crackthe.netDeutsch
Menu

Security & Privacy

The vulnerabilities that crack the net.

Some vulnerabilities hit large parts of the internet at once and put security and privacy at risk. This timeline shows the biggest, chosen by fixed criteria. Each case shows what happened, how far it reached, and what to do now.

  1. [ 01 ] SCAN every case that meets the criteria
  2. [ OK ] FOUND 20 vulnerabilities · 32 attacks on IT and ICS · 2001 → 2026
  3. [INFO] WORST highest CVSS score 10.0: Code Red, Conficker, Log4Shell
  4. [ NOW] LATEST PHP2Shell (2026) · CVSS 9.8
  5. [ OK ] RESULT timeline below

Vulnerability timeline

  1. Current: fix released, update now

    PHP2Shell

    PHP, the language behind most websitesCVSS 9.8

    Two flaws in PHP itself let attackers take over web servers without a password, on WordPress, Drupal, Joomla and many other applications.

    69.3 % of websites with a known server language run on PHP

    What to do now: Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer, depending on your branch.

  2. MOVEit Transfer

    Progress MOVEit Transfer, a server for exchanging files with partnersCVSS 9.8

    The Cl0p gang used an unknown flaw in the MOVEit Transfer file server to steal data from 2,773 organizations.

    95.8 million people whose data was affected, according to breach notices (Emsisoft)

  3. Log4Shell

    Apache Log4j 2, a logging library for Java programsCVSS 10.0

    One line of text in a log was enough to make servers run attackers' code, through a Java library that 35,863 packages depended on.

    35,863 Java packages on Maven Central used the flawed code, more than 8 % of all (Google)

  4. ProxyLogon

    Microsoft Exchange Server 2013, 2016 and 2019, run on an organization's own serversCVSS 9.8

    Four flaws in Microsoft Exchange let attackers read mailboxes and take over mail servers without a password, two months before a fix existed.

    400,000 Exchange servers at risk the day before the fix (nearly that many; not all were hacked)

  5. Citrix ADC

    Citrix ADC and Citrix Gateway (today again called NetScaler), devices for remote access to internal networksCVSS 9.8

    A flaw in Citrix's remote access gateways let anyone on the internet take them over without a password. For 33 days, only a workaround existed.

    128,777 vulnerable servers worldwide in December 2019 (estimate from a scan; DIVD)

  6. Exim

    Exim, a mail server for Linux and Unix systemsCVSS 9.8

    A flaw in the Exim mail server let attackers run commands as root by writing them into an email address. Within days, a worm spread through it.

    4.1 million systems showed a vulnerable Exim version in Shodan search results in June 2019 (more than; Tenable data)

  7. MikroTik Winbox

    MikroTik RouterOS, the operating system of MikroTik routers, through its Winbox management serviceCVSS 9.1

    A flaw in the Winbox service of MikroTik routers let anyone download the administrators' passwords. Months after the fix, attackers had hijacked more than 200,000 routers.

    370,000 MikroTik devices were still vulnerable four months after the fix (Netlab 360)

  8. Meltdown

    Most Intel processors and a few ARM-based designsCVSS 5.6

    A design flaw in most Intel processors let any program read the operating system's protected memory; operating-system updates closed the hole.

    3.2–503 kilobytes per second: how fast an ordinary program read kernel memory, depending on the machine

  9. Spectre

    Processors from Intel, AMD and Arm, in billions of devicesCVSS 5.6

    A design flaw in almost all modern processors let programs read memory they should not see, on desktops, laptops, servers and smartphones.

    45 Windows editions needed patches; 41 had them six days after disclosure

  10. NotPetya

    Windows networks, reached through the Ukrainian accounting software M.E.DocCVSS 8.8

    A worm posing as ransomware came through a hijacked software update, destroyed data in Ukraine and 64 more countries, and cost billions of dollars.

    200–300 million US dollars in costs expected by the shipping group Maersk alone (press report)

  11. WannaCry

    Windows computers with the old file-sharing protocol SMBv1CVSS 8.8

    A ransomware worm used a leaked NSA tool and a Windows flaw to hit more than 200,000 computers, and it disrupted hospitals in England.

    200,000+ computers hit in at least 100 countries

  12. Shellshock

    GNU Bash, the command shell of Linux, Unix and macOSCVSS 9.8

    A flaw in Bash, the command shell of Linux and macOS, let attackers run commands on web servers with a single crafted request.

    63.2 % of websites with a known operating system run on Linux today, where Bash is part of the system

  13. Heartbleed

    OpenSSL, the encryption software behind many HTTPS serversCVSS 7.5

    A missing check in OpenSSL let attackers read pieces of server memory, from passwords to private keys, without leaving a trace in normal logs.

    24–55 % of HTTPS servers among the top million websites were vulnerable at first

  14. NTP monlist

    ntpd, the time server software of the NTP project, and devices that use itCVSS 5.0

    A diagnostic command in NTP time servers answered a tiny request with a list of up to 600 addresses. This let attackers with forged sender addresses use more than a million servers as amplifiers for DDoS attacks.

    2,166,097 different addresses of vulnerable NTP servers in 15 weeks of scans

  15. Conficker

    Microsoft Windows, Server serviceCVSS 10.0

    A Windows worm looked for updates at up to 50,000 new domain names a day. Defenders in over 100 countries worked together to block them.

    5–13 million computers infected one year after the outbreak

  16. Kaminsky DNS

    DNS resolvers such as BIND and Windows DNS, which look up internet addresses for usersCVSS 6.8

    A weakness in the DNS let attackers plant false addresses for any domain in a resolver's cache within seconds. They could then send the resolver's users to servers of their choice.

    57 % of 0.9 million open resolvers still sent every query from the same port months after the fixes

  17. Blaster

    Windows NT 4.0, 2000, XP and Server 2003, through the RPC service that runs by defaultCVSS 7.5

    Through a flaw in a Windows service that runs by default, a worm infected more than 100,000 computers in a week. A year later, it was still spreading.

    100,000+ Windows computers infected in the first week

  18. SQL Slammer

    Microsoft SQL Server 2000 and MSDE 2000 databasesCVSS 7.5

    A worm of just 376 bytes spread a hundred times faster than Code Red and flooded networks with its traffic.

    10 min to infect more than 90 % of vulnerable servers

  19. Nimda

    Microsoft IIS web servers, and Windows computers with Internet Explorer 5.01 or 5.5CVSS 7.5

    A worm attacked Microsoft's web servers and Windows PCs by five routes at once, from e-mail to backdoors left by CodeRedII. It infected 160,000 computers within seven hours.

    160,000 computers infected at the peak, 7 hours after the outbreak began

  20. Code Red

    Microsoft IIS web serversCVSS 10.0

    A self-spreading worm used a flaw in Microsoft's web server software IIS, a month after Microsoft had published the fix.

    359,104 computers infected in less than 14 hours

How a vulnerability gets on this listAll vulnerabilities with their records

The biggest IT attacks

The biggest ICS attacks

How an attack gets on this listAll attacks with their figures

Security & Privacy

Tools and guides that help, and what the archive measures.

Security

Privacy

Tools

Learn