Cloud Survey: August 2026

AI-driven RAM inflation is repricing European bare metal, a CVSS 10.0 hit the cloud identity plane, and GitHub had two bad days.

The number that mattered most in August is a RAM price. OVHcloud announced a second wave of price increases effective September 1: 2026-generation dedicated servers rise about 51 percent on average, gaming servers up to 87 percent, with founder Octave Klaba pointing at AI-driven component inflation (RAM 6x more expensive than a year ago, projected at 9x by September) [1][2]. The AI boom is no longer just about GPU scarcity. It is repricing ordinary infrastructure.

The reliability picture was noisy rather than catastrophic. No global mega-outage, but density: GitHub down worldwide for 7 hours 47 minutes on August 17 [3], regional failures at all three hyperscalers, and unusually busy status pages across the European providers. ThousandEyes' weekly outage counts stayed at baseline: a normally noisy internet [4]. Security was louder than reliability: a self-propagating worm in npm and a CVSS 10.0 flaw in Entra ID made the supply chain and the identity plane the month's real risk surface [5][6].

Regulation kept moving under the surface: France anchored SecNumCloud 3.2 in the Journal officiel, the EU's Cloud and AI Development Act consultation closes August 27, and the AI Act's transparency obligations became enforceable on August 2.

Key takeaways

OVHcloud reprices hard: +51 percent average on 2026-generation dedicated servers, up to +87 percent on gaming, from September 1. Current rates can be locked for up to 48 months by prepaying before October 1 [1][2]. If you run European bare metal anywhere, price a lock this week.
Hetzner has been refusing new cloud server provisioning for new customers and randomly selected existing ones since June 26, citing component shortages, and the restriction was still active at the cutoff [7]. If Hetzner is your provider, or your fallback plan, that is a capacity risk, not just a price risk.
August 17 was the month's worst day for CI/CD: GitHub down worldwide for nearly 8 hours, cascading into CircleCI [3]. Mitigations for small teams are in the Security section; the short version: cache your dependencies, and keep one deploy path that does not transit GitHub.
The ChainDrop worm compromised keyv, cacheable and more than 400 npm packages starting August 4 [5][8], days after the registries shipped new supply-chain defenses: GitHub's Dependabot cooldown and PyPI's block on file uploads to old releases got their first real test [9].
Kubernetes v1.37, scheduled for August 26, deprecates kube-proxy IPVS mode and continues the cgroup v1 phase-out [10]. If your clusters still rely on either, that is a migration task with a date on it, not trivia.
Microsoft Foundry puts a price premium on EU Data Zone model deployments: 9 percent above Global pricing from September 1, announced July 9 [11][12].
Regulation moved on two fronts: SecNumCloud 3.2 entered into force August 15, so vendor self-claims no longer suffice for sensitive French state data [13][14], and the EU Cloud and AI Development Act consultation closes August 27 [15].

Incidents: hyperscalers

AWS had three distinct events worth a CTO's attention. On August 4, us-west-2 lost external connectivity for about 20 minutes on the same Oregon-Seattle network path blamed for the July 24 outage, the fourth AWS reliability incident since May; AWS did not say whether the two failures share a root cause [16][17]. In Frankfurt, water ingress at the Equinix FR5 colocation site took down Direct Connect equipment for roughly three days (August 15 to 18), an account that rests on AWS's support channel and outage trackers rather than a published post-event summary [18][19]. Customers with circuits only at FR5 ate sustained packet loss to eu-central-1; customers with redundant locations noticed nothing. In London, the freshly launched euw2-az4 availability zone shipped with a default-VPC defect that produced elevated EC2 launch errors for about 18 hours; AWS acknowledged it in a status notice picked up by third-party trackers, but has published no post-event summary [20]. A day-one defect in a day-one AZ.

Google Cloud's turn came on August 20: scheduled fiber maintenance in us-west1 went wrong, automated rerouting failed, and some 26 services (Compute Engine, GKE, Cloud Storage, BigQuery, Cloud SQL and more) degraded for up to roughly three hours [21]. Australia had a rough stretch: the Melbourne region australia-southeast2 went down for about 12 hours on August 17, one month after commercial launch [22], and a Google Workspace disruption on August 19 ran for hours while Google's own dashboard stayed green, with confirmation coming only late in the incident [23]. The transferable lesson is not the incident list, it is the dashboard: provider status pages are a lagging indicator, and the only monitoring you can trust during an incident is your own.

Azure's Southeast Asia region suffered a power-related failure on August 25 that disrupted Storage (about 25 minutes) and Virtual Network (about 2.5 hours), per third-party status trackers; as of the cutoff a residual single-stamp issue remained open and Microsoft had published no post-incident review [24]. On August 26, maintenance activity degraded Teams meetings across Asia-Pacific for about 30 minutes [25].

Incidents: European providers

OVHcloud had the busiest month. A major Cloud Databases incident starting August 25 hit 58 components (Kafka, OpenSearch, ClickHouse and their dashboards) across 11 regions and was still open at the cutoff [26]. Strasbourg Object Storage returned intermittent 503s for about 25 hours (August 17 to 18), Paris object storage had degraded stretches earlier in the month, and Gravelines compute went down for about an hour across six regions on August 25 [26]. Email was worse: MX Plan took three hardware-failure hits (two global outages, about 30 minutes on August 10 and about 1.5 hours on August 16, plus a roughly 4.5-hour disruption confined to one Gravelines mail server), and Zimbra logged three incidents, the last opening on August 26 and resolving the same day [27].

Scaleway's headline issue: after a faulty deployment on August 20, routes stopped being advertised on site-to-site VPN gateways in fr-par, still in monitoring on August 26. Around it, a dense series of short incidents: serverless outages, Edge 503s, an it-mil API unavailability, pl-waw object storage latency, and a Cockpit degradation open since August 11 [28].

Hetzner's Nuremberg Object Storage incident on August 25 put stored data at risk; Hetzner says integrity and redundancy are restored, with performance degraded during online recovery. It capped recurring object storage degradations in fsn1 and hel1 through the month, plus an intermittent Frankfurt-Helsinki backbone fault open since August 21 [29].

Elsewhere: Infomaniak's web hosting was disrupted for about 10 hours on August 20 [30]; UpCloud's Frankfurt zone lost cloud servers to a storage backend problem for roughly 7 hours overnight on August 25 to 26 [31]; IONOS logged rolling incidents across two weeks (WordPress hosting, Control Center login, Cloud VPS), and while its website-unavailability incident resolved mid-afternoon on August 26, degraded webmail was still unresolved at month end [32]. Exoscale: scheduled maintenance only [33]. A genuinely quiet month.

One pattern in that log deserves more attention than any single incident: object storage failed at four independent European providers in the same month. OVHcloud Strasbourg served 503s for a day, Hetzner Nuremberg had data at risk, Scaleway pl-waw saw latency spikes twice, UpCloud Frankfurt lost a storage backend for seven hours. Different root causes, same layer. If your architecture assumes object storage is always on, August is the argument for replicating anything you cannot re-derive to a second provider, and for knowing what your stack actually does during a multi-hour 503 stretch. The month's other repeat offenders, the identity plane and the CI/CD chain, get their own section below.

Pricing and product moves

Beyond OVHcloud's headline percentages: savings plans are restructured (only 12- and 36-month terms survive, with locked pricing), while a separate prepayment mechanism, a 12-, 24- or 48-month upfront renewal on eligible existing servers before October 1, is what locks current rates for up to 48 months. From October 1, storage and IPv4 also become separate line items on Gen3 Public Cloud instances [1][2]. Klaba's stated drivers: RAM heading to 12x by early 2027, NVMe up 7x, HDDs up 3.5x [1]. If those projections hold, this is not the last wave.

It is already not only OVHcloud's problem. Hetzner has been restricting creation of new cloud servers for new and randomly selected existing customers since June 26, citing hardware component shortages, and the restriction was still active through August [7]. That follows three price rises earlier in 2026 [34]: some VPS prices tripled [35], and the 128 GB RAM add-on went from 45.88 to 264 euros, a 5.75x jump (roughly a 475 percent increase) [36]. Read in that order, OVHcloud's September wave is the second European domino, not the first.

Klaba is also the person with the strongest incentive to dramatize these numbers, so check them against an independent yardstick. TrendForce's data points the same way: German retail DDR5 prices sat at nearly 5x their year-ago level in mid-August, TrendForce's own quarterly contract-price rises compound to roughly 5x since mid-2025, and server DRAM contracts are up another 13 to 18 percent quarter over quarter in Q3 [37][38]. So the 6x figure is the aggressive end of a real trend, not an invention; the 9x and 12x figures are projections, not measurements. The same TrendForce report also explains why none of the big three moved general-purpose VM list prices in August: long-term supply agreements cap the increases memory makers can push through to the largest buyers [38], so the pressure surfaces where contracts do not shield them (GPU reservations, AI model pricing), and hyperscalers can absorb the rest longer than any bare-metal provider can. The practical read: if you run European bare metal anywhere, price a 12-to-36-month commitment now, with OVHcloud's prepay deadline on October 1, and budget 2027 on the assumption that this inflation reaches hyperscaler managed services with a lag, not never. To see what current list prices mean for your own workload across this roster, our cost calculator runs the comparison live.

Hyperscalers answered with capacity rather than discounts. AWS added a fourth London availability zone carrying Trainium3 and P6 accelerated instances [39], after raising EC2 Capacity Blocks prices about 20 percent in July, the second GPU-capacity hike in six months [40][41]. Microsoft opened India South Central in Hyderabad, its fourth Indian region [42]. Microsoft Foundry announced (July 9) model-deployment price increases effective September 1: EU Data Zone deployments move to 9 percent above Global pricing, non-US regional deployments to 7 to 16 percent above [11][12]. A priced premium on EU Data Zone deployments for frontier models is a market signal worth watching. Google Cloud extended Flex Committed Use Discounts to L4 and RTX Pro 6000 GPU VMs, a discounting move rather than a price change [43].

On the European side: Infomaniak's planned listing on the SIX Swiss Exchange via a reverse takeover of Perrot Duval, announced in late July, progressed toward the September 24 shareholder vote, with a prospectus expected around September 2 and the Infomaniak Foundation keeping majority voting rights [44][45]. IONOS reported a record H1 (701.1 million euros revenue, up 6.9 percent, cloud as the growth engine) [46]. Exoscale launched Managed ClickHouse [47].

Sovereignty and regulation

France finished the job. The Prime Minister signed the arrêté approving SecNumCloud 3.2 on August 12; it was published in the Journal officiel on August 14 and entered into force August 15 [13][14]. Conformity for sensitive state data is now attested by ANSSI qualification or an equivalent EU certification; administrations and their subcontracting chains must verify that the qualification matches the deployed architecture and that data sits out of reach of third-country authorities. The nine ANSSI-qualified providers are now the only compliant options for sensitive state data.

On August 3 the EU General Court rejected Broadcom's bid to block a Commission document request in the VMware antitrust probe, holding that US in-house privilege does not apply under EU law; the investigation into VMware licensing proceeds with full discovery [48]. Our account rests on press coverage, not the order text itself. For VMware licensees the practical stake is thin for now: formal probes run for years, August's order only settles that discovery proceeds, and nothing here changes renewal pricing or timelines in the near term. The Cloud and AI Development Act consultation, with its four-level sovereignty assurance framework and a target of tripling EU data centre capacity, closes August 27 [15]. AI Act transparency obligations (deepfake labelling, disclosure of AI interaction) became applicable August 2, with penalties up to 15 million euros or 3 percent of global turnover [49]. And AWS quietly added outbound IAM identity federation to its European Sovereign Cloud, one more feature-parity step in its argument that sovereignty does not require leaving the ecosystem [50].

Synergy's Q2 numbers give the backdrop: cloud infrastructure revenue reached 143.4 billion dollars, up 43 percent year over year, the fastest growth in eight years, with Amazon at 28 percent, Microsoft 20 percent and Google 15 percent [51]. The sovereignty push has not dented the big three's 63 percent. Whether SecNumCloud 3.2 and the Cloud and AI Act change that will show up in these numbers over the next year or two.

Security and the DevOps ecosystem

August was worm month. On August 4 at 9:00 UTC, a compromised maintainer account began seeding malicious versions of keyv, and a self-propagating Shai-Hulud variant dubbed ChainDrop spread to more than 400 npm packages and more than 1,300 versions, harvesting cloud and CI credentials, planting persistence, and exfiltrating to attacker GitHub repos [5][8]. To check exposure: Wiz maintains the authoritative affected-package and version list [5]; diff your lockfile history against it for anything installed from August 4 onward (npm ls keyv cacheable is a fast first pass), and if a listed version appears, rotate every credential the build could see. Takedowns rolled out package by package, so do not assume a clean end date for the window. The registries' new defenses are the useful part, and they predate the worm: GitHub's Dependabot default 3-day cooldown on non-security version bumps and PyPI's block on new file uploads to releases older than 14 days shipped in response to last year's worm wave [9]. ChainDrop was their first real test. Enable the cooldown. It is nearly free.

The month's most severe disclosed flaw was not in a registry but in the cloud identity plane. In late August, Microsoft disclosed CVE-2026-69836, a maximum-severity CVSS 10.0 unauthenticated remote code execution flaw in Entra ID (deserialization of untrusted data), alongside CVE-2026-59115, a CVSS 9.9 privilege escalation in the Entra Provisioning Service patched in the August Patch Tuesday cycle [6][52]. Both were fully mitigated server-side by Microsoft, with no customer action required. Initial reports said the 10.0 had been exploited in the wild; Microsoft corrected that on August 24 [53]. A maximum-severity bug in the identity layer fronting most enterprise clouds, fixed before customers could act on it: the managed model working as designed, and a measure of how much trust it consumes.

Entra tenants took a second, unrelated hit. A threat actor advertised roughly 3.6 million records claimed stolen from the Azure and Entra tenants of Fortune 500 firms (McDonald's, Gap, Vodafone, TCS, HCL, IHG, Kyndryl among them), including a dump of about 1.7 million McDonald's employee records posted around August 16 [54][55]. The evidence points to infostealer-harvested credentials, not a platform vulnerability. The fix is unglamorous: credential hygiene and conditional access.

GitHub itself had a bad month: the August 17 global outage (7h47, a load balancer that failed to scale at a new traffic peak, recovery delayed by a VS Code retry storm) [3], plus roughly 10 hours of degraded Actions and Pages on August 6 [56]. For a small team the mitigations are cheap and specific. Run a pull-through cache for dependencies and container images, so a registry or GitHub loss does not stop builds. Keep one emergency deploy path that needs only your artifact registry, not GitHub Actions. And note what the retry storm implies: your own clients' retry policies are part of someone else's blast radius, so put exponential backoff on anything that polls GitHub. Docker Hub had a roughly 7-hour incident affecting Docker Hardened Images builds the same day as the big outage (third-party trackers only; no official notice) [57]. GitLab shipped an emergency patch for CVE-2026-19478 (CVSS 9.4, unauthenticated modification of public projects via GraphQL), its second patch cycle in five days [58]. August research scoped the March LiteLLM PyPI compromise to potential exposure at more than 2,500 organizations; if you ran the poisoned builds, your secrets are not yours [59][60]. Kubernetes v1.37 is scheduled to land August 26, our cutoff day, with 16 features graduating to stable and notable deprecations (IPVS mode, cgroup v1); at press time that is the release team's schedule, not a shipped release [10].

Cross-cutting infrastructure

Cloudflare logged 13 incidents in 8 days (August 7 to 14): R2, Workers KV, Durable Objects, Magic Transit and regional 5xx spikes. Broad but mostly shallow, with one exception: an August 12 email-delivery disruption caused by a Spamhaus listing of Cloudflare IPs was rated major, though resolved in about two hours [61][62]. No consolidated postmortem. Two subsea cables off Perth (INDIGO West and INDIGO Central) suffered shunt faults in close succession inside a protected zone, with the Australian Federal Police assessing a possible-sabotage report [63]. Namecheap took roughly 30 hours to fully restore service after a storm killed cooling at its Phoenix data center, with its main site down nearly 12 hours; authoritative DNS lived in the same building, so sites hosted elsewhere went dark too (single source) [64]. The failure that mattered was keeping authoritative DNS under the same roof as everything else. Tier-1 carrier Arelion had two short multi-region outages (August 14 and 21), the second touching customers in about 30 countries [4].

Provider watch

Provider	August 2026
OVHcloud	+51 percent avg on 2026-gen dedicated (up to +87 percent gaming) from Sept 1 [1]; major database, storage, compute and email incidents, the Cloud Databases incident still open at the cutoff [26][27]
Scaleway	fr-par VPN route advertisement broken since Aug 20, still monitoring; dense series of short incidents across three regions [28]
Hetzner	NBG Object Storage data-integrity incident; recurring storage degradations; FRA-HEL backbone fault open [29]; new-server provisioning still restricted amid component shortages, after three 2026 price rises [7][34]
Infomaniak	SIX listing (announced late July) progressing toward Sept 24 vote [44][45]; ~10h web hosting disruption Aug 20 [30]
Exoscale	Quiet month [33]; launched Managed ClickHouse [47]
UpCloud	~7h Frankfurt storage backend incident Aug 25-26; otherwise minor incidents and planned maintenance [31]
IONOS	Record H1 results [46]; rolling hosting and email incidents, webmail degradation unresolved at month end [32]
AWS	Repeat us-west-2 connectivity failure [16]; 3-day Frankfurt Direct Connect degradation [18]; London AZ day-one defect (status notice only; no post-event summary) [20]; fourth London AZ launched [39]
Microsoft Azure	Entra ID CVSS 10.0 patched server-side [6]; claimed 3.6M-record tenant data-theft campaign [54]; Southeast Asia power incident [24]; Hyderabad region opened [42]; Foundry EU price rise from Sept 1 [11]
Google Cloud	us-west1 multi-service outage [21]; Melbourne down 12h one month post-launch [22]; Flex CUDs extended to inference GPUs [43]

Method

We reviewed provider status pages and machine-readable feeds (OVHcloud Statuspage APIs, Scaleway, Hetzner, UpCloud, Exoscale, Infomaniak, IONOS, Cloudflare, GitHub), official announcements, regulatory texts and press coverage, for events between August 1 and the August 26 cutoff. The roster is the ten providers of our sovereignty map: seven European providers (companies headquartered in Europe, running their own datacenters; we do not re-audit ownership structures monthly) and the three US hyperscalers, plus the shared infrastructure between them; incidents outside that roster (for example at Asian regional providers) are not covered. Several incidents were still open at press time; where a same-day resolution was visible before publication, we say so. Where a number cannot be known, we say so instead of guessing: weakly sourced claims are tagged inline as (single source) or (third-party trackers only; no official notice). Two circulating stories were excluded outright: a supposed AWS and Google Cloud multicloud egress-abolition pact, because no primary source exists, and one tracker's count of six Australian cloud incidents in a week, because we could not verify it against primary sources. Quiet is a finding too: Exoscale's empty incident log is reported with the same confidence as OVHcloud's full one.