Code Red Turns 25: The Worm That Still Has Things to Teach Us
A worm that tore across the internet in 2001 exposed a visibility blind spot that organisations keep walking into. The rush to deploy AI tools is the latest version of the same mistake.
Key points
- The Code Red worm, a self-spreading malicious program, was co-discovered by Marc Maiffret and Ryan Permeh on a Friday night in July 2001 after two customer complaints.
- Code Red exploited a flaw in Microsoft Internet Information Services (IIS), the software that runs websites on Windows servers, which was switched on by default at millions of organisations.
- The worm was among the first to spread across the open internet rather than through email, hitting organisations worldwide before most knew a patch existed.
- BeyondTrust CTO Marc Maiffret, in a discussion first published by Dark Reading, says the AI adoption rush today mirrors the visibility failures that made Code Red so damaging.
- The core lesson from 2001 still holds: you can't protect systems you don't know you're running.
Twenty-five years ago this summer, two security researchers were unwinding on a Friday evening when their inboxes filled with worried messages. Customers were reporting that their web servers were behaving strangely. Neither could explain what was wrong.
Marc Maiffret and Ryan Permeh started digging through packet captures, recordings of network traffic that work like call logs for computers. What they found wasn't a standard break-in. Something was moving through machines on its own, copying itself from server to server with no human pushing it.
That was Code Red.
The worm targeted a flaw in Microsoft Internet Information Services (IIS), Windows software that powers web servers. IIS came switched on by default. Millions of organisations were running it without knowing. Many had never applied the patch Microsoft had already released. Code Red defaced websites with the message "Hacked by Chinese" and carried a built-in ability to flood targets with junk traffic, a technique called a distributed denial-of-service (DDoS) attack. It spread fast enough to reach organisations across the planet before most IT teams knew a worm existed.
We first covered Code Red on 21 July 2026, and BeyondTrust has stayed in our reporting since: the company rushed out fixes for two pre-authentication flaws rated 9.2 on the severity scale on 7 July 2026, a reminder that default-on, under-examined services remain a live problem.
How does a 2001 worm connect to AI tools today?
The connection is the blind spot, not the technology. Code Red succeeded because organisations were running software they'd forgotten, never secured, and had no easy way to find. Maiffret argues the same pattern is playing out now with artificial intelligence.
Companies are deploying AI tools and automated AI workflows at speed, often without a clear picture of what's actually running inside their own networks. Security teams call this "shadow AI": tools adopted by staff or departments without formal approval or oversight. If you don't know a tool exists, you can't check whether it's safe.
The parallel is precise. In 2001 the overlooked service was a web server. Today it might be a third-party AI chatbot with access to company data, or an automated workflow nobody in security signed off on.
Maiffret's advice is first-principles thinking: step one in security is knowing what you have. That was true in 2001.
Should you worry?
If you're using an AI tool at work that your IT or security team hasn't approved, flag it. That's not overcaution. Shadow tools create blind spots, and blind spots are where incidents start. The Spirals ransomware crew broke into an IT firm through an exposed web server and encrypted the network inside 24 hours. The entry point, in 2026, was a service nobody was watching. Code Red would have recognised it.
