One Cut Fiber. X, Reddit, Teams, Discord, AWS All Down. The Internet's Real Architecture Showed Itself.
- Patrick Duggan
- 5 minutes ago
- 3 min read
June 22, 13:35 UTC. Cloudflare begins reporting elevated error rates — 522 timeouts, latency spikes across North America and Europe simultaneously.
The cause: a fiber cut on Zayo's backbone routes in Eastern North America.
One physical cable. Not a cyberattack. Not a software bug. Not a misconfigured BGP announcement. A cable in the ground that carries internet traffic stopped carrying internet traffic.
What Zayo Is and Why It Matters
Zayo is not a household name. It is one of the largest fiber infrastructure providers in North America — one of the backbone carriers that major networks, including Cloudflare, use for transit between cities and continents. Cloudflare runs its own global network but relies on upstream transit providers to move traffic between regions. Zayo is one of those providers.
When the Zayo routes went down, Cloudflare's ability to route traffic through North American points of presence was degraded. Anything that routes through those POPs — or that reaches European services via North American interconnects — started throwing errors.
The blast radius was not proportional to the cause. A single fiber cut took down:
X — 30,000+ Downdetector reports at peak
Reddit — tens of thousands of reports
Microsoft Teams
Discord
Zoom
Canva
AWS edge services
Most services recovered within 20 minutes of peak degradation. Cloudflare marked the incident fully resolved at 21:22 UTC — about eight hours after the cut, suggesting secondary cleanup work after the physical repair.
The Architecture Problem This Exposed
The internet was designed to route around damage. The original ARPANET thesis was that a decentralized network could survive node failures by finding alternate paths. That thesis is technically still true — BGP exists, alternate routes exist.
But the practical internet in 2026 is not the decentralized network the architecture promised. It is a small number of hyperscalers and backbone carriers handling a disproportionate share of global traffic. Cloudflare alone handles a significant fraction of internet requests. Zayo carries a significant fraction of North American backbone transit. When one layer in that stack fails, the redundancy that theoretically exists in the protocol is not sufficient to absorb the traffic volume fast enough.
The result is that a physical cable — the most analog possible infrastructure failure, a thing that gets cut by construction equipment or corroded by moisture or snapped by seismic activity — can produce an outage that registers across tens of millions of users within minutes.
Physical Infrastructure as the Attack Surface Nobody Talks About
The cybersecurity industry spends enormous energy on software vulnerabilities, credential theft, ransomware, supply chain attacks. Physical infrastructure is rarely in the conversation.
It should be. Submarine cables get cut with some regularity — accidentally by anchors and trawling equipment, occasionally by ships dragging anchors deliberately. Terrestrial fiber runs near roads, under rivers, through conduit that ages. Data centers sit in buildings with power feeds and cooling systems that fail. The physical layer is the foundation everything else runs on, and it is not as redundant as the software layer makes it appear to be.
A nation-state or sophisticated criminal actor who wanted to cause maximum disruption with minimum technical sophistication could accomplish a great deal with a backhoe and some reconnaissance of where major fiber routes run. That information is not classified. Much of it is publicly available in permit filings and infrastructure records.
Our Exposure
Our STIX feed analytics showed June 22 at 6,695 requests — slightly lower than surrounding days, consistent with brief degradation rather than a complete outage. The analytics dashboard and Meilisearch sit on Azure in Central US, behind Cloudflare. We felt the event but weren't knocked out.
The reason: our critical path is relatively simple. Feed consumers pull from analytics.dugganusa.com, which resolves through Cloudflare. When Cloudflare's North American routing degraded, some of those pulls would have failed or timed out. The 45-minute window of peak degradation was narrow enough that it showed as a dip, not a gap.
For organizations whose operations run entirely through Cloudflare-fronted services with no fallback, the 45 minutes was material.
The Unsexy Lesson
The most sophisticated threat intelligence in the world doesn't help if the infrastructure it rides on goes down because a cable got cut.
Resilience isn't just detection and response. It's architecture that survives the boring failures — the physical ones, the power ones, the vendor ones — as well as the adversarial ones. The June 22 incident was a reminder that the attack surface includes the ground the cables run through.
Sources: LatestLY — fiber cut details — The National — X, Reddit, Teams down — Windows News — 522 errors
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.