The Internet Dial

On Monday night, someone leaked the existence of two critical bugs in PHP — the language that runs WordPress, Wikipedia, and somewhere between a quarter and a third of the web — a day before the patch was ready. Both are unauthenticated remote code execution: anyone can run code on your server without logging in. Censys-derived counts put roughly 1.5 million of 2.6 million monitored PHP hosts on versions with no fix in the hours after release.

What happened next had no precedent in scale. CISA told organizations to take PHP systems offline until patched. So did the NSA, the FBI, the UK's NCSC, and CERT-EU. The Prime Minister of Japan posted patch instructions to 48 million followers. The Dutch parliament, the Dutch cybersecurity agency, and the Port of Rotterdam went dark — the agency took down its own website. Finland's state IT centre pulled central government services. Wikipedia and Archive.org went down. So did Asana, GOG, Something Awful, and the University of Vienna's webmail. And that was just PHP — the same day, GitLab shipped an out-of-band patch for CVE-2026-110264, a CVSS 10.0 pre-auth RCE present in every self-hosted release since 2014.

A viral thread summarized the mood: the internet got told to turn itself off, and a surprising amount of it complied. Which raises the question people kept half-joking in the replies: what is p(the internet is fucked), actually?

We already run a weekly, fully-cited estimate of P(AI kills us all). This page applies the same discipline to a nearer-term question. It runs again every Monday.

The question, pinned down

"The internet is dying" is the oldest take on the internet, and it's unfalsifiable as stated. So the dial asks something specific: the probability that, within the next 5 years, the open internet becomes effectively unusable — meaning any of four outcomes lasting a month or more and touching roughly a quarter of its users:

• Availability collapse — core function (web, DNS, routing, major platforms) out or severely degraded at continental scale.
• Security collapse — ordinary users and organizations can no longer safely run services or transact; mass exploitation with no workable patch path.
• Trust collapse — bots, synthetic content and fraud make open publishing and open search epistemically and economically nonviable.
• Fragmentation — the global network splits into non-interoperable national or regional islands.

Not a bad afternoon. A broken month, or worse, that doesn't just bounce back.

What we built

Nobody publishes P(internet collapse) estimates to aggregate — we looked; there isn't even a liquid prediction market on it. What exists instead is something better: two decades of measurable indicators, maintained by people with no stake in the answer. So each of five components tracks one failure mode through its named indicators, converts them to a 5-year probability through a stated anchor rubric, and the five pool in log-odds:

• Mass exploitation (25%) — CISA's Known Exploited Vulnerabilities catalog, exposed-host counts, Mandiant's time-to-exploit trend, the year's worst incident.
• Concentration (20%) — how much of the web sits behind how few chokepoints, and the blast radius when one fails.
• Bots & slop (20%) — bot share of traffic, AI crawl-to-referral ratios, what's happening to open-web economics.
• Fragmentation (15%) — government shutdown counts, the Freedom on the Net series, splinternet moves.
• The resilience case (20%) — the explicit counter-argument, scored from recovery evidence. A pool with no floor is propaganda.

Every number above the fold comes from a JSON file you can read, and the methodology and the historical reconstruction are a single readable file each. Disagree with a component, change one line, re-run.

The uncomfortable finding: every indicator is at its all-time worst, simultaneously

Backcasting this to 2014 produced something we did not expect to be this clean. Pick any failure mode. Its headline indicator set a record in the last eighteen months:

Any one of these rows is a trend piece. All of them at once is why the dial's backcast rises through the 2020s instead of oscillating. The 2014 internet had bad weeks; it did not have every structural indicator pinned at a record simultaneously.

The equally uncomfortable counter-finding: the recovery record is unbroken

Here's what the same backcast shows on the other side. Every "internet killer" since 2014 was absorbed. Heartbleed, Shellshock, Mirai taking out Dyn, WannaCry, NotPetya, Log4Shell — each produced a week of apocalypse coverage, then patching, then quiet. Log4Shell, "the most serious vulnerability" CISA's director said she'd seen in her career, produced no mass catastrophe at all — the retrospectives read as studies in successful mobilization. When COVID moved the entire planet online in a month, traffic spiked double digits and the network held. When CrowdStrike bluescreened 8.5 million machines in 2024 — $5.4B in Fortune 500 losses, planes grounded, hospitals on paper — the recovery took days, not months.

Even this week cuts both ways, and honestly scoring it means saying so. The coordinated disclosure held for two months. When it leaked, PHP shipped fixes in roughly eighteen hours. The agencies' advisories landed same-day. The things that went offline went offline voluntarily, as precaution — which is the immune system working, not failing. The scariest sentence in the whole affair, "the Prime Minister told everyone to turn it off," is also the strongest evidence that coordination at population scale is possible on a Tuesday.

That tension — every structural indicator worsening, every acute incident absorbed — is the model. The exploitation, concentration and fragmentation components push the number up; the resilience component, weighted at a fifth of the pool, drags it down; and the pooled result lands well above 2014 but well below panic.

The part with no recovery precedent

One component is different in kind, and it's the one we'd watch. Security incidents recover; outages recover. Nobody has ever demonstrated a recovery from economic collapse of the open web, and that's the direction the slop indicators point. Google referral traffic to publishers is down ~38% year over year; roughly two-thirds of searches end without a click; small publishers report search referrals down ~60% in two years; Wikipedia — the single most load-bearing site on the open web — reports crawler bandwidth up 50% while human traffic falls 8%. The open web's deal — publish openly, get readers back — is being unwound by the same systems trained on it.

The counter-evidence is real but young: Cloudflare now blocks AI crawlers by default for new sites and is building a pay-per-crawl market, and the worst crawl ratios improved sharply in a year (Anthropic's was 38,744:1 last July). Whether mitigation outruns extraction is, in our read, the single question most likely to decide where this series goes — more than any CVE.

What would actually move this

• Up: a php2shell-class bug that gets mass-exploited before disclosure instead of after. A chokepoint outage that takes a week instead of hours. Open-web referral economics crossing from decline into publisher die-off. A major country hard-partitioning its network and staying partitioned.
• Down: memory-safe migration visibly shrinking the critical-CVE pipeline. Crawl-compensation markets actually paying publishers. A year of falling shutdown counts. The KEV addition rate bending downward.

A run that only finds evidence in one direction is a search failure, not a finding, and the weekly prompt says so in those words.

What this is not

It is not a forecast to trade on, and it is not a claim that the headline number is right — the disagreement band is wide and honest. It is a number you can audit: every input cited, every conversion stated, the weights in a file, re-run on a schedule whether or not the news is exciting that week. If it ever crosses 30%, my phone buzzes.

The alternative — announcing the death of the internet every time something leaks, in posts, on the internet, which stays up — is what we've been doing since Usenet. It hasn't worked very well either.