and developer-tooling startups to feed the narrative. And a hyperscaler bid would hit three walls at once. Antitrust regulators would revolt at one cloud giant owning the security layer for a fifth of the web. The "Switzerland of the cloud" brand — its entire trust proposition — evaporates the instant Google owns it. And the check, at tens of billions, is enormous for an asset that competes head-on with every plausible buyer. The likelier future isn't a takeover. It's a still-independent Cloudflare, regulated more like a utility with each passing year, defending a premium multiple until the AI story finally has to show up as profit.

The Weight of the World on a Single Network

Step back and the arc is genuinely staggering. A spam tracker became a content network became a security company became a storage rebel became the runtime for artificial intelligence — each layer funding and physically enabling the next. The CDN paid for the data centers; the data centers held the GPUs; the GPUs became the foundation for edge AI; the free storage removed the last reason to keep your data anywhere else. It is one of the great compounding land-grabs in the history of technology, and it was executed so smoothly that almost nobody noticed it happening.

And yet the triumph and the danger are the same fact, viewed from two angles. When one organization fields two trillion requests a day, proxies 80-odd percent of its market, and shields a quarter of the websites on Earth, its bugs stop being corporate embarrassments and become global events. The outages of late 2025 and early 2026 weren't the work of supervillains. They were a doubled file and a confused router in Miami — the immune system attacking the body it was built to protect.

This is the bargain at the heart of the modern internet, and the heart of this whole series: we have traded a fragile, redundant web we didn't quite trust for a fast, elegant, centralized one we can't quite live without. Cloudflare is the purest example yet of the unknown pegleg — a marvel of engineering so seamless that the world forgets the weight it carries, right up until the morning it doesn't.

We are walking, all of us, at a full sprint, on a leg we've never once looked down at. It has held beautifully so far. The interesting question — the one the regulators in Brussels and London are belatedly asking — is not whether it's strong. It's what happens to a civilization that learned to run before it checked what it was standing on.

Sources & further reading

• Cloudflare Blog — "500 Tbps of capacity: 16 years of scaling our global network"
• Cloudflare Radar — 2025 Year in Review and accompanying blog
• W3Techs — reverse proxy market-share statistics, 2026
• Cloudflare Blog — Pingora and the NGINX-to-Rust migration
• Cloudflare — 2026 Threat Report (Cloudforce One) and press release
• Cloudflare Blog — "Announcing Turnstile" and Private Access Tokens documentation
• Cloudflare R2 vs. AWS S3 pricing comparisons (Cloudflare; third-party analyses)
• Cloudflare Blog — post-mortems for the Nov 18 2025, Dec 5 2025, Aug 21 2025, and Jan 22 2026 incidents; Bleeping Computer on the BGP route leak
• Ookla and Downdetector reporting on the November 2025 outage and the October 2025 AWS US-EAST-1 outage
• Cloudflare press materials on the NVIDIA partnership, Workers AI, Hugging Face integration, Vectorize, and AI Gateway
• Cloudflare — Project Galileo, the CyberPeace Institute partnership, and the 2025 Impact Report
• Cloudflare — Q1 2026 and FY2025 financial results (SEC Form 8-K filings; Businesswire)
• TechCrunch, Fortune, SecurityWeek, and CNBC reporting on the May 2026 AI-attributed layoffs
• CyberArk shareholder M&A study (comparative software revenue multiples); Tracxn on Cloudflare's recent acquisitions (VoidZero/Vite, Human Native, Replicate)