# The last 24 hours in PHP land, as observed by a monitoring service

The last 24 hours have been interesting in PHP land, to say the least. What started as a responsible disclosure of 2 highly critical vulnerabilities discovered in PHP core turned into a race to find & exploit the vulnerabilities before the official patches were released.

* [CVE-2026-109618, "RCE via OOM corruption"](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
* [CVE-2026-109619, "RCE via stale global state"](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)

As a precaution, many PHP site owners decided to take down their applications until the official patches were out. All to protect their servers & customer data from being exploited.

Now that all the patches are available and (hopefully!) most [people have patched their systems](https://ma.ttias.be/php-cve-2026-109618-patch/), applications are coming back online.

Below is a series of graphs of what we observed on the websites we monitor for our clients. Given our background in the PHP community, it's no surprise a majority of the sites we monitor end up being written in PHP.

## Sites going down

It's our job to alert when sites go down, but we haven't seen _this many_ go down at the same time. Below are our baseline numbers compared to the last 48 hours, where **at the peak, 18.8% of the sites we monitored were offline**.

**Share of sites that were down**

Percent of monitored sites that failed at least half of their checks in each half hour. Times are in UTC.

| Time (UTC) | These 48 hours | Same hours, a week earlier |
| --- | --- | --- |
| Tue 20 Oct 09:00 | 1.1% | 0.9% |
| Tue 20 Oct 09:30 | 1.1% | 0.9% |
| Tue 20 Oct 10:00 | 1.1% | 0.9% |
| Tue 20 Oct 10:30 | 1.1% | 0.9% |
| Tue 20 Oct 11:00 | 1.1% | 0.9% |
| Tue 20 Oct 11:30 | 1% | 0.9% |
| Tue 20 Oct 12:00 | 0.9% | 0.9% |
| Tue 20 Oct 12:30 | 0.9% | 0.9% |
| Tue 20 Oct 13:00 | 0.9% | 0.9% |
| Tue 20 Oct 13:30 | 0.9% | 0.9% |
| Tue 20 Oct 14:00 | 0.9% | 0.9% |
| Tue 20 Oct 14:30 | 0.9% | 0.9% |
| Tue 20 Oct 15:00 | 0.9% | 0.9% |
| Tue 20 Oct 15:30 | 0.9% | 0.9% |
| Tue 20 Oct 16:00 | 0.9% | 0.9% |
| Tue 20 Oct 16:30 | 0.9% | 0.9% |
| Tue 20 Oct 17:00 | 0.9% | 0.9% |
| Tue 20 Oct 17:30 | 0.9% | 0.9% |
| Tue 20 Oct 18:00 | 1% | 0.9% |
| Tue 20 Oct 18:30 | 1% | 0.9% |
| Tue 20 Oct 19:00 | 0.9% | 0.9% |
| Tue 20 Oct 19:30 | 0.9% | 0.9% |
| Tue 20 Oct 20:00 | 1% | 0.9% |
| Tue 20 Oct 20:30 | 1% | 0.9% |
| Tue 20 Oct 21:00 | 0.9% | 0.9% |
| Tue 20 Oct 21:30 | 1% | 0.9% |
| Tue 20 Oct 22:00 | 1% | 0.9% |
| Tue 20 Oct 22:30 | 1% | 0.9% |
| Tue 20 Oct 23:00 | 1% | 0.9% |
| Tue 20 Oct 23:30 | 1% | 0.9% |
| Wed 21 Oct 00:00 | 1% | 0.9% |
| Wed 21 Oct 00:30 | 1% | 0.9% |
| Wed 21 Oct 01:00 | 1% | 0.9% |
| Wed 21 Oct 01:30 | 1% | 0.9% |
| Wed 21 Oct 02:00 | 1% | 0.9% |
| Wed 21 Oct 02:30 | 1% | 0.9% |
| Wed 21 Oct 03:00 | 1% | 0.9% |
| Wed 21 Oct 03:30 | 1% | 0.9% |
| Wed 21 Oct 04:00 | 1% | 0.9% |
| Wed 21 Oct 04:30 | 1% | 0.9% |
| Wed 21 Oct 05:00 | 1% | 1% |
| Wed 21 Oct 05:30 | 1.4% | 0.9% |
| Wed 21 Oct 06:00 | 1.6% | 0.9% |
| Wed 21 Oct 06:30 | 1.6% | 0.9% |
| Wed 21 Oct 07:00 | 1.8% | 0.9% |
| Wed 21 Oct 07:30 | 1.9% | 0.8% |
| Wed 21 Oct 08:00 | 2.1% | 0.9% |
| Wed 21 Oct 08:30 | 2.3% | 0.9% |
| Wed 21 Oct 09:00 | 2.6% | 0.9% |
| Wed 21 Oct 09:30 | 3.2% | 0.9% |
| Wed 21 Oct 10:00 | 3.9% | 0.9% |
| Wed 21 Oct 10:30 | 5% | 0.9% |
| Wed 21 Oct 11:00 | 6.8% | 0.9% |
| Wed 21 Oct 11:30 | 9% | 0.9% |
| Wed 21 Oct 12:00 | 11.1% | 0.9% |
| Wed 21 Oct 12:30 | 13.2% | 0.9% |
| Wed 21 Oct 13:00 | 14.6% | 0.9% |
| Wed 21 Oct 13:30 | 16.9% | 0.9% |
| Wed 21 Oct 14:00 | 18.5% | 0.9% |
| Wed 21 Oct 14:30 | 18.8% | 0.9% |
| Wed 21 Oct 15:00 | 17.6% | 0.9% |
| Wed 21 Oct 15:30 | 17.1% | 0.9% |
| Wed 21 Oct 16:00 | 15.8% | 0.9% |
| Wed 21 Oct 16:30 | 15.2% | 0.9% |
| Wed 21 Oct 17:00 | 14.2% | 0.9% |
| Wed 21 Oct 17:30 | 13.4% | 0.9% |
| Wed 21 Oct 18:00 | 12.6% | 0.9% |
| Wed 21 Oct 18:30 | 11.6% | 0.9% |
| Wed 21 Oct 19:00 | 10.3% | 0.9% |
| Wed 21 Oct 19:30 | 8.9% | 0.9% |
| Wed 21 Oct 20:00 | 8% | 0.9% |
| Wed 21 Oct 20:30 | 7% | 0.9% |
| Wed 21 Oct 21:00 | 6.7% | 0.9% |
| Wed 21 Oct 21:30 | 6.4% | 0.9% |
| Wed 21 Oct 22:00 | 5.9% | 0.9% |
| Wed 21 Oct 22:30 | 5.7% | 0.9% |
| Wed 21 Oct 23:00 | 5.6% | 0.9% |
| Wed 21 Oct 23:30 | 5.4% | 0.9% |
| Thu 22 Oct 00:00 | 5.2% | 0.9% |
| Thu 22 Oct 00:30 | 5.1% | 0.9% |
| Thu 22 Oct 01:00 | 5% | 0.9% |
| Thu 22 Oct 01:30 | 5% | 0.9% |
| Thu 22 Oct 02:00 | 4.9% | 0.9% |
| Thu 22 Oct 02:30 | 4.9% | 0.9% |
| Thu 22 Oct 03:00 | 4.9% | 0.9% |
| Thu 22 Oct 03:30 | 5% | 1% |
| Thu 22 Oct 04:00 | 4.9% | 1% |
| Thu 22 Oct 04:30 | 4.7% | 1.2% |
| Thu 22 Oct 05:00 | 4.7% | 1.4% |
| Thu 22 Oct 05:30 | 4.5% | 1.3% |
| Thu 22 Oct 06:00 | 4.3% | 1% |
| Thu 22 Oct 06:30 | 4.2% | 1% |
| Thu 22 Oct 07:00 | 4% | 0.9% |
| Thu 22 Oct 07:30 | 3.8% | 0.9% |
| Thu 22 Oct 08:00 | 3.6% | 0.9% |
| Thu 22 Oct 08:30 | 3.5% | 0.9% |


Of course, it's our job to alert/notify the ones responsible for those sites, so we sent out alerts. A lot of them. At the peak, **25x more sites got a down alert than in a normal half hour**.

**Sites we sent a "down" alert for**

Sites with at least one "site is down" alert delivered, per half hour, compared to a normal half hour. 1× is normal. Times are in UTC.

| Time (UTC) | These 48 hours | Same hours, a week earlier |
| --- | --- | --- |
| Tue 20 Oct 09:00 | 1.4× | 1× |
| Tue 20 Oct 09:30 | 1.2× | 0.8× |
| Tue 20 Oct 10:00 | 1.3× | 1× |
| Tue 20 Oct 10:30 | 1.2× | 0.9× |
| Tue 20 Oct 11:00 | 1.3× | 1.1× |
| Tue 20 Oct 11:30 | 0.9× | 0.9× |
| Tue 20 Oct 12:00 | 0.9× | 1.1× |
| Tue 20 Oct 12:30 | 1× | 1.2× |
| Tue 20 Oct 13:00 | 0.9× | 1× |
| Tue 20 Oct 13:30 | 1.7× | 1.4× |
| Tue 20 Oct 14:00 | 1.1× | 1× |
| Tue 20 Oct 14:30 | 1× | 1× |
| Tue 20 Oct 15:00 | 0.8× | 1.1× |
| Tue 20 Oct 15:30 | 0.9× | 0.9× |
| Tue 20 Oct 16:00 | 0.7× | 0.9× |
| Tue 20 Oct 16:30 | 0.9× | 0.8× |
| Tue 20 Oct 17:00 | 0.8× | 1.1× |
| Tue 20 Oct 17:30 | 0.9× | 0.9× |
| Tue 20 Oct 18:00 | 1× | 1.1× |
| Tue 20 Oct 18:30 | 0.9× | 0.9× |
| Tue 20 Oct 19:00 | 1× | 0.9× |
| Tue 20 Oct 19:30 | 0.9× | 1× |
| Tue 20 Oct 20:00 | 0.8× | 0.8× |
| Tue 20 Oct 20:30 | 1.2× | 0.7× |
| Tue 20 Oct 21:00 | 0.8× | 0.9× |
| Tue 20 Oct 21:30 | 1.3× | 1× |
| Tue 20 Oct 22:00 | 1× | 1× |
| Tue 20 Oct 22:30 | 1.1× | 1.7× |
| Tue 20 Oct 23:00 | 0.8× | 0.9× |
| Tue 20 Oct 23:30 | 0.9× | 0.7× |
| Wed 21 Oct 00:00 | 1.2× | 1× |
| Wed 21 Oct 00:30 | 1.1× | 0.8× |
| Wed 21 Oct 01:00 | 0.8× | 0.9× |
| Wed 21 Oct 01:30 | 1.1× | 0.9× |
| Wed 21 Oct 02:00 | 0.9× | 1.1× |
| Wed 21 Oct 02:30 | 0.9× | 0.8× |
| Wed 21 Oct 03:00 | 0.9× | 1.1× |
| Wed 21 Oct 03:30 | 1× | 0.9× |
| Wed 21 Oct 04:00 | 0.8× | 1× |
| Wed 21 Oct 04:30 | 0.9× | 0.9× |
| Wed 21 Oct 05:00 | 1.4× | 1.2× |
| Wed 21 Oct 05:30 | 2.6× | 0.8× |
| Wed 21 Oct 06:00 | 1.2× | 1.1× |
| Wed 21 Oct 06:30 | 2.6× | 0.8× |
| Wed 21 Oct 07:00 | 1.5× | 1× |
| Wed 21 Oct 07:30 | 2.6× | 0.8× |
| Wed 21 Oct 08:00 | 1.7× | 0.9× |
| Wed 21 Oct 08:30 | 3.3× | 0.9× |
| Wed 21 Oct 09:00 | 2.7× | 1.1× |
| Wed 21 Oct 09:30 | 4.9× | 1.1× |
| Wed 21 Oct 10:00 | 4.8× | 1.2× |
| Wed 21 Oct 10:30 | 7.9× | 0.9× |
| Wed 21 Oct 11:00 | 9.6× | 0.9× |
| Wed 21 Oct 11:30 | 11.7× | 1× |
| Wed 21 Oct 12:00 | 15.7× | 1.1× |
| Wed 21 Oct 12:30 | 17.2× | 1.2× |
| Wed 21 Oct 13:00 | 21× | 0.8× |
| Wed 21 Oct 13:30 | 23.4× | 1× |
| Wed 21 Oct 14:00 | 25.2× | 1.1× |
| Wed 21 Oct 14:30 | 22.6× | 1.2× |
| Wed 21 Oct 15:00 | 23.3× | 1.3× |
| Wed 21 Oct 15:30 | 19.2× | 0.8× |
| Wed 21 Oct 16:00 | 21.7× | 0.9× |
| Wed 21 Oct 16:30 | 17.4× | 0.8× |
| Wed 21 Oct 17:00 | 19.4× | 0.9× |
| Wed 21 Oct 17:30 | 15.2× | 0.8× |
| Wed 21 Oct 18:00 | 17.3× | 1.2× |
| Wed 21 Oct 18:30 | 12.3× | 0.9× |
| Wed 21 Oct 19:00 | 13.6× | 0.9× |
| Wed 21 Oct 19:30 | 10.1× | 0.8× |
| Wed 21 Oct 20:00 | 11× | 1× |
| Wed 21 Oct 20:30 | 7.5× | 0.8× |
| Wed 21 Oct 21:00 | 8.3× | 1.1× |
| Wed 21 Oct 21:30 | 6.6× | 0.8× |
| Wed 21 Oct 22:00 | 7.8× | 1× |
| Wed 21 Oct 22:30 | 6.2× | 0.8× |
| Wed 21 Oct 23:00 | 7.3× | 0.9× |
| Wed 21 Oct 23:30 | 5.9× | 1.1× |
| Thu 22 Oct 00:00 | 6.8× | 1× |
| Thu 22 Oct 00:30 | 5.9× | 1× |
| Thu 22 Oct 01:00 | 6× | 1.1× |
| Thu 22 Oct 01:30 | 4× | 1.1× |
| Thu 22 Oct 02:00 | 4× | 1× |
| Thu 22 Oct 02:30 | 3.9× | 0.9× |
| Thu 22 Oct 03:00 | 4.3× | 1× |
| Thu 22 Oct 03:30 | 4.2× | 0.9× |
| Thu 22 Oct 04:00 | 4.2× | 1.4× |
| Thu 22 Oct 04:30 | 4× | 1.6× |
| Thu 22 Oct 05:00 | 3.9× | 1.5× |
| Thu 22 Oct 05:30 | 3.8× | 1.5× |
| Thu 22 Oct 06:00 | 3.8× | 1.1× |
| Thu 22 Oct 06:30 | 3.7× | 0.9× |
| Thu 22 Oct 07:00 | 3.6× | 1.1× |
| Thu 22 Oct 07:30 | 3.3× | 0.8× |
| Thu 22 Oct 08:00 | 3.6× | 1.5× |
| Thu 22 Oct 08:30 | 3× | 0.9× |

Counts sites, not messages. "Normal" is the average half hour of the week before.


And what goes down must come up. While we repeat notifications for downtime as the issue persists, every downtime alert is also followed by a recovery alert.

## How they went down

Looking at the status codes, it's interesting to see how most sites were brought offline. It's a mix of `HTTP/503` responses and sites that were completely unresponsive.

So either sysadmins took `php-fpm` down but let Nginx/Apache still serve requests, or they took the entire web server offline instead.

We did something similar: for a brief period, the Oh Dear website & dashboard were unavailable, as we set up a static HTML page served by Nginx, while keeping our `php-fpm` stopped.

**How the down sites answered**

Percent of all monitored sites that were down, by the answer they gave most often. 503 is the code most maintenance modes return, but not every 503 is maintenance. Times are in UTC.

| Time (UTC) | 503 Service Unavailable | No answer at all | 401 or 403, blocked | Gateway or proxy error | Other |
| --- | --- | --- | --- | --- | --- |
| Tue 20 Oct 09:00 | <0.1% | 0.6% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 09:30 | <0.1% | 0.6% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 10:00 | <0.1% | 0.6% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 10:30 | <0.1% | 0.6% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 11:00 | <0.1% | 0.5% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 11:30 | <0.1% | 0.5% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 12:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 12:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 13:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 13:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 14:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 14:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 15:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 15:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 16:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 16:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 17:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 17:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 18:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 18:30 | <0.1% | 0.5% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 19:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 19:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 20:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 20:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 21:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 21:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 22:00 | <0.1% | 0.5% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 22:30 | <0.1% | 0.5% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 23:00 | <0.1% | 0.5% | 0.2% | <0.1% | 0.2% |
| Tue 20 Oct 23:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 00:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 00:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 01:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 01:30 | <0.1% | 0.5% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 02:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 02:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 03:00 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 03:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 04:00 | <0.1% | 0.5% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 04:30 | <0.1% | 0.4% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 05:00 | <0.1% | 0.5% | 0.2% | <0.1% | 0.2% |
| Wed 21 Oct 05:30 | <0.1% | 0.8% | 0.2% | 0.1% | 0.2% |
| Wed 21 Oct 06:00 | <0.1% | 1% | 0.2% | 0.1% | 0.2% |
| Wed 21 Oct 06:30 | <0.1% | 1% | 0.2% | 0.1% | 0.2% |
| Wed 21 Oct 07:00 | 0.1% | 1.1% | 0.2% | 0.1% | 0.2% |
| Wed 21 Oct 07:30 | 0.2% | 1.1% | 0.2% | 0.2% | 0.2% |
| Wed 21 Oct 08:00 | 0.3% | 1.1% | 0.2% | 0.2% | 0.3% |
| Wed 21 Oct 08:30 | 0.4% | 1.2% | 0.3% | 0.2% | 0.3% |
| Wed 21 Oct 09:00 | 0.4% | 1.3% | 0.3% | 0.2% | 0.3% |
| Wed 21 Oct 09:30 | 0.6% | 1.7% | 0.3% | 0.2% | 0.4% |
| Wed 21 Oct 10:00 | 1% | 1.8% | 0.3% | 0.3% | 0.4% |
| Wed 21 Oct 10:30 | 1.5% | 2.2% | 0.4% | 0.3% | 0.6% |
| Wed 21 Oct 11:00 | 1.9% | 3.1% | 0.8% | 0.3% | 0.7% |
| Wed 21 Oct 11:30 | 2.9% | 4% | 0.8% | 0.4% | 0.8% |
| Wed 21 Oct 12:00 | 4% | 4.5% | 1.2% | 0.5% | 0.9% |
| Wed 21 Oct 12:30 | 5.5% | 4.9% | 1.3% | 0.6% | 1% |
| Wed 21 Oct 13:00 | 6.2% | 5.2% | 1.3% | 0.7% | 1.2% |
| Wed 21 Oct 13:30 | 7.4% | 6.2% | 1.3% | 0.8% | 1.3% |
| Wed 21 Oct 14:00 | 8.2% | 6.5% | 1.4% | 0.9% | 1.5% |
| Wed 21 Oct 14:30 | 8.1% | 6.9% | 1.6% | 0.9% | 1.3% |
| Wed 21 Oct 15:00 | 7.4% | 6.7% | 1.5% | 0.8% | 1.2% |
| Wed 21 Oct 15:30 | 7.1% | 6.7% | 1.4% | 0.7% | 1.2% |
| Wed 21 Oct 16:00 | 6.1% | 6.6% | 1.3% | 0.6% | 1.1% |
| Wed 21 Oct 16:30 | 5.6% | 6.5% | 1.2% | 0.7% | 1.1% |
| Wed 21 Oct 17:00 | 5.3% | 6% | 1.2% | 0.7% | 1.1% |
| Wed 21 Oct 17:30 | 4.9% | 5.7% | 1.1% | 0.7% | 1% |
| Wed 21 Oct 18:00 | 4.4% | 5.5% | 1% | 0.7% | 1% |
| Wed 21 Oct 18:30 | 3.9% | 5.2% | 0.9% | 0.7% | 0.9% |
| Wed 21 Oct 19:00 | 3.3% | 4.7% | 0.9% | 0.6% | 0.7% |
| Wed 21 Oct 19:30 | 2.8% | 4.3% | 0.7% | 0.6% | 0.6% |
| Wed 21 Oct 20:00 | 2.3% | 3.9% | 0.7% | 0.5% | 0.5% |
| Wed 21 Oct 20:30 | 2.1% | 3.2% | 0.7% | 0.5% | 0.5% |
| Wed 21 Oct 21:00 | 2% | 3% | 0.7% | 0.5% | 0.5% |
| Wed 21 Oct 21:30 | 1.9% | 2.9% | 0.7% | 0.4% | 0.5% |
| Wed 21 Oct 22:00 | 1.5% | 2.9% | 0.6% | 0.5% | 0.5% |
| Wed 21 Oct 22:30 | 1.4% | 2.7% | 0.6% | 0.4% | 0.5% |
| Wed 21 Oct 23:00 | 1.4% | 2.7% | 0.6% | 0.4% | 0.5% |
| Wed 21 Oct 23:30 | 1.4% | 2.7% | 0.6% | 0.3% | 0.5% |
| Thu 22 Oct 00:00 | 1.3% | 2.5% | 0.6% | 0.3% | 0.4% |
| Thu 22 Oct 00:30 | 1.3% | 2.5% | 0.6% | 0.3% | 0.4% |
| Thu 22 Oct 01:00 | 1.3% | 2.5% | 0.6% | 0.3% | 0.4% |
| Thu 22 Oct 01:30 | 1.3% | 2.5% | 0.6% | 0.3% | 0.4% |
| Thu 22 Oct 02:00 | 1.3% | 2.4% | 0.6% | 0.3% | 0.4% |
| Thu 22 Oct 02:30 | 1.3% | 2.4% | 0.6% | 0.3% | 0.4% |
| Thu 22 Oct 03:00 | 1.3% | 2.3% | 0.6% | 0.3% | 0.4% |
| Thu 22 Oct 03:30 | 1.4% | 2.3% | 0.6% | 0.3% | 0.4% |
| Thu 22 Oct 04:00 | 1.4% | 2.3% | 0.5% | 0.3% | 0.4% |
| Thu 22 Oct 04:30 | 1.4% | 2.2% | 0.5% | 0.3% | 0.4% |
| Thu 22 Oct 05:00 | 1.3% | 2.2% | 0.5% | 0.3% | 0.4% |
| Thu 22 Oct 05:30 | 1.2% | 2.1% | 0.5% | 0.3% | 0.4% |
| Thu 22 Oct 06:00 | 1.2% | 2% | 0.5% | 0.2% | 0.4% |
| Thu 22 Oct 06:30 | 1.1% | 2% | 0.5% | 0.2% | 0.4% |
| Thu 22 Oct 07:00 | 1% | 1.9% | 0.5% | 0.2% | 0.4% |
| Thu 22 Oct 07:30 | 0.9% | 1.8% | 0.5% | 0.3% | 0.4% |
| Thu 22 Oct 08:00 | 0.8% | 1.7% | 0.4% | 0.3% | 0.4% |
| Thu 22 Oct 08:30 | 0.8% | 1.7% | 0.4% | 0.2% | 0.4% |

Of the sites that were down, 7.7% answered 503 before the rise. At the peak it was 43.4%.


Some sites were quick to jump into action and took their sites down for several hours. Others were more relaxed and only took their sites offline a few hours before the patches were due to be released.

**How long the outages lasted**

Share of all monitored sites that had an outage of this length. A week earlier, outages of 1 hour or longer were rare.

|  | These 48 hours | Same hours, a week earlier |
| --- | --- | --- |
| 5 to 15 min | 4.2% | 2.6% |
| 15 to 60 min | 2.9% | 1% |
| 1 to 4 hours | 6.4% | 0.6% |
| 4 to 12 hours | 11% | 0.1% |
| 12 hours or more | 2.1% | <0.1% |
| Still down | 2.7% | 0.2% |

Outages under 5 minutes are left out: 30.4% of sites had one, against 24.1% the week before. A site with several outages counts once in each length it had. "Still down" means still down when the 48 hours ended, on 22 October at 09:00 UTC. The week before is judged the same way.


## What we sent

It'll be no surprise that most of the notifications we sent were in the **"Your site is down"** category. Downtime is anything that isn't an `HTTP/2xx` code (or that fails the optional checkstring or header verification), so any `HTTP/503` or timeout will trigger these notifications.

**Which alerts grew**

Alerts delivered in these 48 hours, compared to the same 48 hours a week earlier.

|  | Compared to the week before |
| --- | --- |
| Site is down | 5.1× |
| Could not read health results | 4.3× |
| Site is back up | 2.7× |
| Cron job failed | 2.1× |
| DNS problem found | 1.4× |
| DNS records changed | 1.3× |
| Certificate changed | 1.1× |

Counts delivered messages. One outage that alerts three channels counts three times.


## Who answered with a 503

The `Server` header also tells us _who_ answered with the 503. Most often - again, no surprise - this was Cloudflare. They were also quick to add a WAF rule for all clients, mitigating the attack for those that didn't take their sites offline preventively.

**Who served the 503 page**

Outages that started with a 503, by the web server that answered.

|  | Share of the 503 outages |
| --- | --- |
| Cloudflare | 28.9% |
| nginx | 24.3% |
| No Server header | 24% |
| Apache | 10.9% |
| AWS load balancer | 4.1% |
| LiteSpeed | 1.2% |
| Other | 6.5% |

Read from the Server header of the failed check closest to the start of the outage. It names the server or CDN that answered, not the application behind it.


Suffice it to say, the past 24 hours were _a rush_. While the peak seems to be behind us, many sites are still down as they await patches, and we haven't seen a return to baseline yet. We'll keep updating this blog post over the next few days to show the final results in these graphs.