Brief: how many sites went offline, and where
Status: accepted by the editor in the session on 23 October 2026 ("offline brief is important"); written by desk@php.newsroom, the news desk chief, on 22 October. Asked by the editor: "a very tight grip and understanding on how many websites have now been taken offline", and a pattern the editor suspects: "a lot of impact on non-English countries because they tend to run on [old] infrastructure ... a lot of PHP". The message was dictated: the transcript reads "all the infrastructure", and "[old]" is the desk's reading of it, which the editor confirmed in the session.
Where we are
- The offline ledger in
data/impact.jsonhas 10 rows. They count different things: one row is a whole government's public web services (Finland, Valtori), another is one council's site (Edinburgh). Ten rows are not ten of anything, so the site cannot give a count today. - Three rows rest on the organisation's own word (NCSC.nl, CERT.LV, Weird Gloop); the rest are the press. The fact-check desk grades the Netherlands row overstated: the government's notice names only NCSC.nl; DigiD, MijnOverheid and Overheid.nl come from the press.
- The ledger's latest capture is about 11:30 UTC on 22 October. The two sources closest to a count are not captured yet: the PHPocalypse Tracker's
sites.csvand the BBC live page as it stands ("32 UK services, 90%"), board 089.
The editor's hypothesis, and what tests it
Hypothesis: non-English-speaking countries are hit harder because they run more old PHP.
What the data can say today: nothing either way.
1. Our collection leans English. The source watch is 214 of 333 pages in English (64%), and discovery across languages is blocked (board 077). The UK holds 4 of the 10 offline rows because we read the UK press.
2. A rival explanation fits the big takedowns. The national-scale ones (the Netherlands, Finland, Latvia) were precautionary decisions by the operators of centralised state hosting: the Dutch government, Finland's state IT agency Valtori, Latvia's single "state website platform". One operator with one platform can switch a whole government off at once. It is the operator's posture, not the national CERT's published advice: NCSC-NL advised PHP's mitigations and said nothing of taking systems offline (data/agencies.json), yet NCSC.nl itself was taken offline "uit voorzorg". The offline map may be a map of who hosts centrally and how cautiously, not of old PHP.
3. There is no denominator. "More old PHP" needs, per country: PHP's share of sites and the share on unsupported versions (8.1 and older). The only national count we hold is CERT.LV's "about 6,000 potentially affected" in Latvia.
What would support the hypothesis: in the same country-domain samples, a higher share of unsupported PHP outside the English-speaking web, and offline or compromise rows that follow it rather than following CERT advice. What would refute it: offline rows that track CERT posture and centralised hosting, with version shares that do not differ.
The work
| Board | Owner | Work |
|---|---|---|
| 089 (exists, first) | collector-researchers | Capture the PHPocalypse Tracker's sites.csv and the BBC live page today. |
| 220 | researcher@php.newsroom | Discovery in the other languages straight from the source: national CERTs and public broadcasters of DE, FR, ES, IT, PL, PT, BR and JP, not through Google News (board 077). |
| 221 | collector-gov | The posture map, extended: data/agencies.json compares 16 bodies; add every other EU and EEA national CERT (Finland, Germany and Belgium first: they are in the offline ledger and not in the comparison), coded the same way, each with its capture; and, for each offline row, whether the operator followed its CERT's advice or went further. |
| 222 | collector-researchers | The denominator: W3Techs PHP share and PHP version shares by country domain (extends 033 and 043), and any per-country host count from Censys, Shodan or VulnCheck. |
| 223 | claude-story-site | The offline ledger reshaped: one row per organisation, a unit (site, platform, whole government), a count of domains where known, the source's language, and who said it; then a count with its basis on the front page. |
| 224 | factcheck | Grade the reshaped ledger as rows land, the Netherlands row first, and the count's basis. |
| 225 | journalist | The piece on where the web went dark and why, once 221 and 222 are in, not before. |
Since: 24 October (site v0.10.19)
- Board 089 is half done. The PHPocalypse Tracker's
sites.csvis in the evidence vault (phpocalypse-tracker-sites-csv, snapshot 22 October, 18:36 UTC): a community list of 50 sites that went dark and came back, with times. It is the first basis for a count, and its unit is a site. The offline ledger indata/impact.jsonstill has the same 10 rows; board 223 now has a source to build from. - The first per-country figures with a denominator have arrived, from non-English sources. ICTjournal (Switzerland, French): just over 23,000 of nearly 690,000 servers, about 3.5%, still affected a day after the fix. Paperjam (Luxembourg, French): thousands of sites exposed. With CERT.LV's 6,000 in Latvia, that is three countries; none is yet a share of old PHP, which is what the hypothesis needs (board 222).
- Collection is widening. Korean, Japanese, French and Dutch sources now reach the front page's Latest. Board 220 should measure the language mix again before anyone reads a pattern from it.
What this cannot do
It cannot count sites that went offline quietly: an outage nobody announced leaves no source. The count will be a floor, and the page says so.