Starting around 7:30 PM PT on March 5th, 2025, the Craft Cloud tender-newton MySQL database cluster in the United States region suffered performance degradation issues.

After investigating, we found that it was a DDOS attack on some sites on that cluster originating from China.

The attack bypassed our firewall rules as Cloudflare misclassified this traffic as legitimate.

We were able to mitigate this attack after 45 minutes and services were back to normal around 8:15 PM PT.

We’ve strengthened our rules to prevent this sort of attack in the future and will continue to monitor incoming traffic.