crackthe.netDeutsch

Data · Privacy · Security

The vulnerabilities that crack the net.

Some vulnerabilities hit the whole internet at once. This timeline shows the biggest since 1995, chosen by fixed criteria: what happened, how far it reached, and what to do now.

The biggest vulnerabilities, newest first

  1. Current: fix released, update now

    PHP2Shell

    PHP, the language behind most websitesCVSS 9.8

    Two flaws in PHP itself let attackers take over web servers without a password, on WordPress, Drupal, Joomla and many other applications.

    69.3 % of websites with a known server language run on PHP

    What to do now: Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer, depending on your branch.

  2. MOVEit Transfer

    Progress MOVEit Transfer, a server for exchanging files with partnersCVSS 9.8

    The Cl0p gang used an unknown flaw in the MOVEit Transfer file server to steal data from 2,773 organizations.

    95.8 million people whose data was affected, according to breach notices (Emsisoft)

  3. Log4Shell

    Apache Log4j 2, a logging library for Java programsCVSS 10.0

    One line of text in a log was enough to make servers run attackers' code, through a Java library that 35,863 packages depended on.

    35,863 Java packages on Maven Central used the flawed code, more than 8 % of all (Google)

  4. ProxyLogon

    Microsoft Exchange Server 2013, 2016 and 2019, run on an organization's own serversCVSS 9.8

    Four flaws in Microsoft Exchange let attackers read mailboxes and take over mail servers without a password, two months before a fix existed.

    400,000 Exchange servers at risk the day before the fix (nearly that many; not all were hacked)

  5. Meltdown

    Most Intel processors, and a few ARM-based designsCVSS 5.6

    A design flaw in most Intel processors let any program read the operating system's protected memory; operating-system updates closed the hole.

    3.2–503 kilobytes per second: how fast an ordinary program read kernel memory, depending on the machine

  6. Spectre

    Processors from Intel, AMD and Arm, in billions of devicesCVSS 5.6

    A design flaw in almost all modern processors let programs read memory they should not see, on desktops, laptops, servers and smartphones.

    45 Windows editions needed patches; 41 had them six days after disclosure

  7. NotPetya

    Windows networks, reached through the Ukrainian accounting software M.E.DocCVSS 8.8

    A worm posing as ransomware came through a hijacked software update, destroyed data in Ukraine and 64 more countries, and cost billions of dollars.

    200–300 million US dollars in costs expected by the shipping group Maersk alone (press report)

  8. WannaCry

    Windows computers with the old file-sharing protocol SMBv1CVSS 8.8

    A ransomware worm used a leaked NSA tool and a Windows flaw to hit more than 200,000 computers, and it disrupted hospitals in England.

    200,000+ computers hit in at least 100 countries

  9. Shellshock

    GNU Bash, the command shell of Linux, Unix and macOSCVSS 9.8

    A flaw in Bash, the command shell of Linux and macOS, let attackers run commands on web servers with a single crafted request.

    63.2 % of websites with a known operating system run on Linux today, where Bash is part of the system

  10. Heartbleed

    OpenSSL, the encryption software behind many HTTPS serversCVSS 7.5

    A missing check in OpenSSL let attackers read pieces of server memory, from passwords to private keys, without leaving a trace in normal logs.

    24–55 % of HTTPS servers among the top million websites were vulnerable at first

  11. Conficker

    Microsoft Windows, Server serviceCVSS 10.0

    A Windows worm looked for updates at up to 50,000 new domain names a day, which defenders in over 100 countries worked together to block.

    5–13 million computers infected one year after the outbreak

  12. SQL Slammer

    Microsoft SQL Server 2000 and MSDE 2000 databasesCVSS 7.5

    A worm of just 376 bytes spread a hundred times faster than Code Red and flooded networks with its traffic.

    10 min to infect more than 90 % of vulnerable servers

  13. Code Red

    Microsoft IIS web serversCVSS 10.0

    A self-spreading worm used a flaw in Microsoft's web server software IIS, a month after Microsoft had published the fix.

    359,104 computers infected in less than 14 hours

How a vulnerability gets on this listAll vulnerabilities with their records

Text updated October 23, 2026.