On July 2, 2019, at 13:42 UTC, one new firewall rule went live on every Cloudflare server at once. It contained a regular expression that backtracked so hard it pushed every CPU core serving HTTP to 100 %, and for 27 minutes the sites behind Cloudflare returned 502 errors. The Cloudflare outage was not an attack; it was a regex, a missing CPU guard and a rollout with one speed. The postmortem by CTO John Graham-Cumming is still one of the best ever published, and the bug in it is one you can w...