crackthe.net
Timeline of the biggest vulnerabilities that crack the net
From Code Red to PHP2Shell: the vulnerabilities that changed IT security, with severity, the timeline from report to attack, and the figures.
- Cases
- 20
- Rated critical
- 8
Vulnerabilities
Current: fix released, update now
PHP2Shell
Two flaws in PHP itself let attackers take over web servers without a password, on WordPress, Drupal, Joomla, and many other applications.
69.3% of websites with a known server language run on PHP
What to do now: Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or newer, depending on your branch.
MOVEit Transfer
The Cl0p gang used an unknown flaw in the MOVEit Transfer file server to steal data from 2,773 organizations.
95.8 million people whose data was affected, according to breach notices (Emsisoft)
Log4Shell
One line of text in a log was enough to make servers run attackers' code, through a Java library that 35,863 packages depended on.
35,863 Java packages on Maven Central used the flawed code, more than 8% of all (Google)
ProxyLogon
Four flaws in Microsoft Exchange let attackers read mailboxes and take over mail servers without a password, two months before a fix existed.
400,000 Exchange servers at risk the day before the fix (nearly that many; not all were hacked)
Citrix ADC
A flaw in Citrix's remote access gateways let anyone on the internet take them over without a password. For 33 days, only a workaround existed.
128,777 vulnerable servers worldwide in December 2019 (estimate from a scan; DIVD)
Exim
A flaw in the Exim mail server let attackers run commands as root by writing them into an email address. Within days, a worm spread through it.
4.1 million systems showed a vulnerable Exim version in Shodan search results in June 2019 (more than; Tenable data)
MikroTik Winbox
A flaw in the Winbox service of MikroTik routers let anyone download the administrators' passwords. Months after the fix, attackers had hijacked more than 200,000 routers.
370,000 MikroTik devices were still vulnerable four months after the fix (Netlab 360)
Meltdown
A design flaw in most Intel processors let any program read the operating system's protected memory; operating-system updates closed the hole.
3.2–503 kilobytes per second: how fast an ordinary program read kernel memory, depending on the machine
Spectre
A design flaw in almost all modern processors let programs read memory they should not see, on desktops, laptops, servers, and smartphones.
45 Windows editions needed patches; 41 had them six days after disclosure
NotPetya
A worm posing as ransomware came through a hijacked software update, destroyed data in Ukraine and 64 more countries, and cost billions of dollars.
200–300 million US dollars in costs expected by the shipping group Maersk alone (press report)
WannaCry
A ransomware worm used a leaked NSA tool and a Windows flaw to hit more than 200,000 computers, and it disrupted hospitals in England.
200,000+ computers hit in at least 100 countries
Shellshock
A flaw in Bash, the command shell of Linux and macOS, let attackers run commands on web servers with a single crafted request.
63.2% of websites with a known operating system run on Linux today, where Bash is part of the system
Heartbleed
A missing check in OpenSSL let attackers read pieces of server memory, from passwords to private keys, without leaving a trace in normal logs.
24–55% of HTTPS servers among the top million websites were vulnerable at first
NTP monlist
A diagnostic command in NTP time servers answered a tiny request with a list of up to 600 addresses. This let attackers with forged sender addresses use more than a million servers as amplifiers for DDoS attacks.
2,166,097 different addresses of vulnerable NTP servers in 15 weeks of scans
Conficker
A Windows worm looked for updates at up to 50,000 new domain names a day. Defenders in over 100 countries worked together to block them.
5–13 million computers infected one year after the outbreak
Kaminsky DNS
A weakness in the DNS let attackers plant false addresses for any domain in a resolver's cache within seconds. They could then send the resolver's users to servers of their choice.
57% of 0.9 million open resolvers still sent every query from the same port months after the fixes
Blaster
Through a flaw in a Windows service that runs by default, a worm infected more than 100,000 computers in a week. A year later, it was still spreading.
100,000+ Windows computers infected in the first week
SQL Slammer
A worm of just 376 bytes spread a hundred times faster than Code Red and flooded networks with its traffic.
10 min to infect more than 90% of vulnerable servers
Nimda
A worm attacked Microsoft's web servers and Windows PCs by five routes at once, from email to backdoors left by CodeRedII. It infected 160,000 computers within seven hours.
160,000 computers infected at the peak, 7 hours after the outbreak began
Code Red
A self-spreading worm used a flaw in Microsoft's web server software IIS, a month after Microsoft had published the fix.
359,104 computers infected in less than 14 hours
The cases and the criteria they meet
| Name | Year | CVSS | Reach | Mass exploitation | Damage | Extraordinary response |
|---|---|---|---|---|---|---|
| Code Red | 2001 | 10.0 | met | met | met | not met |
| Nimda | 2001 | 7.5 | met | met | not met | not met |
| SQL Slammer | 2003 | 7.5 | not met | met | met | not met |
| Blaster | 2003 | 7.5 | met | met | not met | met |
| Kaminsky DNS | 2008 | 6.8 | met | not met | not met | met |
| Conficker | 2008 | 10.0 | met | met | not met | met |
| NTP monlist | 2014 | 5.0 | met | met | not met | met |
| Heartbleed | 2014 | 7.5 | met | not met | not met | met |
| Shellshock | 2014 | 9.8 | met | met | not met | not met |
| WannaCry | 2017 | 8.8 | met | met | met | met |
| NotPetya | 2017 | 8.8 | not met | met | met | not met |
| Meltdown | 2018 | 5.6 | met | not met | not met | met |
| Spectre | 2018 | 5.6 | met | not met | not met | met |
| MikroTik Winbox | 2018 | 9.1 | met | met | not met | not met |
| Exim | 2019 | 9.8 | met | met | not met | not met |
| Citrix ADC | 2019 | 9.8 | met | met | met | met |
| ProxyLogon | 2021 | 9.8 | met | met | not met | met |
| Log4Shell | 2021 | 10.0 | not met | met | not met | met |
| MOVEit Transfer | 2023 | 9.8 | not met | met | met | not met |
| PHP2Shell | 2026 | 9.8 | met | not met | not met | met |
| Code Red | 10.0 | |
|---|---|---|
| Conficker | 10.0 | |
| Log4Shell | 10.0 | |
| Shellshock | 9.8 | |
| Exim | 9.8 | |
| Citrix ADC | 9.8 | |
| ProxyLogon | 9.8 | |
| MOVEit Transfer | 9.8 | |
| PHP2Shell | 9.8 | |
| MikroTik Winbox | 9.1 | |
| WannaCry | 8.8 | |
| NotPetya | 8.8 | |
| Nimda | 7.5 | |
| SQL Slammer | 7.5 | |
| Blaster | 7.5 | |
| Heartbleed | 7.5 | |
| Kaminsky DNS | 6.8 | |
| Meltdown | 5.6 | |
| Spectre | 5.6 | |
| NTP monlist | 5.0 |
CVSS base scores from the US National Vulnerability Database. Older entries carry version 2 scores, which use a different scale.
Vulnerabilities
- 2001 Code Red
- 2001 Nimda
- 2003 SQL Slammer
- 2003 Blaster
- 2008 Kaminsky DNS
- 2008 Conficker
- 2014 NTP monlist
- 2014 Heartbleed
- 2014 Shellshock
- 2017 WannaCry
- 2017 NotPetya
- 2018 Meltdown
- 2018 Spectre
- 2018 MikroTik Winbox
- 2019 Exim
- 2019 Citrix ADC
- 2021 ProxyLogon
- 2021 Log4Shell
- 2023 MOVEit Transfer
- 2026 PHP2Shell
How to read the cases
Each article starts with the record of the vulnerability. It lists the CVE number, the score from the US National Vulnerability Database, and the dates from the first report to the fix and the first attacks. Below that, the article explains how the flaw worked and what happened next. Charts show the figures from public reports.
The CVSS score rates how severe a vulnerability is, from 0 to 10. It does not say how often it was used in attacks. Some of the most damaging cases here have medium scores.
How a vulnerability gets on this list
This list is not a database of every vulnerability: tens of thousands receive a CVE number each year. It keeps only the cases that shook the whole system. A vulnerability is listed only if it meets all three basic conditions and at least two of the four magnitude criteria.
Basic conditions
- A specific flaw in a widely used product or component, with a public record: a CVE number or a vendor advisory. Malware counts through the flaw it used.
- Many independent operators affected, in many countries, not the customers of a single company.
- Documented by primary sources: vendor advisories, government agencies, or measurement studies.
Magnitude criteria (at least two)
| Criterion | Met when |
|---|---|
| Reach | measurements found at least 100,000 affected systems, or the flaw sits in a component that runs on at least a tenth of all systems of its kind, such as processors, web servers, or websites |
| Mass exploitation | attacks in the wild hit at least 1,000 organizations or 100,000 systems, or a worm spread on its own |
| Damage | documented damage of at least one billion US dollars, outages of critical services such as hospitals, power, or transportation, or data of at least ten million people |
| Extraordinary response | measures beyond routine patching: the highest warning level of a national cyber agency, a government emergency directive, fixes in all major operating systems at once, or coordination across industries and countries |
A high severity score alone is not enough. Meltdown has a CVSS score of 5.6 and is on the list; many flaws with a score of 10 are not. Each case page shows which criteria the case meets and why.
Known, but not on the list
These vulnerabilities made headlines but meet fewer than two of the four magnitude criteria.
| Name | Year | Main CVE | Why not |
|---|---|---|---|
| xz Utils backdoor | 2024 | CVE-2024-3094 | Found before it reached stable releases of the major Linux distributions; no known attacks, no damage. It meets only the response criterion: a near miss. |
| TunnelVision | 2024 | CVE-2024-3661 | Lets an attacker on the same local network route traffic around a VPN; no mass attacks, no reported damage, no extraordinary response. |