The Internet Brief #1 | Yandex goes dark, French fridges go warm

“The world cannot be understood without numbers. And it cannot be understood with numbers alone.” Hans Rosling, Factfulness (2018)

Hi, I’m João. I work on data insights at IPinfo and I’m based in Lisbon, Portugal. Welcome to the first issue of The Internet Brief. In each issue I'll share what IPinfo's data shows about how the Internet works and how it breaks, in plain words, with the numbers behind it and what they can't tell us.

In this issue: what really happened when Yandex's data centers went dark, a month of outages, RPKI's biggest year, the French supermarket fridges, a critical PHP flaw, and the South Pole's satellite hours.

What really happened when Yandex's data centers went dark

Two of Yandex's data centers in Russia went dark, Sasovo on October 8 and Vladimir on October 11, and the share of Yandex Cloud addresses answering IPinfo's checks fell to about 30% of normal. Yandex's network still told the rest of the Internet how to reach those addresses, but the servers behind them stopped answering. A viral chart claiming “Russian bot traffic dropped by half” mostly showed Yandex's own search crawler, which tells you little about who stopped posting. And on October 18, VK said drones hit one of its data centers near St Petersburg: the addresses on that network answering IPinfo's checks fell to about two thirds of normal, while VK's other network was unaffected.

October in outages

From a subsea cable cut in the Philippines to an earthquake in Panama, exam shutdowns in Iraq, fiber cuts in Uruguay and power cuts after strikes in Ukraine's Volyn region, October showed how many ways the Internet can break. In Uruguay on October 13, ANTEL's addresses in the south and east almost all stopped answering IPinfo's checks for two and a half hours, even though ANTEL's network still told the rest of the Internet how to reach them. On October 20, a power problem in one of Google Cloud's London zones left up to 9% of its London addresses silent in IPinfo's checks from 06:00 until about noon UTC.

Also on the record, with no cause reported: Telecom Armenia, the country's main operator, had a one-hour outage on the night of October 15. Petersburg Internet Network went down twice on October 16, the same day drones were reported over the Leningrad region and mobile Internet was restricted in the city, though nothing links the two. A regional ISP in Brazil had a short outage the same night. And on October 15, a power plant failure blacked out St Thomas and St John in the US Virgin Islands.

RPKI now protects 70% of Internet routes

RPKI lets networks prove which addresses they're allowed to announce. It now protects 70% of Internet routes, up from 54% a year ago, more growth in one year than in the two before combined. But about 1 in 6 protected routes still leaves a gap that a hijacker can use, as a forged Hetzner route showed in August.

Read the full analysis →

Over half the exposed supermarket fridge dashboards were in France

Overnight on October 11 and 12, a cyberattack forced refrigeration into defrost at hundreds of French supermarkets. When I went back to IPinfo's regular Internet-wide scan after the attack, the run from five days earlier had found 2,528 Danfoss refrigeration dashboards reachable from the open Internet, and 1,331 of them were in France, more than in the rest of the world combined. How the attackers got in hasn't been confirmed.

Read the full analysis →

A critical PHP flaw, and the servers that won't get the fix

On October 21, the PHP team released emergency fixes for two critical flaws that could let attackers take over web servers. (PHP is the programming language that builds web pages on the server for a large share of websites, including every WordPress site.) Official updates cover versions 8.2 to 8.5. For 7.4, 8.0 and 8.1, the team published source patches for people who build PHP themselves, and older versions get nothing.

In IPinfo's Internet-wide scan from October 14–15, at least 620,000 addresses announced a PHP version that gets no fix at all, nearly half of those that showed a version. That doesn't mean all of them can be attacked: some get fixes from their Linux distribution, and others sit behind protections. In the next issue: how fast servers update.

Nobel: The South Pole is online only when a satellite is overhead

This year's Physics Nobel went to Francis Halzen for IceCube, a detector buried in the ice at the South Pole. The station reaches the Internet only while one of a handful of satellites is above the horizon, which leaves about seven hours a day with none, and in CDN request data its traffic stops in those gaps. Each request from the Pole takes about 0.78 seconds to get an answer, against about 0.02 seconds from a typical US home.

Keep exploring IPinfo data

Follow IPinfo for more research, data findings and observations about how the Internet works. And explore more from our team on the IPinfo Blog and through our Research & Reports.

Get The Internet Brief by email: subscribe here.

Got a question, a data request or an idea to make this better? Write to me at joao@ipinfo.io.

For journalists: if you want the data behind any of these charts, a different cut for your story, or to talk with the team, write to press@ipinfo.io.

Data: IPinfo's Internet-wide scans (October 1–20, 2026, and October 6–7 for the dashboards), IPinfo's website logs, routing data, CDN request data and IPinfo WHOIS data, plus the US Antarctic Program's satellite schedule. Outage causes from the operators, Cloudflare Radar, Watch the Net and NetBlocks where they confirmed them.