{ "question": "Probability that the open internet becomes effectively unusable — a sustained (30+ day, ~quarter-of-users) collapse of availability, security, or trust — within the next 5 years (rolling)", "model": "weighted log-odds pool of five failure-mode components scored from named indicators; methodology of record: onlydata/scripts/internet-dial/MODEL.md", "weights_version": "v1 (2026-10-21)", "weights": { "exploitation": 0.25, "concentration": 0.2, "slop": 0.2, "fragmentation": 0.15, "resilience": 0.2 }, "alert_threshold": 0.3, "cadence": "yearly backcast 2014-2025 · monthly Jan-Sep 2026 · weekly from 2026-10-21", "updated_at": "2026-11-02T14:46:36.579Z", "series": [ { "date": "2014-12-31", "granularity": "year", "method": "backcast", "p": 0.03151, "low": 0.01124, "high": 0.06683, "headline": "Heartbleed and Shellshock make \"the whole internet has a critical bug\" a mainstream event; both are absorbed within months.", "events": [ { "date": "2014-04-07", "title": "Heartbleed disclosed — ~17% of secure web servers vulnerable", "url": "https://en.wikipedia.org/wiki/Heartbleed", "direction": "up", "why": "first mainstream whole-internet vulnerability event" } ], "components": { "exploitation": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated anchor: Heartbleed hit ~17% of trusted TLS servers and Shellshock was exploited within hours — but both were patched at scale within months, with no sustained systemic loss.", "sources": [ { "title": "Heartbleed — Wikipedia", "url": "https://en.wikipedia.org/wiki/Heartbleed", "date": "2014-04", "raw": "~17% of trusted-certificate secure web servers vulnerable at disclosure" }, { "title": "Shellshock — Wikipedia", "url": "https://en.wikipedia.org/wiki/Shellshock_(software_bug)", "date": "2014-09", "raw": "bash RCE in millions of unix systems, exploited within hours of disclosure" } ] }, "concentration": { "p": 0.03, "low": 0.01, "high": 0.06, "note": "Quiet anchor: CDN/cloud consolidation underway but no demonstrated single-point mass outage yet.", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" } ] }, "slop": { "p": 0.04, "low": 0.015, "high": 0.08, "note": "Quiet-elevated: bot share ~56% of traffic in 2014 measurements (then-current Incapsula data, cited via the 2025 report's decade chart) — but spam-era bots, not a trust collapse mechanism.", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" } ] }, "fragmentation": { "p": 0.03, "low": 0.01, "high": 0.06, "note": "Quiet: the Great Firewall is the standing partition precedent; no systematic shutdown count exists yet (#KeepItOn starts 2016).", "sources": [ { "title": "Great Firewall — Wikipedia", "url": "https://en.wikipedia.org/wiki/Great_Firewall", "date": "2014", "raw": "the standing national-partition precedent" } ] }, "resilience": { "p": 0.015, "low": 0.005, "high": 0.04, "note": "The 25-year base rate: every prior \"internet killer\" (Morris worm to Conficker) was absorbed. Heartbleed response demonstrated coordinated patching at internet scale.", "sources": [ { "title": "Heartbleed — Wikipedia", "url": "https://en.wikipedia.org/wiki/Heartbleed", "date": "2014-04", "raw": "~17% of trusted-certificate secure web servers vulnerable at disclosure" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2015-12-31", "granularity": "year", "method": "backcast", "p": 0.02987, "low": 0.01124, "high": 0.0633, "headline": "A quiet structural year — breaches grow, but nothing systemic; the dial's floor year.", "events": [], "components": { "exploitation": { "p": 0.045, "low": 0.02, "high": 0.09, "note": "Quiet-elevated: steady breach cadence (OPM era) but no internet-scale exploitation event this year.", "sources": [ { "title": "Heartbleed — Wikipedia", "url": "https://en.wikipedia.org/wiki/Heartbleed", "date": "2014-04", "raw": "~17% of trusted-certificate secure web servers vulnerable at disclosure" } ] }, "concentration": { "p": 0.03, "low": 0.01, "high": 0.06, "note": "Quiet: unchanged from 2014 — consolidation continues without a demonstrated failure.", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" } ] }, "slop": { "p": 0.035, "low": 0.015, "high": 0.07, "note": "Quiet: bot share actually FELL from its 2013–14 peak toward its mid-decade low (2025 report decade chart) — the one indicator improving.", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" } ] }, "fragmentation": { "p": 0.03, "low": 0.01, "high": 0.06, "note": "unchanged since 2014-12-31: the Great Firewall precedent; no systematic count yet.", "sources": [ { "title": "Great Firewall — Wikipedia", "url": "https://en.wikipedia.org/wiki/Great_Firewall", "date": "2014", "raw": "the standing national-partition precedent" } ] }, "resilience": { "p": 0.015, "low": 0.005, "high": 0.04, "note": "unchanged since 2014-12-31: base rate holds.", "sources": [ { "title": "Heartbleed — Wikipedia", "url": "https://en.wikipedia.org/wiki/Heartbleed", "date": "2014-04", "raw": "~17% of trusted-certificate secure web servers vulnerable at disclosure" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2016-12-31", "granularity": "year", "method": "backcast", "p": 0.03844, "low": 0.01489, "high": 0.08052, "headline": "Mirai takes out Dyn — consumer IoT breaks the DNS layer for a day, and the first systematic shutdown count lands at 75.", "events": [ { "date": "2016-10-21", "title": "Mirai botnet DDoS takes down Dyn — Twitter, Netflix, Reddit, GitHub offline", "url": "https://en.wikipedia.org/wiki/DDoS_attacks_on_Dyn", "direction": "up", "why": "first demonstration that one infrastructure provider is a continental single point of failure" } ], "components": { "exploitation": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated: Mirai demonstrates that unsecured IoT scales into internet-weapon botnets.", "sources": [ { "title": "Mirai (malware) — Wikipedia", "url": "https://en.wikipedia.org/wiki/Mirai_(malware)", "date": "2016-10", "raw": "IoT botnet of hundreds of thousands of devices" } ] }, "concentration": { "p": 0.06, "low": 0.025, "high": 0.12, "note": "Elevated: the Dyn attack proves a single DNS provider's failure takes major platforms down across two continents for a day.", "sources": [ { "title": "DDoS attacks on Dyn — Wikipedia", "url": "https://en.wikipedia.org/wiki/DDoS_attacks_on_Dyn", "date": "2016-10", "raw": "Mirai-driven DNS attack took Twitter, Netflix, Reddit, GitHub offline across North America and Europe" } ] }, "slop": { "p": 0.04, "low": 0.015, "high": 0.08, "note": "Quiet-elevated: bot-share near its mid-decade low; platform-era misinformation concerns rising but unquantified.", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" } ] }, "fragmentation": { "p": 0.035, "low": 0.015, "high": 0.07, "note": "Elevated start of record: #KeepItOn documents 75 government-ordered shutdowns in its first systematic year.", "sources": [ { "title": "Access Now #KeepItOn 2024 annual report (series since 2016)", "url": "https://www.accessnow.org/wp-content/uploads/2025/02/KeepItOn-2024-Internet-Shutdowns-Annual-Report.pdf", "date": "2025-02", "raw": "gov-ordered shutdowns/yr: 75 (2016) · 108 (2017) · 196 (2018) · 213 (2019) · 159 (2020) · 182 (2021) · 187 (2022) · 283 (2023) · 296 in 54 countries (2024); 1,754 since 2016" } ] }, "resilience": { "p": 0.018, "low": 0.006, "high": 0.045, "note": "Dyn recovered same-day; Mirai mitigations deployed across providers within weeks. Absorption record intact.", "sources": [ { "title": "DDoS attacks on Dyn — Wikipedia", "url": "https://en.wikipedia.org/wiki/DDoS_attacks_on_Dyn", "date": "2016-10", "raw": "Mirai-driven DNS attack took Twitter, Netflix, Reddit, GitHub offline across North America and Europe" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2017-12-31", "granularity": "year", "method": "backcast", "p": 0.04352, "low": 0.0169, "high": 0.08974, "headline": "WannaCry and NotPetya: state-grade exploits meet unpatched estates — $10B+ damage, hospitals diverted, and both absorbed inside a quarter.", "events": [ { "date": "2017-05-12", "title": "WannaCry hits 300,000+ machines in ~150 countries", "url": "https://en.wikipedia.org/wiki/WannaCry_ransomware_attack", "direction": "up", "why": "first worm since 2008 with hospital-level real-world consequences" }, { "date": "2017-06-27", "title": "NotPetya — >$10B damages, Maersk global shipping disrupted", "url": "https://en.wikipedia.org/wiki/Petya_(malware_family)", "direction": "up", "why": "state wiper disguised as ransomware proves supply-chain blast radius" } ], "components": { "exploitation": { "p": 0.08, "low": 0.035, "high": 0.15, "note": "Strained: WannaCry (300k+ machines, ~150 countries, NHS ambulances diverted) and NotPetya (>$10B, the costliest cyberattack recorded) in one summer, both powered by a leaked NSA exploit against long-patched bugs.", "sources": [ { "title": "WannaCry ransomware attack — Wikipedia", "url": "https://en.wikipedia.org/wiki/WannaCry_ransomware_attack", "date": "2017-05", "raw": "300,000+ computers across ~150 countries; NHS up to 70,000 devices, ambulances diverted" }, { "title": "Petya (malware family) — Wikipedia", "url": "https://en.wikipedia.org/wiki/Petya_(malware_family)", "date": "2017-06", "raw": "NotPetya: >$10B total damages (White House assessment); Maersk $200–300M" } ] }, "concentration": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated: Equifax shows one unpatched component exposing half a country's adults — concentration of data, not just routes.", "sources": [ { "title": "2017 Equifax data breach — Wikipedia", "url": "https://en.wikipedia.org/wiki/2017_Equifax_data_breach", "date": "2017-09", "raw": "147.9M Americans exposed via an unpatched Struts CVE" } ] }, "slop": { "p": 0.04, "low": 0.015, "high": 0.08, "note": "Quiet-elevated: carried; bot share still near its decade low per the later trend chart.", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" } ] }, "fragmentation": { "p": 0.04, "low": 0.015, "high": 0.08, "note": "Elevated: shutdowns rise to 108 in year two of the count.", "sources": [ { "title": "Access Now #KeepItOn 2024 annual report (series since 2016)", "url": "https://www.accessnow.org/wp-content/uploads/2025/02/KeepItOn-2024-Internet-Shutdowns-Annual-Report.pdf", "date": "2025-02", "raw": "gov-ordered shutdowns/yr: 75 (2016) · 108 (2017) · 196 (2018) · 213 (2019) · 159 (2020) · 182 (2021) · 187 (2022) · 283 (2023) · 296 in 54 countries (2024); 1,754 since 2016" } ] }, "resilience": { "p": 0.02, "low": 0.007, "high": 0.05, "note": "Both worms were stopped/absorbed within weeks (WannaCry by a kill switch found in hours); patching campaigns worked again.", "sources": [ { "title": "WannaCry ransomware attack — Wikipedia", "url": "https://en.wikipedia.org/wiki/WannaCry_ransomware_attack", "date": "2017-05", "raw": "300,000+ computers across ~150 countries; NHS up to 70,000 devices, ambulances diverted" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2018-12-31", "granularity": "year", "method": "backcast", "p": 0.0437, "low": 0.01717, "high": 0.0915, "headline": "Meltdown/Spectre put a structural flaw in every CPU; shutdowns nearly double to 196. Nothing breaks, everything creaks.", "events": [], "components": { "exploitation": { "p": 0.06, "low": 0.025, "high": 0.12, "note": "Elevated: hardware-level vulnerability class (Meltdown/Spectre) in essentially every processor — mitigated in software, never mass-exploited.", "sources": [ { "title": "Meltdown (security vulnerability) — Wikipedia", "url": "https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)", "date": "2018-01", "raw": "CPU-level flaws (with Spectre) affecting essentially every processor; mitigations, no mass exploitation" } ] }, "concentration": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated: carried from 2017; BGP hijack incidents recur without systemic loss.", "sources": [ { "title": "DDoS attacks on Dyn — Wikipedia", "url": "https://en.wikipedia.org/wiki/DDoS_attacks_on_Dyn", "date": "2016-10", "raw": "Mirai-driven DNS attack took Twitter, Netflix, Reddit, GitHub offline across North America and Europe" } ] }, "slop": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated: platform-trust crisis (Cambridge Analytica era) — the trust indicator rises before the bot indicator does.", "sources": [ { "title": "Dead Internet theory — Wikipedia", "url": "https://en.wikipedia.org/wiki/Dead_Internet_theory", "date": "2026", "raw": "the trust-collapse thesis, now with measurable inputs" } ] }, "fragmentation": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated-strained: 196 shutdowns in 25 countries — nearly double the prior year.", "sources": [ { "title": "Access Now #KeepItOn 2024 annual report (series since 2016)", "url": "https://www.accessnow.org/wp-content/uploads/2025/02/KeepItOn-2024-Internet-Shutdowns-Annual-Report.pdf", "date": "2025-02", "raw": "gov-ordered shutdowns/yr: 75 (2016) · 108 (2017) · 196 (2018) · 213 (2019) · 159 (2020) · 182 (2021) · 187 (2022) · 283 (2023) · 296 in 54 countries (2024); 1,754 since 2016" } ] }, "resilience": { "p": 0.02, "low": 0.007, "high": 0.05, "note": "Spectre-class flaws produced zero observed mass exploitation across the year; the patching machine held again.", "sources": [ { "title": "Meltdown (security vulnerability) — Wikipedia", "url": "https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)", "date": "2018-01", "raw": "CPU-level flaws (with Spectre) affecting essentially every processor; mitigations, no mass exploitation" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2019-12-31", "granularity": "year", "method": "backcast", "p": 0.04434, "low": 0.01742, "high": 0.09284, "headline": "Ransomware turns civic — Baltimore offline for weeks — and shutdowns hit 213. The slow indicators keep ratcheting.", "events": [], "components": { "exploitation": { "p": 0.06, "low": 0.025, "high": 0.12, "note": "Elevated: ransomware-as-industry normalizes against cities and hospitals (Baltimore weeks-long).", "sources": [ { "title": "2019 Baltimore ransomware attack — Wikipedia", "url": "https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_attack", "date": "2019-05", "raw": "a major US city offline for weeks — ransomware normalizes against civic infrastructure" } ] }, "concentration": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated: carried — no new demonstrated chokepoint failure this year.", "sources": [ { "title": "DDoS attacks on Dyn — Wikipedia", "url": "https://en.wikipedia.org/wiki/DDoS_attacks_on_Dyn", "date": "2016-10", "raw": "Mirai-driven DNS attack took Twitter, Netflix, Reddit, GitHub offline across North America and Europe" } ] }, "slop": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated: bot share begins climbing again (~37% in 2019 data per the decade chart).", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" } ] }, "fragmentation": { "p": 0.055, "low": 0.022, "high": 0.11, "note": "Strained edge: 213 shutdowns in 33 countries; Russia passes the Sovereign Internet Law.", "sources": [ { "title": "Access Now #KeepItOn 2024 annual report (series since 2016)", "url": "https://www.accessnow.org/wp-content/uploads/2025/02/KeepItOn-2024-Internet-Shutdowns-Annual-Report.pdf", "date": "2025-02", "raw": "gov-ordered shutdowns/yr: 75 (2016) · 108 (2017) · 196 (2018) · 213 (2019) · 159 (2020) · 182 (2021) · 187 (2022) · 283 (2023) · 296 in 54 countries (2024); 1,754 since 2016" }, { "title": "Sovereign Internet Law — Wikipedia", "url": "https://en.wikipedia.org/wiki/Sovereign_Internet_Law", "date": "2022", "raw": "Russia builds and repeatedly tests the ability to partition RuNet from the global internet" } ] }, "resilience": { "p": 0.02, "low": 0.007, "high": 0.05, "note": "Municipal victims recovered in weeks; no contagion beyond individual estates.", "sources": [ { "title": "2019 Baltimore ransomware attack — Wikipedia", "url": "https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_attack", "date": "2019-05", "raw": "a major US city offline for weeks — ransomware normalizes against civic infrastructure" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2020-12-31", "granularity": "year", "method": "backcast", "p": 0.04382, "low": 0.01715, "high": 0.09308, "headline": "The strongest resilience datapoint in the series — COVID moves the planet online and the network holds — against SolarWinds proving months-deep supply-chain compromise.", "events": [ { "date": "2020-12-13", "title": "SolarWinds supply-chain compromise disclosed", "url": "https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach", "direction": "up", "why": "months of undetected access across ~18,000 orgs — trust in the update channel itself" }, { "date": "2020-03-27", "title": "COVID: internet traffic surges 10–40% by region — and holds", "url": "https://blog.cloudflare.com/on-the-shoulders-of-giants-recent-changes-in-internet-traffic/", "direction": "down", "why": "the network absorbs an unplanned planetary load test" } ], "components": { "exploitation": { "p": 0.07, "low": 0.03, "high": 0.14, "note": "Strained edge: SolarWinds — ~18,000 orgs ran trojaned updates for months undetected, including US federal agencies.", "sources": [ { "title": "2020 United States federal government data breach — Wikipedia", "url": "https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach", "date": "2020-12", "raw": "~18,000 orgs received trojaned Orion updates; months undetected" } ] }, "concentration": { "p": 0.055, "low": 0.022, "high": 0.11, "note": "Elevated: pandemic load concentrated life onto a handful of platforms and they became critical infrastructure overnight.", "sources": [ { "title": "Cloudflare: recent changes in Internet traffic (COVID surge)", "url": "https://blog.cloudflare.com/on-the-shoulders-of-giants-recent-changes-in-internet-traffic/", "date": "2020-03", "raw": "traffic up 10–40% by region in weeks; the network held" } ] }, "slop": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated: carried from 2019.", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" } ] }, "fragmentation": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated: shutdowns dipped to 159 (pandemic year) — the one fragmentation improvement in the series.", "sources": [ { "title": "Access Now #KeepItOn 2024 annual report (series since 2016)", "url": "https://www.accessnow.org/wp-content/uploads/2025/02/KeepItOn-2024-Internet-Shutdowns-Annual-Report.pdf", "date": "2025-02", "raw": "gov-ordered shutdowns/yr: 75 (2016) · 108 (2017) · 196 (2018) · 213 (2019) · 159 (2020) · 182 (2021) · 187 (2022) · 283 (2023) · 296 in 54 countries (2024); 1,754 since 2016" } ] }, "resilience": { "p": 0.015, "low": 0.005, "high": 0.04, "note": "The best resilience evidence ever recorded: traffic surged 10–40% by region in weeks and the internet held — the system passed a planetary load test unplanned.", "sources": [ { "title": "Cloudflare: recent changes in Internet traffic (COVID surge)", "url": "https://blog.cloudflare.com/on-the-shoulders-of-giants-recent-changes-in-internet-traffic/", "date": "2020-03", "raw": "traffic up 10–40% by region in weeks; the network held" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2021-12-31", "granularity": "year", "method": "backcast", "p": 0.05161, "low": 0.02065, "high": 0.10683, "headline": "Log4Shell — \"the most serious vulnerability I've seen\" — plus Facebook's six-hour BGP self-own and Fastly's one-config outage: the chokepoint year.", "events": [ { "date": "2021-12-09", "title": "Log4Shell disclosed — ubiquitous, trivially exploitable", "url": "https://en.wikipedia.org/wiki/Log4Shell", "direction": "up", "why": "the widest attack surface ever shipped in one library" }, { "date": "2021-10-04", "title": "Facebook BGP outage — six hours, total", "url": "https://en.wikipedia.org/wiki/2021_Facebook_outage", "direction": "up", "why": "one company's routing mistake erases its platforms globally" } ], "components": { "exploitation": { "p": 0.09, "low": 0.04, "high": 0.17, "note": "Strained: Log4Shell sits in everything, exploitation begins pre-announcement, CISA's director calls it the most serious flaw of her career; Colonial Pipeline shows infrastructure-adjacent consequences.", "sources": [ { "title": "Log4Shell — Wikipedia", "url": "https://en.wikipedia.org/wiki/Log4Shell", "date": "2021-12", "raw": "CISA director: \"one of the most serious I've seen in my entire career, if not the most serious\"" } ] }, "concentration": { "p": 0.07, "low": 0.03, "high": 0.14, "note": "Strained edge: Facebook erased itself from the internet for 6–7 hours via one BGP change; Fastly took Reddit, Amazon and GOV.UK down with one config — two chokepoint demos in one year.", "sources": [ { "title": "2021 Facebook outage — Wikipedia", "url": "https://en.wikipedia.org/wiki/2021_Facebook_outage", "date": "2021-10", "raw": "six-to-seven-hour global outage from one BGP misconfiguration" }, { "title": "Fastly — Wikipedia (June 2021 outage)", "url": "https://en.wikipedia.org/wiki/Fastly", "date": "2021-06", "raw": "one config bug took Reddit, Twitch, Amazon, GOV.UK, NYT offline; 95% restored in 49 minutes" } ] }, "slop": { "p": 0.05, "low": 0.02, "high": 0.1, "note": "Elevated: carried; bot share climbing.", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" } ] }, "fragmentation": { "p": 0.055, "low": 0.022, "high": 0.11, "note": "Strained edge: 182 shutdowns; Myanmar coup shows month-scale national blackouts are a usable tool.", "sources": [ { "title": "Access Now #KeepItOn 2024 annual report (series since 2016)", "url": "https://www.accessnow.org/wp-content/uploads/2025/02/KeepItOn-2024-Internet-Shutdowns-Annual-Report.pdf", "date": "2025-02", "raw": "gov-ordered shutdowns/yr: 75 (2016) · 108 (2017) · 196 (2018) · 213 (2019) · 159 (2020) · 182 (2021) · 187 (2022) · 283 (2023) · 296 in 54 countries (2024); 1,754 since 2016" } ] }, "resilience": { "p": 0.018, "low": 0.006, "high": 0.045, "note": "Fastly recovered in 49 minutes; Facebook same-day; Log4Shell's feared catastrophe never materialized (the retrospectives later called it overblown) — absorption record extended.", "sources": [ { "title": "Fastly — Wikipedia (June 2021 outage)", "url": "https://en.wikipedia.org/wiki/Fastly", "date": "2021-06", "raw": "one config bug took Reddit, Twitch, Amazon, GOV.UK, NYT offline; 95% restored in 49 minutes" }, { "title": "VulnCheck: Log4Shell retrospective — \"Overblown and Exaggerated\"", "url": "https://www.vulncheck.com/blog/log4shell-retro", "date": "2024-12", "raw": "the feared mass catastrophe never materialized; community patching worked" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2022-12-31", "granularity": "year", "method": "backcast", "p": 0.05377, "low": 0.02188, "high": 0.11095, "headline": "The war year: Viasat wiped at the invasion hour, RuNet partition rehearsals, shutdowns as a weapon — fragmentation becomes the fastest-moving component.", "events": [ { "date": "2022-02-24", "title": "Viasat KA-SAT wiped at the invasion hour", "url": "https://en.wikipedia.org/wiki/Viasat_hack", "direction": "up", "why": "first operational use of internet-infrastructure attack in a major war" } ], "components": { "exploitation": { "p": 0.08, "low": 0.035, "high": 0.15, "note": "Strained: carried high from Log4Shell year; wiper malware (AcidRain) used operationally in war.", "sources": [ { "title": "Viasat hack — Wikipedia", "url": "https://en.wikipedia.org/wiki/Viasat_hack", "date": "2022-02", "raw": "AcidRain wiper bricked KA-SAT modems at the invasion hour; ~5,800 German wind turbines lost remote control" } ] }, "concentration": { "p": 0.065, "low": 0.028, "high": 0.13, "note": "Strained edge: one satellite operator's compromise bricked modems across Europe and took 5,800 wind turbines off remote control.", "sources": [ { "title": "Viasat hack — Wikipedia", "url": "https://en.wikipedia.org/wiki/Viasat_hack", "date": "2022-02", "raw": "AcidRain wiper bricked KA-SAT modems at the invasion hour; ~5,800 German wind turbines lost remote control" } ] }, "slop": { "p": 0.055, "low": 0.022, "high": 0.11, "note": "Elevated: bot share keeps climbing toward half of traffic.", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" } ] }, "fragmentation": { "p": 0.075, "low": 0.032, "high": 0.15, "note": "Strained: 187 shutdowns; Russia actively partitioning and testing RuNet isolation; the splinternet moves from thesis to policy.", "sources": [ { "title": "Access Now #KeepItOn 2024 annual report (series since 2016)", "url": "https://www.accessnow.org/wp-content/uploads/2025/02/KeepItOn-2024-Internet-Shutdowns-Annual-Report.pdf", "date": "2025-02", "raw": "gov-ordered shutdowns/yr: 75 (2016) · 108 (2017) · 196 (2018) · 213 (2019) · 159 (2020) · 182 (2021) · 187 (2022) · 283 (2023) · 296 in 54 countries (2024); 1,754 since 2016" }, { "title": "Sovereign Internet Law — Wikipedia", "url": "https://en.wikipedia.org/wiki/Sovereign_Internet_Law", "date": "2022", "raw": "Russia builds and repeatedly tests the ability to partition RuNet from the global internet" } ] }, "resilience": { "p": 0.02, "low": 0.007, "high": 0.05, "note": "Ukraine's internet stayed up under physical and cyber attack — Starlink + resilient routing as counter-evidence under worst-case conditions.", "sources": [ { "title": "Viasat hack — Wikipedia", "url": "https://en.wikipedia.org/wiki/Viasat_hack", "date": "2022-02", "raw": "AcidRain wiper bricked KA-SAT modems at the invasion hour; ~5,800 German wind turbines lost remote control" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2023-12-31", "granularity": "year", "method": "backcast", "p": 0.06262, "low": 0.02639, "high": 0.12674, "headline": "MOVEit mass exploitation (2,700+ orgs) and the first full year of generative slop: bot share back near half, shutdowns leap to 283.", "events": [], "components": { "exploitation": { "p": 0.09, "low": 0.04, "high": 0.17, "note": "Strained: MOVEit — one product, 2,773 organizations, ~93M people — becomes the mass-exploitation template.", "sources": [ { "title": "2023 MOVEit data breach — Wikipedia", "url": "https://en.wikipedia.org/wiki/2023_MOVEit_data_breach", "date": "2023-06", "raw": "2,773 organizations, ~93M+ individuals — one file-transfer product, mass-exploited" } ] }, "concentration": { "p": 0.065, "low": 0.028, "high": 0.13, "note": "Strained edge: carried.", "sources": [ { "title": "2021 Facebook outage — Wikipedia", "url": "https://en.wikipedia.org/wiki/2021_Facebook_outage", "date": "2021-10", "raw": "six-to-seven-hour global outage from one BGP misconfiguration" } ] }, "slop": { "p": 0.08, "low": 0.035, "high": 0.15, "note": "Strained: generative AI's first full year — bot share back to 49.6%, SEO-spam measurably degrading search (Bevendorff et al. begins fielding), dead-internet moves from meme to measurable.", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" }, { "title": "Bevendorff et al., \"Is Google Getting Worse?\" (ECIR 2024)", "url": "https://downloads.webis.de/publications/papers/bevendorff_2024a.pdf", "date": "2024-01", "raw": "measured SEO-spam/affiliate degradation of major search engines' results" }, { "title": "Dead Internet theory — Wikipedia", "url": "https://en.wikipedia.org/wiki/Dead_Internet_theory", "date": "2026", "raw": "the trust-collapse thesis, now with measurable inputs" } ] }, "fragmentation": { "p": 0.09, "low": 0.04, "high": 0.17, "note": "Strained: 283 shutdowns in 39 countries — a 50% jump; RuNet isolation tested live in July.", "sources": [ { "title": "Access Now #KeepItOn 2024 annual report (series since 2016)", "url": "https://www.accessnow.org/wp-content/uploads/2025/02/KeepItOn-2024-Internet-Shutdowns-Annual-Report.pdf", "date": "2025-02", "raw": "gov-ordered shutdowns/yr: 75 (2016) · 108 (2017) · 196 (2018) · 213 (2019) · 159 (2020) · 182 (2021) · 187 (2022) · 283 (2023) · 296 in 54 countries (2024); 1,754 since 2016" }, { "title": "Sovereign Internet Law — Wikipedia", "url": "https://en.wikipedia.org/wiki/Sovereign_Internet_Law", "date": "2022", "raw": "Russia builds and repeatedly tests the ability to partition RuNet from the global internet" } ] }, "resilience": { "p": 0.022, "low": 0.008, "high": 0.055, "note": "MOVEit was contained to one product class; patch + mitigation cycle routine. Absorption record intact, but the record now absorbs more per year.", "sources": [ { "title": "2023 MOVEit data breach — Wikipedia", "url": "https://en.wikipedia.org/wiki/2023_MOVEit_data_breach", "date": "2023-06", "raw": "2,773 organizations, ~93M+ individuals — one file-transfer product, mass-exploited" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2024-12-31", "granularity": "year", "method": "backcast", "p": 0.07782, "low": 0.03333, "high": 0.1539, "headline": "The CrowdStrike year: one bad config file bluescreens 8.5M machines — plus the XZ near-miss, Salt Typhoon disclosed, bots pass half of traffic, shutdowns set another record.", "events": [ { "date": "2024-07-19", "title": "CrowdStrike config update bluescreens 8.5M Windows machines", "url": "https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT_outages", "direction": "up", "why": "largest IT outage in history, from one vendor file" }, { "date": "2024-03-29", "title": "XZ Utils backdoor caught days before global distribution", "url": "https://en.wikipedia.org/wiki/XZ_Utils_backdoor", "direction": "up", "why": "a years-long supply-chain infiltration nearly reached every ssh server" } ], "components": { "exploitation": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "Strained-high: XZ backdoor nearly shipped into every sshd on earth (caught by one engineer's benchmark); Salt Typhoon's telecom compromise disclosed; time-to-exploit reaches −1 day (exploitation precedes patch on average).", "sources": [ { "title": "XZ Utils backdoor — Wikipedia", "url": "https://en.wikipedia.org/wiki/XZ_Utils_backdoor", "date": "2024-03", "raw": "multi-year social-engineered supply-chain backdoor into sshd, caught by one engineer's benchmark" }, { "title": "Salt Typhoon — Wikipedia", "url": "https://en.wikipedia.org/wiki/Salt_Typhoon", "date": "2024", "raw": "state compromise of US telecom backbones (began 2023, disclosed 2024)" }, { "title": "Mandiant M-Trends 2026", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "date": "2026-03", "raw": "mean time-to-exploit ~−7 days in 2025 (exploitation precedes patch); exploits #1 initial-access vector, 33% of breaches" } ] }, "concentration": { "p": 0.1, "low": 0.045, "high": 0.19, "note": "Strained-high: CrowdStrike — 8.5M devices, ~$5.4B Fortune-500 losses, airlines and hospitals down — the largest IT outage in history, from one vendor's one file.", "sources": [ { "title": "2024 CrowdStrike-related IT outages — Wikipedia", "url": "https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT_outages", "date": "2024-07", "raw": "8.5M Windows devices; airlines, hospitals, banks; largest IT outage in history" }, { "title": "CrowdStrike outage cost case study", "url": "https://outagecost.com/case-studies/crowdstrike", "date": "2024-07", "raw": "Fortune 500 direct losses ~$5.4B" } ] }, "slop": { "p": 0.1, "low": 0.045, "high": 0.19, "note": "Strained-high: bots pass 51% — humans a minority of web traffic for the first measured time; AI crawler load becomes an infrastructure cost (Wikimedia later reports +50% bandwidth since Jan 2024).", "sources": [ { "title": "Imperva Bad Bot Report 2025 (decade trend chart)", "url": "https://www.imperva.com/resources/wp-content/uploads/sites/6/reports/2025-Bad-Bot-Report.pdf", "date": "2025-04", "raw": "bot share of web traffic: ~56% (2014 data) → ~37% (2019) → 49.6% (2023) → 51% (2024)" }, { "title": "Wikimedia: +50% bandwidth from AI crawlers", "url": "https://www.techzine.eu/news/infrastructure/130333/wikimedia-is-dealing-with-a-50-percent-increase-in-bandwidth-due-to-ai-crawlers/", "date": "2025-04", "raw": "crawler bandwidth +50% since Jan 2024; crawlers ~65% of highest-cost traffic but ~35% of pageviews" } ] }, "fragmentation": { "p": 0.095, "low": 0.042, "high": 0.18, "note": "Strained-high: 296 shutdowns in 54 countries — record year AGAIN; RuNet isolation drills include whole regions.", "sources": [ { "title": "Access Now #KeepItOn 2024 annual report (series since 2016)", "url": "https://www.accessnow.org/wp-content/uploads/2025/02/KeepItOn-2024-Internet-Shutdowns-Annual-Report.pdf", "date": "2025-02", "raw": "gov-ordered shutdowns/yr: 75 (2016) · 108 (2017) · 196 (2018) · 213 (2019) · 159 (2020) · 182 (2021) · 187 (2022) · 283 (2023) · 296 in 54 countries (2024); 1,754 since 2016" }, { "title": "Sovereign Internet Law — Wikipedia", "url": "https://en.wikipedia.org/wiki/Sovereign_Internet_Law", "date": "2022", "raw": "Russia builds and repeatedly tests the ability to partition RuNet from the global internet" } ] }, "resilience": { "p": 0.025, "low": 0.009, "high": 0.06, "note": "CrowdStrike recovery took days not months; XZ was CAUGHT — the near-miss is also evidence the immune system works. But margins visibly thinner.", "sources": [ { "title": "2024 CrowdStrike-related IT outages — Wikipedia", "url": "https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT_outages", "date": "2024-07", "raw": "8.5M Windows devices; airlines, hospitals, banks; largest IT outage in history" }, { "title": "XZ Utils backdoor — Wikipedia", "url": "https://en.wikipedia.org/wiki/XZ_Utils_backdoor", "date": "2024-03", "raw": "multi-year social-engineered supply-chain backdoor into sshd, caught by one engineer's benchmark" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2025-12-31", "granularity": "year", "method": "backcast", "p": 0.08952, "low": 0.03876, "high": 0.17287, "headline": "Every structural indicator at a record at once: bots >53%, shutdowns 313, 15th straight freedom decline, KEV record, AWS/Cloudflare chokepoint outages — the crawl economy starts visibly unwinding the open web.", "events": [ { "date": "2025-10-20", "title": "AWS us-east-1 outage — ~15 hours, 1,000+ companies", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "direction": "up", "why": "the cloud's center of gravity fails for most of a day" }, { "date": "2025-07-01", "title": "Cloudflare blocks AI crawlers by default, launches Pay Per Crawl", "url": "https://www.cloudflare.com/press-releases/2025/cloudflare-just-changed-how-ai-crawlers-scrape-the-internet-at-large/", "direction": "down", "why": "first structural defense of open-web economics" } ], "components": { "exploitation": { "p": 0.12, "low": 0.055, "high": 0.22, "note": "Strained-high: 245 KEV additions set the annual record; mean time-to-exploit goes decisively negative (~−7 days, reported in M-Trends the following March).", "sources": [ { "title": "Mandiant M-Trends 2026", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "date": "2026-03", "raw": "mean time-to-exploit ~−7 days in 2025 (exploitation precedes patch); exploits #1 initial-access vector, 33% of breaches" }, { "title": "CISA KEV catalog analysis 2026", "url": "https://theuptimereport.com/cisa-known-exploited-vulnerabilities-analysis-2026/", "date": "2026-10", "raw": "1,733 total; 249 added YTD by Oct 2 vs 245 in all of 2025 — pace ~32% ahead of the record" } ] }, "concentration": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "Strained-high: AWS us-east-1 down ~15 hours in October; Cloudflare's November config crash takes X, ChatGPT and Uber with it; a quarter of the web now behind one reverse proxy.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" }, { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.13, "low": 0.06, "high": 0.24, "note": "Strained-high → crisis edge: automation >53% of traffic; Wikimedia reports crawler bandwidth +50% while human traffic falls 8%; Cloudflare flips to default-blocking AI crawlers — the open web's economics visibly breaking.", "sources": [ { "title": "Thales/Imperva Bad Bot Report 2026", "url": "https://www.imperva.com/blog/bad-bot-report-2026-bots-agentic-age/", "date": "2026-05", "raw": "automated traffic >53% of all web traffic in 2025; AI-driven bot attacks up ~12.5x" }, { "title": "Wikimedia: +50% bandwidth from AI crawlers", "url": "https://www.techzine.eu/news/infrastructure/130333/wikimedia-is-dealing-with-a-50-percent-increase-in-bandwidth-due-to-ai-crawlers/", "date": "2025-04", "raw": "crawler bandwidth +50% since Jan 2024; crawlers ~65% of highest-cost traffic but ~35% of pageviews" }, { "title": "Wikipedia human traffic −8% YoY", "url": "https://www.implicator.ai/wikipedia-loses-8-of-human-traffic-to-ai-that-trained-on-wikipedia/", "date": "2025-10", "raw": "human pageviews down 8% year over year" }, { "title": "Cloudflare: AI crawlers blocked by default + Pay Per Crawl", "url": "https://www.cloudflare.com/press-releases/2025/cloudflare-just-changed-how-ai-crawlers-scrape-the-internet-at-large/", "date": "2025-07", "raw": "default block for new domains; pay-per-crawl market in beta" } ] }, "fragmentation": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "Strained-high: 313 shutdowns in 52 countries, ~800M people, no shutdown-free day all year; 15th consecutive year of declining internet freedom.", "sources": [ { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" }, { "title": "Freedom on the Net 2025: Uncertain Future", "url": "https://freedomhouse.org/report/freedom-net/2025/uncertain-future-global-internet", "date": "2025-11", "raw": "15th consecutive year of decline; deterioration in 27 of 72 countries assessed" } ] }, "resilience": { "p": 0.028, "low": 0.01, "high": 0.065, "note": "Every 2025 outage recovered inside a day; default crawler-blocking and pay-per-crawl are the first structural COUNTER-moves in the slop fight. The absorber still absorbs.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" }, { "title": "Cloudflare: AI crawlers blocked by default + Pay Per Crawl", "url": "https://www.cloudflare.com/press-releases/2025/cloudflare-just-changed-how-ai-crawlers-scrape-the-internet-at-large/", "date": "2025-07", "raw": "default block for new domains; pay-per-crawl market in beta" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-01-31", "granularity": "month", "method": "backcast", "p": 0.09023, "low": 0.03876, "high": 0.17443, "headline": "The 2026 baseline: all 2025 records stand; the referral-collapse numbers keep arriving.", "events": [], "components": { "exploitation": { "p": 0.12, "low": 0.055, "high": 0.22, "note": "carried from 2025 year-end: record KEV pace and negative time-to-exploit stand.", "sources": [ { "title": "CISA KEV catalog analysis 2026", "url": "https://theuptimereport.com/cisa-known-exploited-vulnerabilities-analysis-2026/", "date": "2026-10", "raw": "1,733 total; 249 added YTD by Oct 2 vs 245 in all of 2025 — pace ~32% ahead of the record" }, { "title": "Mandiant M-Trends 2026", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "date": "2026-03", "raw": "mean time-to-exploit ~−7 days in 2025 (exploitation precedes patch); exploits #1 initial-access vector, 33% of breaches" } ] }, "concentration": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "carried from 2025 year-end.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" }, { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.135, "low": 0.06, "high": 0.25, "note": "Crisis edge: referral collapse data accumulating — publisher referrals −38% YoY, ~68% of searches zero-click.", "sources": [ { "title": "Google referral traffic to publishers −38% YoY", "url": "https://9to5google.com/2026/03/18/google-search-traffic-publishers-report/", "date": "2026-03", "raw": "publisher referrals down ~38% YoY; AI assistants send <1% of traffic" }, { "title": "AI impact on website traffic (FirstPageSage)", "url": "https://firstpagesage.com/seo-blog/ai-impact-on-website-traffic-report/", "date": "2026", "raw": "~68% of searches end without a click; small publishers −60% referrals in 2 years" } ] }, "fragmentation": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "carried from 2025 year-end.", "sources": [ { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" }, { "title": "Freedom on the Net 2025: Uncertain Future", "url": "https://freedomhouse.org/report/freedom-net/2025/uncertain-future-global-internet", "date": "2025-11", "raw": "15th consecutive year of decline; deterioration in 27 of 72 countries assessed" } ] }, "resilience": { "p": 0.028, "low": 0.01, "high": 0.065, "note": "carried from 2025 year-end.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-02-28", "granularity": "month", "method": "backcast", "p": 0.09023, "low": 0.03876, "high": 0.17443, "headline": "No material change — structural indicators hold at records.", "events": [], "components": { "exploitation": { "p": 0.12, "low": 0.055, "high": 0.22, "note": "unchanged since 2026-01-31: record KEV pace, negative time-to-exploit.", "sources": [ { "title": "CISA KEV catalog analysis 2026", "url": "https://theuptimereport.com/cisa-known-exploited-vulnerabilities-analysis-2026/", "date": "2026-10", "raw": "1,733 total; 249 added YTD by Oct 2 vs 245 in all of 2025 — pace ~32% ahead of the record" }, { "title": "Mandiant M-Trends 2026", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "date": "2026-03", "raw": "mean time-to-exploit ~−7 days in 2025 (exploitation precedes patch); exploits #1 initial-access vector, 33% of breaches" } ] }, "concentration": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "unchanged since 2026-01-31: quarter of the web behind one proxy.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" }, { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.135, "low": 0.06, "high": 0.25, "note": "unchanged since 2026-01-31: referral collapse continuing.", "sources": [ { "title": "Google referral traffic to publishers −38% YoY", "url": "https://9to5google.com/2026/03/18/google-search-traffic-publishers-report/", "date": "2026-03", "raw": "publisher referrals down ~38% YoY; AI assistants send <1% of traffic" }, { "title": "AI impact on website traffic (FirstPageSage)", "url": "https://firstpagesage.com/seo-blog/ai-impact-on-website-traffic-report/", "date": "2026", "raw": "~68% of searches end without a click; small publishers −60% referrals in 2 years" } ] }, "fragmentation": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "unchanged since 2026-01-31: 2025 record counts stand.", "sources": [ { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" }, { "title": "Freedom on the Net 2025: Uncertain Future", "url": "https://freedomhouse.org/report/freedom-net/2025/uncertain-future-global-internet", "date": "2025-11", "raw": "15th consecutive year of decline; deterioration in 27 of 72 countries assessed" } ] }, "resilience": { "p": 0.028, "low": 0.01, "high": 0.065, "note": "unchanged since 2026-01-31: absorption record intact.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-03-31", "granularity": "month", "method": "backcast", "p": 0.09276, "low": 0.03987, "high": 0.17989, "headline": "M-Trends confirms exploitation now precedes patching on average (−7 days); Access Now confirms 2025 as the worst shutdown year ever; Anil Dash calls 2026 the open web's endgame year.", "events": [ { "date": "2026-03-24", "title": "M-Trends 2026: time-to-exploit now −7 days", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "direction": "up", "why": "average exploitation now precedes the patch" } ], "components": { "exploitation": { "p": 0.13, "low": 0.06, "high": 0.24, "note": "Strained-high, confirmed: M-Trends 2026 — mean time-to-exploit ~−7 days; exploits the #1 initial-access vector for the 5th straight year.", "sources": [ { "title": "Mandiant M-Trends 2026", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "date": "2026-03", "raw": "mean time-to-exploit ~−7 days in 2025 (exploitation precedes patch); exploits #1 initial-access vector, 33% of breaches" } ] }, "concentration": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "unchanged since 2026-01-31: no new chokepoint event.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" }, { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.135, "low": 0.06, "high": 0.25, "note": "Crisis edge: publisher-referral data firms up (−38% YoY); the \"endgame for the open web\" framing enters mainstream commentary.", "sources": [ { "title": "Google referral traffic to publishers −38% YoY", "url": "https://9to5google.com/2026/03/18/google-search-traffic-publishers-report/", "date": "2026-03", "raw": "publisher referrals down ~38% YoY; AI assistants send <1% of traffic" }, { "title": "Anil Dash: Endgame for the Open Web", "url": "https://www.anildash.com/2026/03/27/endgame-open-web/", "date": "2026-03", "raw": "2026 decides whether the open web survives" } ] }, "fragmentation": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "Strained-high: #KeepItOn 2025 report lands — 313 in 52 countries, worst ever, ~800M affected.", "sources": [ { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" } ] }, "resilience": { "p": 0.028, "low": 0.01, "high": 0.065, "note": "unchanged since 2026-01-31: nothing failed to recover this quarter.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-04-30", "granularity": "month", "method": "backcast", "p": 0.09276, "low": 0.03987, "high": 0.17989, "headline": "No material change.", "events": [], "components": { "exploitation": { "p": 0.13, "low": 0.06, "high": 0.24, "note": "unchanged since 2026-03-31: −7 day time-to-exploit stands.", "sources": [ { "title": "Mandiant M-Trends 2026", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "date": "2026-03", "raw": "mean time-to-exploit ~−7 days in 2025 (exploitation precedes patch); exploits #1 initial-access vector, 33% of breaches" } ] }, "concentration": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "unchanged since 2026-01-31: no new chokepoint event.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" }, { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.135, "low": 0.06, "high": 0.25, "note": "unchanged since 2026-03-31: referral collapse continuing.", "sources": [ { "title": "Google referral traffic to publishers −38% YoY", "url": "https://9to5google.com/2026/03/18/google-search-traffic-publishers-report/", "date": "2026-03", "raw": "publisher referrals down ~38% YoY; AI assistants send <1% of traffic" }, { "title": "Anil Dash: Endgame for the Open Web", "url": "https://www.anildash.com/2026/03/27/endgame-open-web/", "date": "2026-03", "raw": "2026 decides whether the open web survives" } ] }, "fragmentation": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "unchanged since 2026-03-31: record shutdown year confirmed.", "sources": [ { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" } ] }, "resilience": { "p": 0.028, "low": 0.01, "high": 0.065, "note": "unchanged since 2026-01-31: absorption record intact.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-05-31", "granularity": "month", "method": "backcast", "p": 0.09347, "low": 0.04052, "high": 0.18144, "headline": "Bad Bot Report 2026: automation passes 53% of all web traffic; AI-driven bot attacks up ~12.5x.", "events": [ { "date": "2026-05-15", "title": "Thales Bad Bot Report: automation >53% of web traffic", "url": "https://www.imperva.com/blog/bad-bot-report-2026-bots-agentic-age/", "direction": "up", "why": "humans a shrinking minority of the web for a second year" } ], "components": { "exploitation": { "p": 0.13, "low": 0.06, "high": 0.24, "note": "unchanged since 2026-03-31: −7 day time-to-exploit stands.", "sources": [ { "title": "Mandiant M-Trends 2026", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "date": "2026-03", "raw": "mean time-to-exploit ~−7 days in 2025 (exploitation precedes patch); exploits #1 initial-access vector, 33% of breaches" } ] }, "concentration": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "unchanged since 2026-01-31: no new chokepoint event.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" }, { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.14, "low": 0.065, "high": 0.26, "note": "Crisis edge: >53% of 2025 traffic automated (second straight human-minority year); AI-driven bot attacks up ~12.5x.", "sources": [ { "title": "Thales/Imperva Bad Bot Report 2026", "url": "https://www.imperva.com/blog/bad-bot-report-2026-bots-agentic-age/", "date": "2026-05", "raw": "automated traffic >53% of all web traffic in 2025; AI-driven bot attacks up ~12.5x" } ] }, "fragmentation": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "unchanged since 2026-03-31: record shutdown year confirmed.", "sources": [ { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" } ] }, "resilience": { "p": 0.028, "low": 0.01, "high": 0.065, "note": "unchanged since 2026-01-31: absorption record intact.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-06-30", "granularity": "month", "method": "backcast", "p": 0.09347, "low": 0.04052, "high": 0.18144, "headline": "No material change.", "events": [], "components": { "exploitation": { "p": 0.13, "low": 0.06, "high": 0.24, "note": "unchanged since 2026-03-31: −7 day time-to-exploit stands.", "sources": [ { "title": "Mandiant M-Trends 2026", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "date": "2026-03", "raw": "mean time-to-exploit ~−7 days in 2025 (exploitation precedes patch); exploits #1 initial-access vector, 33% of breaches" } ] }, "concentration": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "unchanged since 2026-01-31: no new chokepoint event.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" }, { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.14, "low": 0.065, "high": 0.26, "note": "unchanged since 2026-05-31: automation >53% stands.", "sources": [ { "title": "Thales/Imperva Bad Bot Report 2026", "url": "https://www.imperva.com/blog/bad-bot-report-2026-bots-agentic-age/", "date": "2026-05", "raw": "automated traffic >53% of all web traffic in 2025; AI-driven bot attacks up ~12.5x" } ] }, "fragmentation": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "unchanged since 2026-03-31: record shutdown year confirmed.", "sources": [ { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" } ] }, "resilience": { "p": 0.028, "low": 0.01, "high": 0.065, "note": "unchanged since 2026-01-31: absorption record intact.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-07-31", "granularity": "month", "method": "backcast", "p": 0.09148, "low": 0.03906, "high": 0.17738, "headline": "Two-sided month: Cloudflare Radar puts automation at 57.5% of HTML traffic with AI-agent traffic +7,851% — but crawl-to-referral ratios improve sharply (Anthropic 38,744:1 → 1,917:1), the first evidence mitigation bends the curve.", "events": [ { "date": "2026-07-15", "title": "Crawl-to-referral ratios improve ~20x under blocking pressure", "url": "https://ecorpit.com/ai-crawler-crawl-to-referral-ratio-2026-geo-decision/", "direction": "down", "why": "first measured bend in the extraction curve" } ], "components": { "exploitation": { "p": 0.13, "low": 0.06, "high": 0.24, "note": "unchanged since 2026-03-31: −7 day time-to-exploit stands.", "sources": [ { "title": "Mandiant M-Trends 2026", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "date": "2026-03", "raw": "mean time-to-exploit ~−7 days in 2025 (exploitation precedes patch); exploits #1 initial-access vector, 33% of breaches" } ] }, "concentration": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "unchanged since 2026-01-31: no new chokepoint event.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" }, { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.135, "low": 0.06, "high": 0.25, "note": "Crisis edge, slightly tempered: automation 57.5% of HTML requests (↑) BUT the worst crawl-to-referral ratios improved ~20x in a year under default-blocking pressure (↓) — net: a notch down from May.", "sources": [ { "title": "Cloudflare Radar: bots vs humans (via WorkOS analysis)", "url": "https://workos.com/blog/ai-agent-web-traffic-what-developers-need-to-change", "date": "2026-07", "raw": "automation 57.5% of HTML requests; AI-agent traffic +7,851% YoY" }, { "title": "AI crawl-to-referral ratios (Cloudflare data)", "url": "https://ecorpit.com/ai-crawler-crawl-to-referral-ratio-2026-geo-decision/", "date": "2026-07", "raw": "Anthropic 1,917:1 (from 38,744:1 a year earlier), Perplexity 289:1, OpenAI 251:1, Google 4.7:1" } ] }, "fragmentation": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "unchanged since 2026-03-31: record shutdown year confirmed.", "sources": [ { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" } ] }, "resilience": { "p": 0.026, "low": 0.009, "high": 0.06, "note": "Mitigation evidence: pay-per-crawl + default blocking measurably moved operator behavior inside a year.", "sources": [ { "title": "AI crawl-to-referral ratios (Cloudflare data)", "url": "https://ecorpit.com/ai-crawler-crawl-to-referral-ratio-2026-geo-decision/", "date": "2026-07", "raw": "Anthropic 1,917:1 (from 38,744:1 a year earlier), Perplexity 289:1, OpenAI 251:1, Google 4.7:1" }, { "title": "Cloudflare: AI crawlers blocked by default + Pay Per Crawl", "url": "https://www.cloudflare.com/press-releases/2025/cloudflare-just-changed-how-ai-crawlers-scrape-the-internet-at-large/", "date": "2025-07", "raw": "default block for new domains; pay-per-crawl market in beta" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-08-31", "granularity": "month", "method": "backcast", "p": 0.09148, "low": 0.03906, "high": 0.17738, "headline": "No material change.", "events": [], "components": { "exploitation": { "p": 0.13, "low": 0.06, "high": 0.24, "note": "unchanged since 2026-03-31: −7 day time-to-exploit stands.", "sources": [ { "title": "Mandiant M-Trends 2026", "url": "https://www.helpnetsecurity.com/2026/03/24/mandiant-m-trends-2026-report/", "date": "2026-03", "raw": "mean time-to-exploit ~−7 days in 2025 (exploitation precedes patch); exploits #1 initial-access vector, 33% of breaches" } ] }, "concentration": { "p": 0.11, "low": 0.05, "high": 0.2, "note": "unchanged since 2026-01-31: no new chokepoint event.", "sources": [ { "title": "Major cloud outages of 2025 (incident log)", "url": "https://blog.incidenthub.cloud/major-cloud-outages-2025", "date": "2025-12", "raw": "AWS us-east-1 Oct 2025 ~15h, 1,000+ companies; Cloudflare Nov 18 2025 config crash took X, ChatGPT, Uber; Cloudflare Dec 5 2025 ~25min" }, { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.135, "low": 0.06, "high": 0.25, "note": "unchanged since 2026-07-31: two-sided crawl picture holds.", "sources": [ { "title": "Cloudflare Radar: bots vs humans (via WorkOS analysis)", "url": "https://workos.com/blog/ai-agent-web-traffic-what-developers-need-to-change", "date": "2026-07", "raw": "automation 57.5% of HTML requests; AI-agent traffic +7,851% YoY" }, { "title": "AI crawl-to-referral ratios (Cloudflare data)", "url": "https://ecorpit.com/ai-crawler-crawl-to-referral-ratio-2026-geo-decision/", "date": "2026-07", "raw": "Anthropic 1,917:1 (from 38,744:1 a year earlier), Perplexity 289:1, OpenAI 251:1, Google 4.7:1" } ] }, "fragmentation": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "unchanged since 2026-03-31: record shutdown year confirmed.", "sources": [ { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" } ] }, "resilience": { "p": 0.026, "low": 0.009, "high": 0.06, "note": "unchanged since 2026-07-31: mitigation evidence stands.", "sources": [ { "title": "AI crawl-to-referral ratios (Cloudflare data)", "url": "https://ecorpit.com/ai-crawler-crawl-to-referral-ratio-2026-geo-decision/", "date": "2026-07", "raw": "Anthropic 1,917:1 (from 38,744:1 a year earlier), Perplexity 289:1, OpenAI 251:1, Google 4.7:1" }, { "title": "Cloudflare: AI crawlers blocked by default + Pay Per Crawl", "url": "https://www.cloudflare.com/press-releases/2025/cloudflare-just-changed-how-ai-crawlers-scrape-the-internet-at-large/", "date": "2025-07", "raw": "default block for new domains; pay-per-crawl market in beta" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-09-30", "granularity": "month", "method": "backcast", "p": 0.09324, "low": 0.0397, "high": 0.18118, "headline": "KEV passes 2025's full-year record with a quarter to spare; Cloudflare's share of all websites reaches 25.7%.", "events": [], "components": { "exploitation": { "p": 0.135, "low": 0.062, "high": 0.25, "note": "Strained-high: 249 KEV additions by Oct 2 vs 245 in ALL of 2025 — the record falls with 3 months left; pace ~32% ahead.", "sources": [ { "title": "CISA KEV catalog analysis 2026", "url": "https://theuptimereport.com/cisa-known-exploited-vulnerabilities-analysis-2026/", "date": "2026-10", "raw": "1,733 total; 249 added YTD by Oct 2 vs 245 in all of 2025 — pace ~32% ahead of the record" } ] }, "concentration": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "Strained-high: W3Techs — 25.7% of all websites behind Cloudflare; CDN usage 25% and climbing.", "sources": [ { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.135, "low": 0.06, "high": 0.25, "note": "unchanged since 2026-07-31: two-sided crawl picture holds.", "sources": [ { "title": "Cloudflare Radar: bots vs humans (via WorkOS analysis)", "url": "https://workos.com/blog/ai-agent-web-traffic-what-developers-need-to-change", "date": "2026-07", "raw": "automation 57.5% of HTML requests; AI-agent traffic +7,851% YoY" }, { "title": "AI crawl-to-referral ratios (Cloudflare data)", "url": "https://ecorpit.com/ai-crawler-crawl-to-referral-ratio-2026-geo-decision/", "date": "2026-07", "raw": "Anthropic 1,917:1 (from 38,744:1 a year earlier), Perplexity 289:1, OpenAI 251:1, Google 4.7:1" } ] }, "fragmentation": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "unchanged since 2026-03-31: record shutdown year confirmed.", "sources": [ { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" } ] }, "resilience": { "p": 0.026, "low": 0.009, "high": 0.06, "note": "unchanged since 2026-07-31: mitigation evidence stands.", "sources": [ { "title": "AI crawl-to-referral ratios (Cloudflare data)", "url": "https://ecorpit.com/ai-crawler-crawl-to-referral-ratio-2026-geo-decision/", "date": "2026-07", "raw": "Anthropic 1,917:1 (from 38,744:1 a year earlier), Perplexity 289:1, OpenAI 251:1, Google 4.7:1" }, { "title": "Cloudflare: AI crawlers blocked by default + Pay Per Crawl", "url": "https://www.cloudflare.com/press-releases/2025/cloudflare-just-changed-how-ai-crawlers-scrape-the-internet-at-large/", "date": "2025-07", "raw": "default block for new domains; pay-per-crawl market in beta" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-10-21", "granularity": "week", "method": "live", "p": 0.10563, "low": 0.04584, "high": 0.20279, "headline": "The week the internet got told to turn itself off: two leaked pre-auth PHP RCEs (CVSS 9.2, ~1.5M unpatched exposed hosts) plus a CVSS 10.0 GitLab bug dormant since 2014 — NSA/FBI/CISA/NCSC/CERT-EU advise taking systems offline, Japan's PM posts patch orders, parliaments and Wikipedia go dark. Largest single-week move in the series — and still a third of the alert threshold, because nearly everything that went dark went dark on purpose and PHP patched within ~18 hours of the leak.", "events": [ { "date": "2026-10-20", "title": "php2shell embargo broken — two critical pre-auth PHP RCEs leak before the patch", "url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "direction": "up", "why": "details public a day early; PHP moves the release up" }, { "date": "2026-10-21", "title": "CISA, NSA, FBI, NCSC, CERT-EU: take PHP systems offline until patched", "url": "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "direction": "up", "why": "population-scale disconnect advisories from five major agencies" }, { "date": "2026-10-21", "title": "Japan's PM posts patch instructions; Dutch parliament, Port of Rotterdam, Wikipedia, Archive.org go dark", "url": "https://www.nippon.com/en/news/yjj2026102101249/", "direction": "up", "why": "heads of government and flagship sites act in hours" }, { "date": "2026-10-21", "title": "GitLab CVE-2026-110264: CVSS 10.0 pre-auth RCE in every self-managed release since 2014", "url": "https://byteiota.com/gitlab-cve-2026-110264-cvss-10-0-rce-hits-every-version-since-2014-patch-now/", "direction": "up", "why": "a twelve-year-old maximal-severity bug in the code-hosting layer" }, { "date": "2026-10-21", "title": "PHP ships fixes ~18 hours after the leak; mass offline was precautionary, not forced", "url": "https://www.wiz.io/blog/php2shell-php-rce", "direction": "down", "why": "the response worked: same-day advisories, same-day patches, voluntary precaution" } ], "components": { "exploitation": { "p": 0.19, "low": 0.09, "high": 0.33, "note": "Crisis anchor: population-scale advisories to disconnect are INSIDE the outcome definition's security-collapse clause. Two unauthenticated RCEs in ~⅓ of the web's runtime, embargo broken before the patch, ~1.5M of 2.6M monitored hosts unfixed at release (Censys via press), exploitation attempts same day (watchTowr/vendors; CISA itself had not observed exploitation at publication — sources disagree by hours and the band reflects it). Plus GitLab CVE-2026-110264: CVSS 10.0, pre-auth, every self-managed release since 2014. Found by AI models (Wiz) — a preview of AI-accelerated vuln discovery on BOTH sides.", "sources": [ { "title": "Wiz Research: php2shell (CVE-2026-109618/109619)", "url": "https://www.wiz.io/blog/php2shell-php-rce", "date": "2026-10-21", "raw": "two unauthenticated RCEs in PHP core, CVSSv4 9.2, found with frontier AI models; affects versions back to ~PHP 5" }, { "title": "Huntress: php2shell leaked before the patch", "url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "date": "2026-10-20", "raw": "embargo broken via anonymous HN post Oct 20; PHP moved the release up to Oct 21" }, { "title": "BleepingComputer: PHP ships emergency patches (Censys counts)", "url": "https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/", "date": "2026-10-21", "raw": "~1.5M of ~2.6M monitored PHP hosts on unfixed versions in the hours after release (Censys-derived, press-relayed)" }, { "title": "CISA alert: critical PHP vulnerabilities require immediate patching", "url": "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "date": "2026-10-21", "raw": "\"take PHP-based systems offline until they can be patched\"; no observed exploitation at publication" }, { "title": "watchTowr: php2shell FAQ + honeypot observations", "url": "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "date": "2026-10-21", "raw": "exploitation attempts observed same day as patch" }, { "title": "GitLab CVE-2026-110264: CVSS 10.0 since 2014", "url": "https://byteiota.com/gitlab-cve-2026-110264-cvss-10-0-rce-hits-every-version-since-2014-patch-now/", "date": "2026-10-21", "raw": "pre-auth RCE in every self-managed release since GitLab 7.0 (2014); out-of-band patches" } ] }, "concentration": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "carried from September: the chokepoint picture is unchanged by this week — php2shell is a monoculture event, scored under exploitation.", "sources": [ { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10", "raw": "Cloudflare serves 25.7% of all websites; CDN usage 25%, up from 19.6% a year earlier" } ] }, "slop": { "p": 0.135, "low": 0.06, "high": 0.25, "note": "unchanged since 2026-07-31: two-sided crawl picture holds; no new slop data this week.", "sources": [ { "title": "Cloudflare Radar: bots vs humans (via WorkOS analysis)", "url": "https://workos.com/blog/ai-agent-web-traffic-what-developers-need-to-change", "date": "2026-07", "raw": "automation 57.5% of HTML requests; AI-agent traffic +7,851% YoY" }, { "title": "AI crawl-to-referral ratios (Cloudflare data)", "url": "https://ecorpit.com/ai-crawler-crawl-to-referral-ratio-2026-geo-decision/", "date": "2026-07", "raw": "Anthropic 1,917:1 (from 38,744:1 a year earlier), Perplexity 289:1, OpenAI 251:1, Google 4.7:1" } ] }, "fragmentation": { "p": 0.12, "low": 0.055, "high": 0.22, "note": "Strained-high, up a notch: governments ordering their OWN estates dark (NL parliament, NCSC-NL, Port of Rotterdam, Finland's Valtori) plus a head of government directing a national patch-or-disconnect is state-coordinated mass disconnection as an instrument — voluntary this time.", "sources": [ { "title": "DutchNews: government websites taken offline", "url": "https://www.dutchnews.nl/2026/10/government-websites-taken-offline-over-hacking-vulnerabilities/", "date": "2026-10-21", "raw": "Dutch parliament, NCSC-NL (its own site), Port of Rotterdam, DigiD, hospitals — precautionary offline" }, { "title": "CNBC: government websites go dark", "url": "https://www.cnbc.com/2026/10/21/government-websites-go-dark-as-software-flaw-sparks-security-scramble.html", "date": "2026-10-21", "raw": "Netherlands + Finland (Valtori) pull public-facing government services" }, { "title": "Japan PM Takaichi urges PHP checks (Nippon/Jiji)", "url": "https://www.nippon.com/en/news/yjj2026102101249/", "date": "2026-10-21", "raw": "the Prime Minister posted patch instructions; pixiv, DMM, niconico into emergency maintenance" }, { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record; ~800M people affected; no day in 2025 without an active shutdown" } ] }, "resilience": { "p": 0.03, "low": 0.011, "high": 0.07, "note": "Up slightly — but this week is ALSO a resilience showcase: coordinated disclosure held two months; PHP shipped fixes ~18h after the leak; agencies responded same-day; the things that went offline went offline voluntarily, as precaution. The immune system coordinated at population scale on a Tuesday. Score rises only because the margin (embargo leaks, EOL estate size) visibly thinned.", "sources": [ { "title": "Huntress: php2shell leaked before the patch", "url": "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "date": "2026-10-20", "raw": "embargo broken via anonymous HN post Oct 20; PHP moved the release up to Oct 21" }, { "title": "CISA alert: critical PHP vulnerabilities require immediate patching", "url": "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "date": "2026-10-21", "raw": "\"take PHP-based systems offline until they can be patched\"; no observed exploitation at publication" }, { "title": "CERT-EU advisory 2026-018", "url": "https://cert.europa.eu/publications/security-advisories/2026-018/", "date": "2026-10-21", "raw": "consider isolating internet-facing PHP applications from public networks" }, { "title": "UK NCSC: critical security issue affecting PHP", "url": "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php", "date": "2026-10-21", "raw": "immediate action: inventory the PHP estate" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-22T04:54:55.188Z", "computed_by": "seed-history (session 2026-10-21)" }, { "date": "2026-10-26", "granularity": "week", "method": "live", "p": 0.09408, "low": 0.04235, "high": 0.18219, "headline": "The php2shell week retraces: every site reported dark is back, Nepal's national portals restored, EOL PHP branches back to 5.6 got packaged fixes inside 24h, and CISA still has neither php2shell CVE nor GitLab's CVSS 10.0 in KEV (catalog 2026.10.23, 1,756 entries, 26 October additions vs 43 in September). Exploitation comes off the crisis anchor to strained-high — not back to baseline, because Amazon saw exploit attempts on Oct 17 four days BEFORE disclosure, a honeypot caught 35 real shells, and 59% of 3,532 version-disclosing sites were still pre-fix on Oct 25.", "events": [ { "date": "2026-10-23", "title": "Automated PHPocalypse tracking closes: all sites reported dark have recovered", "url": "https://allixsenos.github.io/phpocalypse-tracker/", "direction": "down", "why": "the voluntary mass-offline that drove last week's crisis anchor lasted days, not weeks" }, { "date": "2026-10-26", "title": "Nepal restores most government websites after php2shell patching", "url": "https://kathmandupost.com/science-technology/2026/10/26/most-nepal-government-websites-back-online-after-php2shell-flaw", "direction": "down", "why": "a whole national estate went dark and came back under a week" }, { "date": "2026-10-22", "title": "EOL PHP 7.4/8.0/8.1 get packaged backports; Red Hat errata same day as the patch", "url": "https://computingforgeeks.com/php2shell-end-of-life-php-backport/", "direction": "down", "why": "the unsupported long tail — the part with no patch path — got one within 24h" }, { "date": "2026-10-23", "title": "CISA KEV at 1,756 entries; neither php2shell CVE nor GitLab CVE-2026-110264 added", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "direction": "down", "why": "no KEV-standard confirmed exploitation five days in, and October's addition rate (26) is below September's (43)" }, { "date": "2026-10-25", "title": "Exploit attempts predate disclosure by four days; honeypot catches 35 spawned shells; 59% of version-disclosing sites still pre-fix", "url": "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "direction": "up", "why": "real RCE in the wild plus a large unpatched residue, including 1,157 sites on end-of-life branches" }, { "date": "2026-10-25", "title": "Suspected Lazarus-linked operator works a 216-host target set across 12 countries", "url": "https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html", "direction": "up", "why": "state-actor targeting of government, finance, airports and logistics on the residual exposed set" }, { "date": "2026-10-21", "title": "GitLab's second CVSS 10.0 in nine days re-exposes everyone who patched on Oct 12", "url": "https://dev.to/sorrelthorncroft/gitlabs-second-perfect-score-in-nine-days-why-anyone-who-patched-on-12-october-is-still-exposed-4i31", "direction": "up", "why": "patch velocity is high but patch *finality* is not: 19.4.2 was fixed on Oct 12 and vulnerable again on Oct 21" }, { "date": "2026-10-20", "title": "Access Now: 'Deliberately forgotten' — indefinite shutdowns rising year over year", "url": "https://www.accessnow.org/indefinite-internet-shutdowns/", "direction": "up", "why": "the structural fragmentation indicator worsens even as this week's voluntary disconnects resolve" }, { "date": "2026-10-23", "title": "Iranian outlet reports a standing directive to cut international connectivity on renewed war", "url": "https://insights.niacouncil.org/p/report-of-new-wartime-internet-shutdown", "direction": "neutral", "why": "single unverified outlet, no document, no official confirmation — logged, not scored" }, { "date": "2026-10-26", "title": "Explicit ALLOW rules for answering bots triple year over year", "url": "https://technologychecker.io/blog/robots-txt-ai-crawlers-blocking-report", "direction": "down", "why": "publishers negotiating crawl terms is the open web adapting, not abandoning" } ], "components": { "exploitation": { "p": 0.15, "low": 0.08, "high": 0.26, "note": "Strained-high anchor (~9-15%), down from last week's crisis 0.19. The clause that put it at crisis — population-scale advisories to disconnect — has expired: the advisories are closed, every site reported dark has recovered (PHPocalypse tracker stopped Oct 23 with the dark list emptied), Nepal's national portals are back, and EOL branches 7.4/8.0/8.1 had packaged fixes within ~24h (Remi, cPanel, DirectAdmin, Ubuntu 22.04, Red Hat errata RHSA-2026:87151/87080 on Oct 21). Raw indicators: CISA KEV catalog 1,756 entries at catalogVersion 2026.10.23, with CVE-2026-109618, CVE-2026-109619 and GitLab CVE-2026-110264 all ABSENT — no KEV-standard exploitation confirmation five days on; October KEV additions 26 vs September 43; 8 additions in the Oct 19-25 window (Arista VeloCloud, Collabora, 4x Plex, Siemens, SiteGuard), none php2shell. Does NOT return to the 0.135 pre-event baseline because three things are new and real: Amazon telemetry shows exploit attempts on Oct 17, four days before disclosure (zero-day use, not post-disclosure opportunism); a researcher honeypot logged 35 shells started by Apache workers after exploit requests on unpatched 8.4.26 (actual RCE, not just scanning); and the residue is large — 59% of 3,532 sites with readable version headers were still pre-fix in the Oct 21-25 checker window (914 on supported branches, 1,157 on EOL), against millions of attempts observed by Cloudflare and ~250k requests from ~3,200 IPs seen by Fastly through Oct 22. Unit 42's agentic-AI post-exploitation case (hashes + MFA secrets in two hours) stands as tradecraft even though it retracted php2shell as the initial-access vector — the band's width carries that disagreement.", "sources": [ { "title": "CISA Known Exploited Vulnerabilities catalog (JSON feed)", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "date": "2026-10-23", "raw": "catalogVersion 2026.10.23, count 1756; 272 added in 2026 vs 245 in all of 2025; monthly adds Aug 31 / Sep 43 / Oct 26; CVE-2026-109618, CVE-2026-109619, CVE-2026-110264 all absent" }, { "title": "Brandefense: PHP2Shell checker results and exploitation observations", "url": "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "date": "2026-10-26", "raw": "checker ran 40,849 times on 30,027 sites Oct 21-25; of 3,532 with readable versions, 59% pre-fix (914 supported branches, 1,157 EOL); Amazon logged earliest exploit attempt Oct 17 (4 days pre-disclosure); Oct 24 honeypot: 35 shells started by Apache workers after exploit requests on PHP 8.4.26" }, { "title": "The Hacker News: PHP2Shell exploitation attempts continue amid suspected DPRK scanning", "url": "https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html", "date": "2026-10-25", "raw": "CYFIRMA: 216 unpatched/partially mitigated hosts across 12 countries, moderate-confidence Lazarus-ecosystem attribution, moved from recon to low-and-slow scanning; Cloudflare 'millions of exploitation attempts'; Unit 42 retracted php2shell as the initial-access vector in its European government case" }, { "title": "Actively exploited this week: 8 new CISA KEV entries (19-25 October 2026)", "url": "https://dev.to/devaland/actively-exploited-this-week-8-new-cisa-kev-entries-19-october-to-25-october-2026-4ok", "date": "2026-10-25", "raw": "Arista VeloCloud CVE-2026-114625, Collabora CVE-2026-110447, Plex CVE-2026-96652/96654/96655/96656, Siemens CVE-2026-110936, SiteGuard CVE-2026-106931; none with known ransomware use at publication" }, { "title": "GitLab's second perfect score in nine days", "url": "https://dev.to/sorrelthorncroft/gitlabs-second-perfect-score-in-nine-days-why-anyone-who-patched-on-12-october-is-still-exposed-4i31", "date": "2026-10-23", "raw": "CVE-2026-97229 (Oct 12, fixed 19.4.2) then CVE-2026-110264 (Oct 21, fixed 19.4.3) — same Onigmo integer overflow, same reporter; Oct 12 patchers are inside the affected range again" }, { "title": "Wikipedia: PHP2Shell", "url": "https://en.wikipedia.org/wiki/PHP2Shell", "date": "2026-10-26", "raw": "discovered Aug 1 2026, leaked Oct 20, patched Oct 21 13:34 UTC in 8.2.35/8.3.36/8.4.27/8.5.12; affects PHP 5.4-8.5 across ~70% of websites; source patches for EOL 7.4/8.0/8.1" } ] }, "concentration": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "Unchanged since 2026-09-30. No new chokepoint incident in the Oct 21-26 window: AWS, Azure, Akamai and Cloudflare status pages stayed clear through the php2shell week, and the month's largest cloud event remains the Oct 20 Google Cloud europe-west2 power incident — one region, ~8 hours, fully resolved. php2shell is a runtime-monoculture event and is scored under exploitation, not here. Standing indicator re-fetched today: W3Techs reads Cloudflare at 28.0% of all websites (86.0% of the reverse-proxy market) with 32.6% of sites behind some reverse proxy. Honesty note on the delta: the 2026-09-30 entry recorded 25.7% from this same page, and a 2.3pp move in under four weeks is not credible for a W3Techs series — treat today's LEVEL as the indicator and the apparent jump as a probable metric mismatch in the earlier read (reverse-proxy share vs the CDN sub-metric) until a second weekly read confirms a direction.", "sources": [ { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-10-26", "raw": "Cloudflare 28.0% of all websites and 86.0% of the reverse-proxy market; 32.6% of sites use a monitored reverse proxy; Amazon CloudFront 1.7%, Fastly 0.9%" } ] }, "slop": { "p": 0.13, "low": 0.058, "high": 0.24, "note": "Down a half-notch from 0.135, still elevated (~5-8% band's top shading into strained). Fresh Cloudflare Radar read: bots were 35.49% of requests in Q3 2026 against 30.13% in Q3 2025 (+5.36pp YoY, and not monotonic — March 2026 fell 0.99pp, July fell 0.04pp), with AI-related categories at 32.49% of verified-bot traffic (crawlers 22.12%, search 7.03%, assistants 3.35%). The move down is the mitigation side finally showing a measurable number rather than an argument: across 4,242 robots.txt files sampled Sep 28 2026, the shift since Sep 2025 is not more blocking but more explicit ALLOWING — GPTBot's block-to-allow ratio fell from 2.24:1 to 1.60:1 and allow rules for it tripled from 2.51% to 7.69% of files, while training crawlers stay blocked more than allowed (Bytespider 3.83:1, CCBot 2.61:1, ClaudeBot 1.58:1) and answering bots are allowed at or above parity (OAI-SearchBot 0.91:1). Publishers differentiating training from answering is a crawl market forming, which is the opposite of abandoning open publishing. Note the metric change from prior entries: this is Radar's share-of-requests series, not the 57.5%-of-HTML-requests automation figure carried since July.", "sources": [ { "title": "Bot traffic statistics Q3 2026 (Cloudflare Radar)", "url": "https://technologychecker.io/blog/bot-traffic-statistics", "date": "2026-10-01", "raw": "Q3 2026: 35.49% bots / 64.51% human; Sept 2026 provisional 36.15%; Q3 2025 was 30.13%; AI-related 32.49% of verified-bot traffic; data pulled Oct 1 2026" }, { "title": "robots.txt across Cloudflare's network: blocking training, allowing answering", "url": "https://technologychecker.io/blog/robots-txt-ai-crawlers-blocking-report", "date": "2026-09-28", "raw": "4,242 robots.txt parsed Sep 28 2026; GPTBot block:allow 2.24:1 (Q2) to 1.60:1 (Q3), allow rules 2.51% to 7.69% of files YoY; Bytespider 3.83:1, CCBot 2.61:1, ClaudeBot 1.58:1; OAI-SearchBot 0.91:1" } ] }, "fragmentation": { "p": 0.118, "low": 0.054, "high": 0.215, "note": "Strained, essentially flat (0.12 to 0.118) — two opposite moves nearly cancelling. Down: last week's score was lifted by states ordering their OWN estates dark (NL parliament, NCSC-NL, Port of Rotterdam, Finland's Valtori) plus a head of government directing a national patch-or-disconnect; all of that has resolved inside a week, and Nepal's thousands of government sites are mostly restored as of today. Up: the structural indicator got worse, not better. Access Now published 'Deliberately forgotten: internet shutdowns with no end' on Oct 20 — its finding is that indefinite shutdowns have risen every year, with perpetrators aiming to keep whole populations permanently offline (Myanmar's 'internet dead zone', new Tigray disconnections after the earlier 2+ year cut, Annobon, Sudan, Gaza). Internet Society Pulse today: 10 shutdowns ongoing, the oldest running since Jan 2019 (China), Feb 2021 (Myanmar), Feb 2022 (Russia); 69 total or partial shutdowns across 8 countries in the last twelve months, ~18,234 hours of lost access. India ran repeat Delhi-area mobile cuts in October (Oct 2 at 1.5km radius, Oct 9-10 at 4km). Logged but NOT scored: an Iranian outlet's Oct 21 report of a standing directive to cut international connectivity on renewed war — single source, no document, no official confirmation, so it does not move the number. The 2025 #KeepItOn annual count (313 shutdowns, 52 countries, worst on record) remains the reference level.", "sources": [ { "title": "Access Now: Deliberately forgotten — internet shutdowns with no end", "url": "https://www.accessnow.org/indefinite-internet-shutdowns/", "date": "2026-10-20", "raw": "prolonged shutdowns have risen each year; Myanmar 'internet dead zone', new Tigray cuts after a 2+ year disconnection, plus Annobon, Gaza, Sudan, Kashmir, Nigeria, Pakistan, Uganda, Russia; new ongoing-shutdown dashboard launched" }, { "title": "Internet Society Pulse: shutdowns", "url": "https://pulse.internetsociety.org/en/shutdowns/", "date": "2026-10-26", "raw": "10 ongoing shutdowns as of Oct 26 2026 (China since 2019-01-01, Myanmar 2021-02-02, Russia 2022-02-26, Equatorial Guinea 2024-07-20, Iraq 2025-02-18, Togo 2025-06-26, Pakistan 2025-08-05, Uganda 2026-01-17, Gabon 2026-02-18); 69 total/partial shutdowns across 8 countries since Oct 2025, ~18,234 hours lost" }, { "title": "Kathmandu Post: most Nepal government websites back online after PHP2Shell flaw", "url": "https://kathmandupost.com/science-technology/2026/10/26/most-nepal-government-websites-back-online-after-php2shell-flaw", "date": "2026-10-26", "raw": "thousands of government sites taken offline the prior week; SDOC completed patching and audits, most portals restored; Medical Education Commission site and Nagarik App still down" }, { "title": "NIAC Insights: report of a new wartime internet shutdown order in Iran", "url": "https://insights.niacouncil.org/p/report-of-new-wartime-internet-shutdown", "date": "2026-10-23", "raw": "Zoomon reported Oct 21 that unnamed 'higher authorities' issued a binding directive for an immediate international cutoff on renewed war; no document, scope unknown, no official confirmation" }, { "title": "Medianama: internet shutdown ordered around New Delhi's Jantar Mantar", "url": "https://www.medianama.com/2026/10/223-internet-shutdown-new-delhi-jantar-mantar/", "date": "2026-10", "raw": "MHA 'top secret' order suspended mobile internet in a 4km radius of Janpath-Kartavya Path from 22:00 Oct 9 to 22:00 Oct 10, ~2.5x the area of the Oct 2 shutdown; no stated grounds" }, { "title": "Access Now: internet shutdowns in 2025", "url": "https://www.accessnow.org/internet-shutdowns-2025/", "date": "2026-03", "raw": "313 shutdowns in 52 countries — worst year on record, above 2024's 304 and 2023's 289; 100 countries have had a shutdown since 2016; 75 still ongoing when 2026 began" } ] }, "resilience": { "p": 0.024, "low": 0.009, "high": 0.06, "note": "Quiet anchor, back below the 0.026 pre-event baseline (from 0.03): last week this rose because the margin looked thin, and the week that followed is the strongest recovery evidence the series has recorded. The whole cycle — disclosure to patch to packaged backports to estate restored — ran in five days on roughly 70% of the web's runtime. PHP shipped fixes ~18h after the embargo broke (Oct 21 13:34 UTC); Red Hat errata RHSA-2026:87151/87080 landed the same day with Rocky syncing overnight; the EOL branches that officially have no patch path got real installable builds inside ~24h (Remi 7.4.33-31/8.0.30-21/8.1.34-6, cPanel EasyApache 4, DirectAdmin, Ubuntu 22.04 8.1.2-1ubuntu2.28, AlmaLinux), with third-party packaging reaching back to PHP 5.6; the PHPocalypse tracker closed automated monitoring on Oct 23 with every site reported dark recovered; Nepal's national estate is mostly back. Against that, two real deductions keep it from going lower: detection trailed attackers by four days (Amazon's Oct 17 telemetry), and GitLab shipped two CVSS 10.0 pre-auth RCEs nine days apart in the same bundled regex engine, the second re-exposing everyone who completed the first — fast patching that does not stay patched is a thinner margin than the headline velocity suggests. The 30-year base rate holds: this was another absorbed internet-killer.", "sources": [ { "title": "PHP2Shell fix for EOL PHP 8.1, 8.0 and 7.4", "url": "https://computingforgeeks.com/php2shell-end-of-life-php-backport/", "date": "2026-10-22", "raw": "PHP published minimal source mitigations for EOL 7.4/8.0/8.1; packagers shipped builds within ~24h (Remi 7.4.33-31, 8.0.30-21, 8.1.34-6; cPanel EA4; DirectAdmin; Ubuntu 22.04 8.1.2-1ubuntu2.28; AlmaLinux; Red Hat errata RHSA-2026:87151 and RHSA-2026:87080 on Oct 21, Rocky synced overnight)" }, { "title": "PHPocalypse tracker (php2shell outage log)", "url": "https://allixsenos.github.io/phpocalypse-tracker/", "date": "2026-10-25", "raw": "automated tracking stopped Oct 23 2026 with all sites reported dark recovered; 124 further sites imported from phpvulnerabilities.app on Oct 25; crowdsourced, no aggregate totals published" }, { "title": "Kathmandu Post: most Nepal government websites back online", "url": "https://kathmandupost.com/science-technology/2026/10/26/most-nepal-government-websites-back-online-after-php2shell-flaw", "date": "2026-10-26", "raw": "SDOC completed security updates and audits; most government portals restored after days offline" }, { "title": "Wikipedia: PHP2Shell timeline", "url": "https://en.wikipedia.org/wiki/PHP2Shell", "date": "2026-10-26", "raw": "patches released Oct 21 2026 at 13:34 UTC, ~18h after the Oct 20 leak; third-party packaging carried the fix back to PHP 5.6" }, { "title": "GitLab's second perfect score in nine days", "url": "https://dev.to/sorrelthorncroft/gitlabs-second-perfect-score-in-nine-days-why-anyone-who-patched-on-12-october-is-still-exposed-4i31", "date": "2026-10-23", "raw": "two CVSS 10.0 pre-auth RCEs nine days apart in the same Onigmo regex compiler; fixed versions 19.4.2 then 19.4.3, so completing the first patch left instances in the second's affected range" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-10-26T13:42:19.070Z", "computed_by": "weekly-job" }, { "date": "2026-11-02", "granularity": "week", "method": "live", "p": 0.09492, "low": 0.04199, "high": 0.18733, "headline": "The number barely moves; everything under it does. CISA added both php2shell CVEs to KEV on 2026-10-26 — the same day last week's entry scored them ABSENT and took exploitation off the crisis anchor partly for that reason — with a three-day federal due date and forensic-triage order; a CVSS 9.8 unauthenticated use-after-free in the IPv4 TCP handshake of every Linux kernel since 4.4 landed Oct 30 with Ubuntu and RHEL still unpatched; and Freedom on the Net 2026 reports a 16th consecutive annual decline around Iran's ~88-day nationwide shutdown, the longest it has ever recorded. Offsetting all of it: php2shell measurably could not be sprayed — five deliberately exposed vulnerable sites went eight days uncompromised, a lab exploit worked once in ~24 tries, and 85% of supported PHP branches were fixed within six days. Net +0.08pt, held up by fragmentation alone.", "events": [ { "date": "2026-10-26", "title": "CISA adds both php2shell CVEs to KEV with a three-day federal due date and forensic-triage requirement", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "direction": "up", "why": "reverses last week's key down-argument: CVE-2026-109618/109619 were recorded ABSENT on catalogVersion 2026.10.23 and were added on the day that entry published" }, { "date": "2026-10-30", "title": "CVE-2026-98432: CVSS 9.8 pre-auth use-after-free in the Linux IPv4 TCP handshake, every kernel since 4.4", "url": "https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/", "direction": "up", "why": "second AI-discovered critical pre-auth RCE in universal infrastructure in ten days; Ubuntu and RHEL shipped nothing in the first five days while Debian, Amazon, SUSE and Oracle did" }, { "date": "2026-10-29", "title": "Tenable and Bitsight, one week on: no mass compromise — php2shell needs per-build tuning, not a sprayable string", "url": "https://www.tenable.com/blog/php2shell-one-week-later-why-one-exploit-doesnt-work-everywhere", "direction": "down", "why": "five internet-exposed vulnerable sites uncompromised through Oct 29; Intel 471's exploit succeeded once in ~24 lab attempts; Bitsight saw one chain-shaped sequence and no verified mass compromise" }, { "date": "2026-10-29", "title": "Bitsight patch telemetry: 85% of supported-branch PHP hosts fixed by Oct 27 — and only 6.4% of 5.34M EOL hosts", "url": "https://www.bitsight.com/blog/php2shell-scanning-exploitation-patching", "direction": "neutral", "why": "the fastest mass-patch curve the series has recorded, on a denominator ten times larger than previously scored (29.2M hosts, 18.4M vulnerable) — and a newly measured ~11M-host reservoir that can never be patched" }, { "date": "2026-10-22", "title": "Freedom on the Net 2026: 16th consecutive annual decline; Iran's ~88-day nationwide shutdown the longest the report has recorded", "url": "https://freedomhouse.org/report/freedom-net/2026/seismic-shifts-global-internet", "direction": "up", "why": "a canonical standing indicator, not cited in the Oct 26 entry, and it reads worse: Iran now runs a two-tier internet and Kyrgyzstan routes all international traffic through a state carrier" }, { "date": "2026-10-27", "title": "Cloudflare Q3 2026 disruption summary: 49 disruptions, 19 government-directed, most recovered in hours", "url": "https://blog.cloudflare.com/q3-2026-internet-disruption-summary", "direction": "down", "why": "14 of 49 recovered under an hour and 16 under three; 18 of the 19 government-directed events were Iraqi exam shutdowns of 15-90 minutes; the worst was regional (Tigray, 10 days)" }, { "date": "2026-11-02", "title": "Second weekly W3Techs read resolves last week's metric-mismatch caveat: Cloudflare at 28.4%, up 0.4pp week over week", "url": "https://w3techs.com/technologies/overview/proxy", "direction": "neutral", "why": "the Oct 26 entry asked for exactly this confirmation — the ~28% level is real and the earlier 25.7%/28.0% gap was a metric mismatch, not a three-week migration" }, { "date": "2026-10-30", "title": "Ivanti Connect Secure zero-days chained in attacks (KEV Oct 30); GitLab CVE-2026-97229 KEV Oct 29; Oracle E-Business Suite moves from probing to compromise", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "direction": "up", "why": "October KEV additions revised up from the 26 scored last week to 36; 282 additions YTD against 245 in all of 2025" } ], "components": { "exploitation": { "p": 0.15, "low": 0.075, "high": 0.28, "note": "Held at the strained-high ceiling (~9-15%), with a WIDER band — because this week delivered two large updates in opposite directions and they land on the same number. UP, and it is the sharper correction: last week's note scored CVE-2026-109618/109619 as ABSENT from KEV ('no KEV-standard exploitation confirmation five days on') off catalogVersion 2026.10.23; CISA added BOTH on 2026-10-26, the day that entry published, with dueDate 2026-10-29 — a three-day federal deadline — and forensicTriage set, describing each as unauthenticated RCE. The catalog is now 1,766 entries (2026.10.30) and October's additions are 36, not the 26 scored last week, putting 2026 at 282 against 245 in ALL of 2025. The same window added Ivanti Connect Secure CVE-2026-118527/111357 (zero-days chained in attacks, KEV Oct 30), GitLab CVE-2026-97229 (KEV Oct 29), Palo Alto devices rooted via php2shell per Bitsight, and Oracle E-Business Suite CVE-2026-101767 moving from probing to compromise. Then CVE-2026-98432 on Oct 30: an unauthenticated use-after-free race in the IPv4 TCP connection-request path of every Linux kernel since 4.4, scored 9.8 by the kernel CVE team, with Anthropic researchers demonstrating remote root in ~53 minutes and a KASLR bypass using an unreleased Claude model — the second AI-discovered critical pre-auth RCE in universal infrastructure in ten days. DOWN, and it is the more fundamental finding: the mass-exploitation thesis failed measurement on the best test case anyone could ask for. Tenable kept five vulnerable PHP sites reachable from the internet and none were compromised through Oct 29; exploitation requires an exploit tuned to the target's heap state, SAPI, extensions and FPM pool, and chunk offsets shift with every patch release, so there is no universal offset; Intel 471's public exploit achieved code execution once in roughly 24 lab attempts; Bitsight saw exactly one chain-shaped sequence across its sensor fleet and no verified mass compromise. Bitsight also replaces last week's 3,532-site checker sample with a real denominator — 29.2M PHP hosts, 18.4M (63.1%) on a vulnerable version, Censys ~30.3M on Oct 29 — and the patch curve on that denominator is far better than the 59%-pre-fix snapshot scored last week: supported branches 68.6% of 4.13M fixed within a week, 85% by Oct 27. What stops the down-move from winning is the other half of that same denominator, newly quantified: 59.5% of the exposed population (~11M hosts) runs an EOL branch, 6.4% of 5.34M EOL hosts patched, and 91% of 1.73M PHP 7.4 hosts were still on 7.4 a week later. A permanent reservoir of ~11M unpatchable internet-facing hosts is this component's thesis in its structural form, and it is now measured rather than asserted. Band widened to 0.075-0.28 because the sources genuinely disagree: Red Hat scores the kernel bug 5.9 and calls it mainly denial-of-service, RCE is unproven without an MPTCP listener, and the php2shell patch trackers span 6% to 38% depending on whether they count EOL hosts and distro backports.", "sources": [ { "title": "CISA Known Exploited Vulnerabilities catalog (raw JSON feed)", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "date": "2026-10-30", "raw": "catalogVersion 2026.10.30, count 1,766 (was 1,756 at 2026.10.23); CVE-2026-109618 'PHP Memory Corruption' and CVE-2026-109619 'PHP Stale Internal Request-State' both dateAdded 2026-10-26, dueDate 2026-10-29, forensicTriage Yes, shortDescription 'allows for unauthenticated remote code execution', BOD 26-04 cited; Ivanti Connect Secure CVE-2026-118527 + CVE-2026-111357 added 2026-10-30; GitLab CVE-2026-97229 added 2026-10-29; Cisco ASA/FTD CVE-2026-76418 Oct 29; October 2026 additions 36 vs September 43; 282 additions YTD 2026 vs 245 in all of 2025 and 1,453 total on 2025-11-02; CVE-2026-98432 and GitLab CVE-2026-110264 both still ABSENT" }, { "title": "Tenable: php2shell one week later — why one exploit doesn't work everywhere", "url": "https://www.tenable.com/blog/php2shell-one-week-later-why-one-exploit-doesnt-work-everywhere", "date": "2026-10-29", "raw": "five internet-reachable vulnerable PHP sites kept exposed, none compromised as of Oct 29; exploitation depends on heap state, process manager, worker reuse and memory layout; chunk offsets change per release so no universal offset; working RCE on PHP 7.4.33 only once the exploit matched that single setup; Censys ~30.3M PHP services on an affected version Oct 29; 35 successful shell executions across three honeypot sensors (Adel Karimi) Oct 24; Log4Shell-style mass exploitation judged 'much less likely'; appliances sharing one build are the exception" }, { "title": "Bitsight: php2shell scanning, exploitation and patching data", "url": "https://www.bitsight.com/blog/php2shell-scanning-exploitation-patching", "date": "2026-10-29", "raw": "29.2M PHP hosts observed, 18.4M (63.1%) advertising a vulnerable version; supported branches (8.2-8.5) 68.6% of 4.13M patched within a week — 8.5/8.4 77%, 8.3 66%, 8.2 62%; daily supported-branch fixed share 9.8% release day, 55% Oct 22, 78% Oct 24, 85% Oct 27; EOL branches 6.4% of 5.34M; all-hosts curve flattens ~38%; 59.5% (~11M) on an EOL branch; PHP 7.4 = 1.73M hosts, 91% still on 7.4 after a week; 47.9% of vulnerable hosts on PHP 7 or older; one chain-shaped sequence across sensors, no verified mass compromise; Palo Alto reported active exploitation on some devices Oct 29" }, { "title": "BleepingComputer: critical Linux kernel flaw allows remote root attacks on MPTCP servers", "url": "https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/", "date": "2026-10-30", "raw": "CVE-2026-98432, use-after-free race in IPv4 TCP connection-request handling, every kernel since 4.4; CVSS 9.8 from the kernel CVE team vs Red Hat 5.9 / mainly DoS; Anthropic researchers built a working root exploit with an unreleased Claude model, ~53 minutes, KASLR bypassed, against an MPTCP listener; RCE not publicly demonstrated without an MPTCP listener; no confirmed in-the-wild exploitation; Go 1.24+ opens MPTCP listeners by default on Linux" }, { "title": "SecurityWeek: php2shell exploitation started days before patches", "url": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/", "date": "2026-10-22", "raw": "Amazon MadPot recorded the first attempt Oct 17, four days pre-patch and under embargo; Cloudflare saw thousands of attempts in the 10 hours before announcement rising to millions; VulnCheck saw a Chinese IP attempt a webshell; WatchTowr: none of the circulating PoCs achieve RCE; Censys ~1.57M of 1.58M version-identifiable hosts unpatched Oct 21; ~920k PHP hosts in the US concentrated on AWS, DigitalOcean, Alibaba, OVHcloud, Hetzner" } ] }, "concentration": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "Unchanged since 2026-09-30, and this week RESOLVES the honesty caveat the Oct 26 entry left open rather than moving the score. That entry read Cloudflare at 28.0% of all websites against 25.7% recorded on Sep 30, called a 2.3pp move in four weeks not credible for a W3Techs series, and asked for a second weekly read to confirm the level or the direction. Today's re-fetch: 28.4% of all websites, 86.1% of the reverse-proxy market, 33.0% of sites behind a monitored reverse proxy — a 0.4pp week-over-week move on a level that holds. So the ~28% LEVEL is the indicator and the earlier gap was a metric mismatch (reverse-proxy share versus the CDN sub-metric), exactly as suspected; no score change is warranted for a measurement artefact being identified. The gap to the next provider is the real finding and it is unchanged: CloudFront 1.7%, Fastly 0.9%, DDoS-Guard 0.7%, Akamai 0.6%. No new chokepoint incident occurred between Oct 26 and Nov 2 — no major CDN, cloud, DNS or BGP outage, with the nearest events (Cloudflare One Gateway ~3h on Oct 20, Akamai Edge DNS Oct 2, Google Cloud europe-west2 power Oct 20) all predating the window and all sub-day. Cloudflare's own Q3 telemetry is the counterweight to the share number: 49 observed disruptions, not one caused by platform concentration and not one at quarter-of-users scale. php2shell remains scored under exploitation per the Oct 21 rule, but it is worth recording that it was a runtime-monoculture event — the chokepoint class this component's indicators do not measure.", "sources": [ { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-11-02", "raw": "Cloudflare 28.4% of all websites and 86.1% of the reverse-proxy market (28.0% / 86.0% on 2026-10-26); 33.0% of sites use a monitored reverse proxy (32.6% last week), 67.0% use none; Amazon CloudFront 1.7% / 5.3%, Fastly 0.9% / 2.8%, DDoS-Guard 0.7% / 2.2%, Akamai 0.6% / 1.9%" }, { "title": "Cloudflare: what took the Internet offline in Q3 2026", "url": "https://blog.cloudflare.com/q3-2026-internet-disruption-summary", "date": "2026-10-27", "raw": "49 disruptions observed in Q3 2026; 19 government-directed, 14 power, 5 natural disaster, remainder cable/cyberattack/technical (Guyana cable cut, Portugal reported cyberattack, Phoenix cooling failure); none attributed to provider concentration; Cloudflare carries more than 20% of web traffic" } ] }, "slop": { "p": 0.13, "low": 0.058, "high": 0.24, "note": "Carried forward unchanged from 2026-10-26. The standing indicators were re-fetched and the two-sided picture holds, but the honest reason the number does not move is that this week's best available read comes from a DIFFERENT sample than last week's, and switching series is not a finding. Last week scored Cloudflare Radar's share-of-requests series (bots 35.49% of requests in Q3 2026 vs 30.13% in Q3 2025) plus a 4,242-file robots.txt parse from Sep 28. This week's read is a third-party compilation of Radar monthly data covering Oct 1-30 and a 114,605-domain robots.txt scan dated Oct 26 — comparable to each other month over month, not to last week's figures, so it is recorded as a level and not a delta. WORSE on the economics: Perplexity's crawl-to-referral ratio went 112:1 in January to 2,373:1 in September to 4,056:1 in October, a 36-fold deterioration in ten months, and Mistral has returned no measurable referrals since August. Imperva's 2026 Bad Bot Report (Apr 2026, 2025 data) still puts automated traffic above 53% of all web traffic, up from 51%, with the human share declining. BETTER, and it is why this does not rise: Anthropic's ClaudeBot improved from 47,779:1 in January to 549:1 in September to 482:1 in October — a 99-fold reversal that proves a crawl-to-referral ratio is a policy choice and not a law of nature — while Google holds at 4.8:1 and Yandex improved from 31:1 to 16:1. Mitigation adoption keeps climbing on its own sample too: 81.7% of 114,605 scanned domains carried AI-crawler rules in robots.txt on Oct 26, up from ~80% on Oct 5, with GPTBot gaining 93 and ClaudeBot 94 new disallowing files in three weeks. That sits alongside, not against, last week's finding that publishers are increasingly ALLOWING answering bots while blocking training crawlers: a market pricing crawl differently by purpose is the opposite of open publishing being abandoned.", "sources": [ { "title": "SEOmator GEO data report: crawl-to-refer ratios and bot share (Cloudflare Radar derived)", "url": "https://seomator.com/blog/crawl-to-refer-ratio-ai-crawlers-llm-bots", "date": "2026-10-31", "raw": "data window Radar monthly Jan-Sep 2026 plus Oct 1-30; Oct 2026 Cloudflare network: humans 35.0%, non-AI bots 54.6%, AI bots 6.3% (5.3% Sep), mixed-purpose crawlers 4.0%. Crawl-to-referral Oct / Sep / Jan: Perplexity 4,056:1 / 2,373:1 / 112:1; Anthropic ClaudeBot 482:1 / 549:1 / 47,779:1; OpenAI GPTBot 775:1 / 341:1 / 1,309:1; Google 4.8:1 / 4.7:1 / 4.7:1; Yandex 16:1 / 31:1; Mistral no measurable referrals since August. robots.txt scan 2026-10-26: 81.7% of 114,605 domains carry AI-crawler rules (~80% on Oct 5); of 4,367 files parsed, GPTBot disallowed in 14.6%, ClaudeBot 13.0%, CCBot 12.5%, Google-Extended 11.7%, Bytespider 11.5%; GPTBot +93 and ClaudeBot +94 disallowing files since the Oct 5 scan" }, { "title": "Imperva/Thales Bad Bot Report 2026: bots in the agentic age", "url": "https://www.imperva.com/blog/bad-bot-report-2026-bots-agentic-age/", "date": "2026-04-29", "raw": "automated traffic above 53% of all web traffic in 2025, up from 51% the prior year; human share 47% and still declining; 27% of bot attacks target API endpoints; financial services 24% of all bot attacks and 46% of account-takeover incidents; counts all web traffic including app and API calls, so not comparable to Radar's HTML-request series" } ] }, "fragmentation": { "p": 0.125, "low": 0.057, "high": 0.225, "note": "Up from 0.118 to 0.125 — the only component that moves this week, and it moves on a canonical standing indicator the Oct 26 entry did not have. Freedom on the Net 2026 published Oct 22: a 16th consecutive annual decline in internet freedom, conditions worsening in 16 of the 38 countries covered against 8 improving (34 countries paused this edition). Its centerpiece is Iran's roughly 88-day nationwide shutdown, the longest Freedom on the Net has recorded in sixteen years, on top of a 20-day near-total shutdown in January 2026 — and what makes it a fragmentation datapoint rather than an availability one is what replaced it: Iran now operates a two-tiered internet in which most of the population is cut off from the global net while 'Internet Pro' packages reach it at five times the price of conventional service. Kyrgyzstan's decree routing ALL international traffic through state-owned ElKat was extended, Russia maintains a register of 'socially significant services' that providers must keep reachable during shutdowns, and Russia ran a 19-day mobile shutdown in Moscow in March 2026. These are states building and operating the partition, not merely switching things off, which is the mechanism the outcome definition's fragmentation clause describes. It rises only a notch, because scale is the binding constraint and nothing here approaches it: Iran is roughly 1% of the world's users, and Cloudflare's Q3 count of 19 government-directed disruptions is dominated by 18 Iraqi exam shutdowns lasting 15-90 minutes, with the worst government-directed event regional (Tigray, 10 days, region -100%, country-level HTTP -30%). No new nationwide order was issued between Oct 26 and Nov 2, and last week's unconfirmed single-source report of a standing Iranian wartime cutoff directive remains unconfirmed and still unscored. Access Now's Oct 20 finding that indefinite shutdowns rise every year, already scored last week, stands.", "sources": [ { "title": "Freedom House: Freedom on the Net 2026 — Seismic Shifts on the Global Internet", "url": "https://freedomhouse.org/report/freedom-net/2026/seismic-shifts-global-internet", "date": "2026-10-22", "raw": "16th consecutive year of decline; 38 countries covered, 34 paused; conditions deteriorated in 16 and improved in 8; coverage June 2025 - May 2026; Iran ~88-day nationwide shutdown = longest in the report's 16 years, plus a 20-day near-total shutdown January 2026, a two-tier internet where most are cut off and 'Internet Pro' costs 5x conventional service, Starlink jamming and higher VPN prices; Russia 19-day Moscow mobile shutdown March 2026, regional mobile shutdowns, register of 'socially significant services' kept reachable during shutdowns; Kyrgyzstan July 2025 decree routing all international traffic via state-owned ElKat, extension proposed August 2026; Nigeria months-long localized disruptions in Zamfara State; 10 of 38 countries with age-assurance laws, US scored 73/100" }, { "title": "Cloudflare: what took the Internet offline in Q3 2026", "url": "https://blog.cloudflare.com/q3-2026-internet-disruption-summary", "date": "2026-10-27", "raw": "19 of 49 Q3 disruptions government-directed, 18 of those Iraqi exam shutdowns lasting 15-90 minutes each; worst government-directed event Ethiopia/Tigray, 10 days, regional traffic -100% and country-level HTTP down up to 30%; Ukraine Aug 12 ten hours at -95%, Sevastopol Jul 5 eight hours at -98%; Cuba three-day blackout Sep 18-20" }, { "title": "Access Now: deliberately forgotten — internet shutdowns with no end", "url": "https://www.accessnow.org/indefinite-internet-shutdowns/", "date": "2026-10-20", "raw": "prolonged shutdowns have risen steadily each year; Tigray cut off for over two years during the civil war with new cuts now, Birnin Gwari (Nigeria) still offline three years on; Myanmar 'internet dead zone', Annobon, Gaza, Sudan documented; testimonies collected 2024-2026; #KeepItOn 10th anniversary, 370+ organisations across 106 countries" } ] }, "resilience": { "p": 0.024, "low": 0.009, "high": 0.06, "note": "Held at the quiet anchor, below the 0.026 pre-event baseline. The recovery case got firmer this week on better data than last week's crowdsourced trackers: Bitsight's telemetry puts supported-branch PHP hosts on a fixed build at 9.8% on release day, 55% by Oct 22, 78% by Oct 24 and 85% by Oct 27, which is the fastest mass-patch curve the series has recorded for a pre-auth RCE in a runtime this widely deployed; Tenable's five deliberately exposed vulnerable sites survived eight days uncompromised, and the reason is structural rather than lucky, since memory-corruption RCE must be tuned per build and does not spray. At the network layer Cloudflare's Q3 numbers say the same thing: of 49 disruptions, 14 returned to typical traffic inside an hour and 16 inside three hours, across a quarter whose causes were mostly power and weather. It does not fall further because the week also measured the limit of that immune system twice, independently, and in the same shape — it is fast where maintenance exists and absent where it does not. In PHP, 6.4% of 5.34M EOL hosts patched against 68.6% of supported ones, with 91% of 1.73M PHP 7.4 hosts still on 7.4 a week later and ~11M hosts with no fix path at all. In the kernel, CVE-2026-98432 split the same way inside five days: Debian shipped 6.1.190-1 and 6.12.113-1, Amazon, SUSE and Oracle shipped for some versions, and Ubuntu 22.04/24.04/26.04/26.10 and RHEL 8/9/10 — the two largest server estates — had nothing, with CIQ publishing nftables rules as a stopgap. Last week's two deductions also stand: detection trailed attackers by four days (Amazon's Oct 17 telemetry), and GitLab shipped two CVSS 10.0 pre-auth RCEs nine days apart in the same bundled regex engine. The 30-year base rate holds — this was another absorbed internet-killer — but the absorption is uneven in a way that is now documented rather than inferred.", "sources": [ { "title": "Bitsight: php2shell scanning, exploitation and patching data", "url": "https://www.bitsight.com/blog/php2shell-scanning-exploitation-patching", "date": "2026-10-29", "raw": "supported-branch hosts on a fixed build: 9.8% release day, 55% Oct 22, 78% Oct 24, 85% Oct 27; supported branches 68.6% of 4.13M within a week vs EOL 6.4% of 5.34M; all-hosts curve flattens ~38%; 59.5% (~11M hosts) on an EOL branch; PHP 7.4 1.73M hosts with 91% unchanged after a week; no verified mass-compromise claim; the apparent scanning surge was 'largely a measurement trap' (1,035 PHP-fetching addresses across 25 clusters)" }, { "title": "Tenable: php2shell one week later", "url": "https://www.tenable.com/blog/php2shell-one-week-later-why-one-exploit-doesnt-work-everywhere", "date": "2026-10-29", "raw": "five internet-exposed vulnerable sites uncompromised as of Oct 29, four up through the evening of Oct 24 and one still running vulnerable at publication; Log4Shell-style mass exploitation 'much less likely' because an exploit must match build, SAPI, extensions and runtime configuration; appliances sharing a single build are the stated exception" }, { "title": "Cloudflare: what took the Internet offline in Q3 2026", "url": "https://blog.cloudflare.com/q3-2026-internet-disruption-summary", "date": "2026-10-27", "raw": "49 disruptions in Q3 2026; 14 recovered to typical traffic levels in under an hour, 16 in under three hours; Iraqi exam shutdowns 15-90 minutes each; Guam needed multi-day recovery from Super Typhoon Bavi after four days from Sinlaku in Q2; the Internet 'designed to be distributed and resilient' but dependent on electricity" }, { "title": "BleepingComputer: CVE-2026-98432 distribution patch status", "url": "https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/", "date": "2026-10-30", "raw": "Debian fixed in 6.1.190-1 (Bookworm) and 6.12.113-1 (Trixie); Oracle Linux, Amazon Linux and SUSE fixed for some versions; Ubuntu 22.04/24.04/26.04/26.10 and RHEL 8/9/10 still vulnerable with fixes in progress five days after disclosure; Rocky 8/9/10 affected with CIQ nftables mitigations; no confirmed in-the-wild exploitation; disabling MPTCP alone insufficient" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-11-02T14:46:36.573Z", "computed_by": "weekly-job" } ], "current": { "date": "2026-11-02", "granularity": "week", "method": "live", "p": 0.09492, "low": 0.04199, "high": 0.18733, "headline": "The number barely moves; everything under it does. CISA added both php2shell CVEs to KEV on 2026-10-26 — the same day last week's entry scored them ABSENT and took exploitation off the crisis anchor partly for that reason — with a three-day federal due date and forensic-triage order; a CVSS 9.8 unauthenticated use-after-free in the IPv4 TCP handshake of every Linux kernel since 4.4 landed Oct 30 with Ubuntu and RHEL still unpatched; and Freedom on the Net 2026 reports a 16th consecutive annual decline around Iran's ~88-day nationwide shutdown, the longest it has ever recorded. Offsetting all of it: php2shell measurably could not be sprayed — five deliberately exposed vulnerable sites went eight days uncompromised, a lab exploit worked once in ~24 tries, and 85% of supported PHP branches were fixed within six days. Net +0.08pt, held up by fragmentation alone.", "events": [ { "date": "2026-10-26", "title": "CISA adds both php2shell CVEs to KEV with a three-day federal due date and forensic-triage requirement", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "direction": "up", "why": "reverses last week's key down-argument: CVE-2026-109618/109619 were recorded ABSENT on catalogVersion 2026.10.23 and were added on the day that entry published" }, { "date": "2026-10-30", "title": "CVE-2026-98432: CVSS 9.8 pre-auth use-after-free in the Linux IPv4 TCP handshake, every kernel since 4.4", "url": "https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/", "direction": "up", "why": "second AI-discovered critical pre-auth RCE in universal infrastructure in ten days; Ubuntu and RHEL shipped nothing in the first five days while Debian, Amazon, SUSE and Oracle did" }, { "date": "2026-10-29", "title": "Tenable and Bitsight, one week on: no mass compromise — php2shell needs per-build tuning, not a sprayable string", "url": "https://www.tenable.com/blog/php2shell-one-week-later-why-one-exploit-doesnt-work-everywhere", "direction": "down", "why": "five internet-exposed vulnerable sites uncompromised through Oct 29; Intel 471's exploit succeeded once in ~24 lab attempts; Bitsight saw one chain-shaped sequence and no verified mass compromise" }, { "date": "2026-10-29", "title": "Bitsight patch telemetry: 85% of supported-branch PHP hosts fixed by Oct 27 — and only 6.4% of 5.34M EOL hosts", "url": "https://www.bitsight.com/blog/php2shell-scanning-exploitation-patching", "direction": "neutral", "why": "the fastest mass-patch curve the series has recorded, on a denominator ten times larger than previously scored (29.2M hosts, 18.4M vulnerable) — and a newly measured ~11M-host reservoir that can never be patched" }, { "date": "2026-10-22", "title": "Freedom on the Net 2026: 16th consecutive annual decline; Iran's ~88-day nationwide shutdown the longest the report has recorded", "url": "https://freedomhouse.org/report/freedom-net/2026/seismic-shifts-global-internet", "direction": "up", "why": "a canonical standing indicator, not cited in the Oct 26 entry, and it reads worse: Iran now runs a two-tier internet and Kyrgyzstan routes all international traffic through a state carrier" }, { "date": "2026-10-27", "title": "Cloudflare Q3 2026 disruption summary: 49 disruptions, 19 government-directed, most recovered in hours", "url": "https://blog.cloudflare.com/q3-2026-internet-disruption-summary", "direction": "down", "why": "14 of 49 recovered under an hour and 16 under three; 18 of the 19 government-directed events were Iraqi exam shutdowns of 15-90 minutes; the worst was regional (Tigray, 10 days)" }, { "date": "2026-11-02", "title": "Second weekly W3Techs read resolves last week's metric-mismatch caveat: Cloudflare at 28.4%, up 0.4pp week over week", "url": "https://w3techs.com/technologies/overview/proxy", "direction": "neutral", "why": "the Oct 26 entry asked for exactly this confirmation — the ~28% level is real and the earlier 25.7%/28.0% gap was a metric mismatch, not a three-week migration" }, { "date": "2026-10-30", "title": "Ivanti Connect Secure zero-days chained in attacks (KEV Oct 30); GitLab CVE-2026-97229 KEV Oct 29; Oracle E-Business Suite moves from probing to compromise", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "direction": "up", "why": "October KEV additions revised up from the 26 scored last week to 36; 282 additions YTD against 245 in all of 2025" } ], "components": { "exploitation": { "p": 0.15, "low": 0.075, "high": 0.28, "note": "Held at the strained-high ceiling (~9-15%), with a WIDER band — because this week delivered two large updates in opposite directions and they land on the same number. UP, and it is the sharper correction: last week's note scored CVE-2026-109618/109619 as ABSENT from KEV ('no KEV-standard exploitation confirmation five days on') off catalogVersion 2026.10.23; CISA added BOTH on 2026-10-26, the day that entry published, with dueDate 2026-10-29 — a three-day federal deadline — and forensicTriage set, describing each as unauthenticated RCE. The catalog is now 1,766 entries (2026.10.30) and October's additions are 36, not the 26 scored last week, putting 2026 at 282 against 245 in ALL of 2025. The same window added Ivanti Connect Secure CVE-2026-118527/111357 (zero-days chained in attacks, KEV Oct 30), GitLab CVE-2026-97229 (KEV Oct 29), Palo Alto devices rooted via php2shell per Bitsight, and Oracle E-Business Suite CVE-2026-101767 moving from probing to compromise. Then CVE-2026-98432 on Oct 30: an unauthenticated use-after-free race in the IPv4 TCP connection-request path of every Linux kernel since 4.4, scored 9.8 by the kernel CVE team, with Anthropic researchers demonstrating remote root in ~53 minutes and a KASLR bypass using an unreleased Claude model — the second AI-discovered critical pre-auth RCE in universal infrastructure in ten days. DOWN, and it is the more fundamental finding: the mass-exploitation thesis failed measurement on the best test case anyone could ask for. Tenable kept five vulnerable PHP sites reachable from the internet and none were compromised through Oct 29; exploitation requires an exploit tuned to the target's heap state, SAPI, extensions and FPM pool, and chunk offsets shift with every patch release, so there is no universal offset; Intel 471's public exploit achieved code execution once in roughly 24 lab attempts; Bitsight saw exactly one chain-shaped sequence across its sensor fleet and no verified mass compromise. Bitsight also replaces last week's 3,532-site checker sample with a real denominator — 29.2M PHP hosts, 18.4M (63.1%) on a vulnerable version, Censys ~30.3M on Oct 29 — and the patch curve on that denominator is far better than the 59%-pre-fix snapshot scored last week: supported branches 68.6% of 4.13M fixed within a week, 85% by Oct 27. What stops the down-move from winning is the other half of that same denominator, newly quantified: 59.5% of the exposed population (~11M hosts) runs an EOL branch, 6.4% of 5.34M EOL hosts patched, and 91% of 1.73M PHP 7.4 hosts were still on 7.4 a week later. A permanent reservoir of ~11M unpatchable internet-facing hosts is this component's thesis in its structural form, and it is now measured rather than asserted. Band widened to 0.075-0.28 because the sources genuinely disagree: Red Hat scores the kernel bug 5.9 and calls it mainly denial-of-service, RCE is unproven without an MPTCP listener, and the php2shell patch trackers span 6% to 38% depending on whether they count EOL hosts and distro backports.", "sources": [ { "title": "CISA Known Exploited Vulnerabilities catalog (raw JSON feed)", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "date": "2026-10-30", "raw": "catalogVersion 2026.10.30, count 1,766 (was 1,756 at 2026.10.23); CVE-2026-109618 'PHP Memory Corruption' and CVE-2026-109619 'PHP Stale Internal Request-State' both dateAdded 2026-10-26, dueDate 2026-10-29, forensicTriage Yes, shortDescription 'allows for unauthenticated remote code execution', BOD 26-04 cited; Ivanti Connect Secure CVE-2026-118527 + CVE-2026-111357 added 2026-10-30; GitLab CVE-2026-97229 added 2026-10-29; Cisco ASA/FTD CVE-2026-76418 Oct 29; October 2026 additions 36 vs September 43; 282 additions YTD 2026 vs 245 in all of 2025 and 1,453 total on 2025-11-02; CVE-2026-98432 and GitLab CVE-2026-110264 both still ABSENT" }, { "title": "Tenable: php2shell one week later — why one exploit doesn't work everywhere", "url": "https://www.tenable.com/blog/php2shell-one-week-later-why-one-exploit-doesnt-work-everywhere", "date": "2026-10-29", "raw": "five internet-reachable vulnerable PHP sites kept exposed, none compromised as of Oct 29; exploitation depends on heap state, process manager, worker reuse and memory layout; chunk offsets change per release so no universal offset; working RCE on PHP 7.4.33 only once the exploit matched that single setup; Censys ~30.3M PHP services on an affected version Oct 29; 35 successful shell executions across three honeypot sensors (Adel Karimi) Oct 24; Log4Shell-style mass exploitation judged 'much less likely'; appliances sharing one build are the exception" }, { "title": "Bitsight: php2shell scanning, exploitation and patching data", "url": "https://www.bitsight.com/blog/php2shell-scanning-exploitation-patching", "date": "2026-10-29", "raw": "29.2M PHP hosts observed, 18.4M (63.1%) advertising a vulnerable version; supported branches (8.2-8.5) 68.6% of 4.13M patched within a week — 8.5/8.4 77%, 8.3 66%, 8.2 62%; daily supported-branch fixed share 9.8% release day, 55% Oct 22, 78% Oct 24, 85% Oct 27; EOL branches 6.4% of 5.34M; all-hosts curve flattens ~38%; 59.5% (~11M) on an EOL branch; PHP 7.4 = 1.73M hosts, 91% still on 7.4 after a week; 47.9% of vulnerable hosts on PHP 7 or older; one chain-shaped sequence across sensors, no verified mass compromise; Palo Alto reported active exploitation on some devices Oct 29" }, { "title": "BleepingComputer: critical Linux kernel flaw allows remote root attacks on MPTCP servers", "url": "https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/", "date": "2026-10-30", "raw": "CVE-2026-98432, use-after-free race in IPv4 TCP connection-request handling, every kernel since 4.4; CVSS 9.8 from the kernel CVE team vs Red Hat 5.9 / mainly DoS; Anthropic researchers built a working root exploit with an unreleased Claude model, ~53 minutes, KASLR bypassed, against an MPTCP listener; RCE not publicly demonstrated without an MPTCP listener; no confirmed in-the-wild exploitation; Go 1.24+ opens MPTCP listeners by default on Linux" }, { "title": "SecurityWeek: php2shell exploitation started days before patches", "url": "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/", "date": "2026-10-22", "raw": "Amazon MadPot recorded the first attempt Oct 17, four days pre-patch and under embargo; Cloudflare saw thousands of attempts in the 10 hours before announcement rising to millions; VulnCheck saw a Chinese IP attempt a webshell; WatchTowr: none of the circulating PoCs achieve RCE; Censys ~1.57M of 1.58M version-identifiable hosts unpatched Oct 21; ~920k PHP hosts in the US concentrated on AWS, DigitalOcean, Alibaba, OVHcloud, Hetzner" } ] }, "concentration": { "p": 0.115, "low": 0.052, "high": 0.21, "note": "Unchanged since 2026-09-30, and this week RESOLVES the honesty caveat the Oct 26 entry left open rather than moving the score. That entry read Cloudflare at 28.0% of all websites against 25.7% recorded on Sep 30, called a 2.3pp move in four weeks not credible for a W3Techs series, and asked for a second weekly read to confirm the level or the direction. Today's re-fetch: 28.4% of all websites, 86.1% of the reverse-proxy market, 33.0% of sites behind a monitored reverse proxy — a 0.4pp week-over-week move on a level that holds. So the ~28% LEVEL is the indicator and the earlier gap was a metric mismatch (reverse-proxy share versus the CDN sub-metric), exactly as suspected; no score change is warranted for a measurement artefact being identified. The gap to the next provider is the real finding and it is unchanged: CloudFront 1.7%, Fastly 0.9%, DDoS-Guard 0.7%, Akamai 0.6%. No new chokepoint incident occurred between Oct 26 and Nov 2 — no major CDN, cloud, DNS or BGP outage, with the nearest events (Cloudflare One Gateway ~3h on Oct 20, Akamai Edge DNS Oct 2, Google Cloud europe-west2 power Oct 20) all predating the window and all sub-day. Cloudflare's own Q3 telemetry is the counterweight to the share number: 49 observed disruptions, not one caused by platform concentration and not one at quarter-of-users scale. php2shell remains scored under exploitation per the Oct 21 rule, but it is worth recording that it was a runtime-monoculture event — the chokepoint class this component's indicators do not measure.", "sources": [ { "title": "W3Techs: reverse proxy / CDN usage", "url": "https://w3techs.com/technologies/overview/proxy", "date": "2026-11-02", "raw": "Cloudflare 28.4% of all websites and 86.1% of the reverse-proxy market (28.0% / 86.0% on 2026-10-26); 33.0% of sites use a monitored reverse proxy (32.6% last week), 67.0% use none; Amazon CloudFront 1.7% / 5.3%, Fastly 0.9% / 2.8%, DDoS-Guard 0.7% / 2.2%, Akamai 0.6% / 1.9%" }, { "title": "Cloudflare: what took the Internet offline in Q3 2026", "url": "https://blog.cloudflare.com/q3-2026-internet-disruption-summary", "date": "2026-10-27", "raw": "49 disruptions observed in Q3 2026; 19 government-directed, 14 power, 5 natural disaster, remainder cable/cyberattack/technical (Guyana cable cut, Portugal reported cyberattack, Phoenix cooling failure); none attributed to provider concentration; Cloudflare carries more than 20% of web traffic" } ] }, "slop": { "p": 0.13, "low": 0.058, "high": 0.24, "note": "Carried forward unchanged from 2026-10-26. The standing indicators were re-fetched and the two-sided picture holds, but the honest reason the number does not move is that this week's best available read comes from a DIFFERENT sample than last week's, and switching series is not a finding. Last week scored Cloudflare Radar's share-of-requests series (bots 35.49% of requests in Q3 2026 vs 30.13% in Q3 2025) plus a 4,242-file robots.txt parse from Sep 28. This week's read is a third-party compilation of Radar monthly data covering Oct 1-30 and a 114,605-domain robots.txt scan dated Oct 26 — comparable to each other month over month, not to last week's figures, so it is recorded as a level and not a delta. WORSE on the economics: Perplexity's crawl-to-referral ratio went 112:1 in January to 2,373:1 in September to 4,056:1 in October, a 36-fold deterioration in ten months, and Mistral has returned no measurable referrals since August. Imperva's 2026 Bad Bot Report (Apr 2026, 2025 data) still puts automated traffic above 53% of all web traffic, up from 51%, with the human share declining. BETTER, and it is why this does not rise: Anthropic's ClaudeBot improved from 47,779:1 in January to 549:1 in September to 482:1 in October — a 99-fold reversal that proves a crawl-to-referral ratio is a policy choice and not a law of nature — while Google holds at 4.8:1 and Yandex improved from 31:1 to 16:1. Mitigation adoption keeps climbing on its own sample too: 81.7% of 114,605 scanned domains carried AI-crawler rules in robots.txt on Oct 26, up from ~80% on Oct 5, with GPTBot gaining 93 and ClaudeBot 94 new disallowing files in three weeks. That sits alongside, not against, last week's finding that publishers are increasingly ALLOWING answering bots while blocking training crawlers: a market pricing crawl differently by purpose is the opposite of open publishing being abandoned.", "sources": [ { "title": "SEOmator GEO data report: crawl-to-refer ratios and bot share (Cloudflare Radar derived)", "url": "https://seomator.com/blog/crawl-to-refer-ratio-ai-crawlers-llm-bots", "date": "2026-10-31", "raw": "data window Radar monthly Jan-Sep 2026 plus Oct 1-30; Oct 2026 Cloudflare network: humans 35.0%, non-AI bots 54.6%, AI bots 6.3% (5.3% Sep), mixed-purpose crawlers 4.0%. Crawl-to-referral Oct / Sep / Jan: Perplexity 4,056:1 / 2,373:1 / 112:1; Anthropic ClaudeBot 482:1 / 549:1 / 47,779:1; OpenAI GPTBot 775:1 / 341:1 / 1,309:1; Google 4.8:1 / 4.7:1 / 4.7:1; Yandex 16:1 / 31:1; Mistral no measurable referrals since August. robots.txt scan 2026-10-26: 81.7% of 114,605 domains carry AI-crawler rules (~80% on Oct 5); of 4,367 files parsed, GPTBot disallowed in 14.6%, ClaudeBot 13.0%, CCBot 12.5%, Google-Extended 11.7%, Bytespider 11.5%; GPTBot +93 and ClaudeBot +94 disallowing files since the Oct 5 scan" }, { "title": "Imperva/Thales Bad Bot Report 2026: bots in the agentic age", "url": "https://www.imperva.com/blog/bad-bot-report-2026-bots-agentic-age/", "date": "2026-04-29", "raw": "automated traffic above 53% of all web traffic in 2025, up from 51% the prior year; human share 47% and still declining; 27% of bot attacks target API endpoints; financial services 24% of all bot attacks and 46% of account-takeover incidents; counts all web traffic including app and API calls, so not comparable to Radar's HTML-request series" } ] }, "fragmentation": { "p": 0.125, "low": 0.057, "high": 0.225, "note": "Up from 0.118 to 0.125 — the only component that moves this week, and it moves on a canonical standing indicator the Oct 26 entry did not have. Freedom on the Net 2026 published Oct 22: a 16th consecutive annual decline in internet freedom, conditions worsening in 16 of the 38 countries covered against 8 improving (34 countries paused this edition). Its centerpiece is Iran's roughly 88-day nationwide shutdown, the longest Freedom on the Net has recorded in sixteen years, on top of a 20-day near-total shutdown in January 2026 — and what makes it a fragmentation datapoint rather than an availability one is what replaced it: Iran now operates a two-tiered internet in which most of the population is cut off from the global net while 'Internet Pro' packages reach it at five times the price of conventional service. Kyrgyzstan's decree routing ALL international traffic through state-owned ElKat was extended, Russia maintains a register of 'socially significant services' that providers must keep reachable during shutdowns, and Russia ran a 19-day mobile shutdown in Moscow in March 2026. These are states building and operating the partition, not merely switching things off, which is the mechanism the outcome definition's fragmentation clause describes. It rises only a notch, because scale is the binding constraint and nothing here approaches it: Iran is roughly 1% of the world's users, and Cloudflare's Q3 count of 19 government-directed disruptions is dominated by 18 Iraqi exam shutdowns lasting 15-90 minutes, with the worst government-directed event regional (Tigray, 10 days, region -100%, country-level HTTP -30%). No new nationwide order was issued between Oct 26 and Nov 2, and last week's unconfirmed single-source report of a standing Iranian wartime cutoff directive remains unconfirmed and still unscored. Access Now's Oct 20 finding that indefinite shutdowns rise every year, already scored last week, stands.", "sources": [ { "title": "Freedom House: Freedom on the Net 2026 — Seismic Shifts on the Global Internet", "url": "https://freedomhouse.org/report/freedom-net/2026/seismic-shifts-global-internet", "date": "2026-10-22", "raw": "16th consecutive year of decline; 38 countries covered, 34 paused; conditions deteriorated in 16 and improved in 8; coverage June 2025 - May 2026; Iran ~88-day nationwide shutdown = longest in the report's 16 years, plus a 20-day near-total shutdown January 2026, a two-tier internet where most are cut off and 'Internet Pro' costs 5x conventional service, Starlink jamming and higher VPN prices; Russia 19-day Moscow mobile shutdown March 2026, regional mobile shutdowns, register of 'socially significant services' kept reachable during shutdowns; Kyrgyzstan July 2025 decree routing all international traffic via state-owned ElKat, extension proposed August 2026; Nigeria months-long localized disruptions in Zamfara State; 10 of 38 countries with age-assurance laws, US scored 73/100" }, { "title": "Cloudflare: what took the Internet offline in Q3 2026", "url": "https://blog.cloudflare.com/q3-2026-internet-disruption-summary", "date": "2026-10-27", "raw": "19 of 49 Q3 disruptions government-directed, 18 of those Iraqi exam shutdowns lasting 15-90 minutes each; worst government-directed event Ethiopia/Tigray, 10 days, regional traffic -100% and country-level HTTP down up to 30%; Ukraine Aug 12 ten hours at -95%, Sevastopol Jul 5 eight hours at -98%; Cuba three-day blackout Sep 18-20" }, { "title": "Access Now: deliberately forgotten — internet shutdowns with no end", "url": "https://www.accessnow.org/indefinite-internet-shutdowns/", "date": "2026-10-20", "raw": "prolonged shutdowns have risen steadily each year; Tigray cut off for over two years during the civil war with new cuts now, Birnin Gwari (Nigeria) still offline three years on; Myanmar 'internet dead zone', Annobon, Gaza, Sudan documented; testimonies collected 2024-2026; #KeepItOn 10th anniversary, 370+ organisations across 106 countries" } ] }, "resilience": { "p": 0.024, "low": 0.009, "high": 0.06, "note": "Held at the quiet anchor, below the 0.026 pre-event baseline. The recovery case got firmer this week on better data than last week's crowdsourced trackers: Bitsight's telemetry puts supported-branch PHP hosts on a fixed build at 9.8% on release day, 55% by Oct 22, 78% by Oct 24 and 85% by Oct 27, which is the fastest mass-patch curve the series has recorded for a pre-auth RCE in a runtime this widely deployed; Tenable's five deliberately exposed vulnerable sites survived eight days uncompromised, and the reason is structural rather than lucky, since memory-corruption RCE must be tuned per build and does not spray. At the network layer Cloudflare's Q3 numbers say the same thing: of 49 disruptions, 14 returned to typical traffic inside an hour and 16 inside three hours, across a quarter whose causes were mostly power and weather. It does not fall further because the week also measured the limit of that immune system twice, independently, and in the same shape — it is fast where maintenance exists and absent where it does not. In PHP, 6.4% of 5.34M EOL hosts patched against 68.6% of supported ones, with 91% of 1.73M PHP 7.4 hosts still on 7.4 a week later and ~11M hosts with no fix path at all. In the kernel, CVE-2026-98432 split the same way inside five days: Debian shipped 6.1.190-1 and 6.12.113-1, Amazon, SUSE and Oracle shipped for some versions, and Ubuntu 22.04/24.04/26.04/26.10 and RHEL 8/9/10 — the two largest server estates — had nothing, with CIQ publishing nftables rules as a stopgap. Last week's two deductions also stand: detection trailed attackers by four days (Amazon's Oct 17 telemetry), and GitLab shipped two CVSS 10.0 pre-auth RCEs nine days apart in the same bundled regex engine. The 30-year base rate holds — this was another absorbed internet-killer — but the absorption is uneven in a way that is now documented rather than inferred.", "sources": [ { "title": "Bitsight: php2shell scanning, exploitation and patching data", "url": "https://www.bitsight.com/blog/php2shell-scanning-exploitation-patching", "date": "2026-10-29", "raw": "supported-branch hosts on a fixed build: 9.8% release day, 55% Oct 22, 78% Oct 24, 85% Oct 27; supported branches 68.6% of 4.13M within a week vs EOL 6.4% of 5.34M; all-hosts curve flattens ~38%; 59.5% (~11M hosts) on an EOL branch; PHP 7.4 1.73M hosts with 91% unchanged after a week; no verified mass-compromise claim; the apparent scanning surge was 'largely a measurement trap' (1,035 PHP-fetching addresses across 25 clusters)" }, { "title": "Tenable: php2shell one week later", "url": "https://www.tenable.com/blog/php2shell-one-week-later-why-one-exploit-doesnt-work-everywhere", "date": "2026-10-29", "raw": "five internet-exposed vulnerable sites uncompromised as of Oct 29, four up through the evening of Oct 24 and one still running vulnerable at publication; Log4Shell-style mass exploitation 'much less likely' because an exploit must match build, SAPI, extensions and runtime configuration; appliances sharing a single build are the stated exception" }, { "title": "Cloudflare: what took the Internet offline in Q3 2026", "url": "https://blog.cloudflare.com/q3-2026-internet-disruption-summary", "date": "2026-10-27", "raw": "49 disruptions in Q3 2026; 14 recovered to typical traffic levels in under an hour, 16 in under three hours; Iraqi exam shutdowns 15-90 minutes each; Guam needed multi-day recovery from Super Typhoon Bavi after four days from Sinlaku in Q2; the Internet 'designed to be distributed and resilient' but dependent on electricity" }, { "title": "BleepingComputer: CVE-2026-98432 distribution patch status", "url": "https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/", "date": "2026-10-30", "raw": "Debian fixed in 6.1.190-1 (Bookworm) and 6.12.113-1 (Trixie); Oracle Linux, Amazon Linux and SUSE fixed for some versions; Ubuntu 22.04/24.04/26.04/26.10 and RHEL 8/9/10 still vulnerable with fixes in progress five days after disclosure; Rocky 8/9/10 affected with CIQ nftables mitigations; no confirmed in-the-wild exploitation; disabling MPTCP alone insufficient" } ] } }, "weights_version": "v1 (2026-10-21)", "computed_at": "2026-11-02T14:46:36.573Z", "computed_by": "weekly-job" } }