“For a sense of scale, this two minute attack generated more requests than the total number of article views reported by Wikipedia during the entire month of September 2023.”
The attack peaked at 398 million requests per second, 7.5 times last year’s record of 46 million. It abuses stream multiplexing, a core feature of HTTP/2, and is tracked as CVE-2023-44487. Google absorbed it because it owns enormous edge capacity. Everyone else running an HTTP/2 server gets a patch notice and a pitch for Cloud Armor.