Explainer · 21 October 2026 · 117 views

Can a software flaw take the internet down?

هذا المقال باللغة الإنجليزية.

Ten years ago today, on 21 October 2016, a flood of junk traffic from hacked cameras and video recorders hit Dyn, a company that answers DNS lookups for big websites. For hours, Twitter, Netflix, Reddit, GitHub and many others were unreachable for large parts of North America and Europe. It is the best-known example of a security problem turning into an outage, but it is not the only way it happens.

Three ways a flaw becomes an outage

1. A worm clogs the network

Malware that copies itself from machine to machine can create so much traffic that networks choke, even when it does nothing else.

2. Hacked machines are used as a weapon

Taken-over devices are joined into botnets and rented out for DDoS attacks: so much traffic aimed at one target that it falls over.

3. The network gear itself breaks

A flaw in routers, modems or the routing system can switch off connections directly, by crashing devices or wiping them.

When it happened

More stories like these in our retrospectives: the day Pakistan took YouTube offline, Rogers 2022 and West Africa's cable cuts.

1988, the Morris worm Spread through flaws in common Unix programs and weak passwords. It is usually estimated to have hit around 6,000 computers, a large share of the internet of the time, and slowed many of them to a halt.
2003, SQL Slammer A tiny worm that exploited a Microsoft SQL Server flaw that had been fixed six months earlier. It infected about 75,000 servers, most of them within ten minutes. South Korea lost most of its internet access for hours, and cash machines and airline systems in the US went down with it.
2016, Mirai Not even a bug: hundreds of thousands of cameras and recorders still had their factory passwords. The botnet hit Dyn on 21 October, and in November attacks on Lonestar, a mobile operator in Liberia, disrupted internet access there. In 2019 a British man pleaded guilty to the Lonestar attacks.
2018, VPNFilter Malware found on about 500,000 home and office routers in 54 countries, with a built-in command to make them unusable. It was taken apart before it was used on a large scale.
2022, KA-SAT At the start of the invasion of Ukraine, attackers got in through a misconfigured VPN device at the satellite operator and sent a command that wiped tens of thousands of satellite modems across Europe. Thousands of wind turbines in Germany lost their remote connection.

Some of the biggest outages had nothing to do with attacks: Facebook's six hours offline in October 2021 came from a mistake in its own network settings, and the CrowdStrike crash of July 2024 from a faulty update. To the people cut off, they look exactly the same.

إعلان احصل على Proton VPN اليوم

Most flaws never cause an outage

Most attackers want the opposite: a quiet machine they can use for months, to steal data or send spam. A web server hacked through a flaw like PHP2Shell usually keeps running normally. That is why a flaw can be extremely serious and still invisible on an outage map.

What Blackout Map can and cannot see

We can see

A country or region losing its connection, whatever the cause: our probes check about 4,000 hosts every five minutes, and IODA (Georgia Tech) watches routing and reachability.
DDoS attacks aimed at a country, as Cloudflare Radar sees them, and where scans come from (SANS ISC).
Route hijacks and leaks, when a network wrongly announces addresses that belong to someone else.

We cannot see

Hacked servers that keep working, stolen data, defaced sites.
One website or service going down while the network around it is fine.
Who is behind an outage. We show what happened, not why.

To follow the security side, we have added a Security watch: alerts on flaws that put a large part of the internet at risk, newly exploited flaws from CISA's catalogue, and how much scanning hits web servers every day.