--- title: The Morris Worm | daily.dev description: An account of the Morris Worm's 1988 spread, describing how it launched from MIT and reached about 10% of connected computers across major universities within... canonical: https://daily.dev/posts/the-morris-worm-b9nnejfxd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Morris Worm | daily.dev og:description: An account of the Morris Worm's 1988 spread, describing how it launched from MIT and reached about 10% of connected computers across major universities within... og:url: https://daily.dev/posts/the-morris-worm-b9nnejfxd og:image: https://api.daily.dev/og/posts/B9nNEJFXd.png og:image:alt: The Morris Worm og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Morris Worm **[ThePrimeTime](https://daily.dev/sources/primeagen)** · 1 min read · 0 upvotes · 0 comments ## Summary An account of the Morris Worm's 1988 spread, describing how it launched from MIT and reached about 10% of connected computers across major universities within 13 hours. The worm's core behavior is explained: a self-limiting population-control check, propagation to connected systems, and local password cracking, repeated in a loop until it was stopped. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the Morris worm spread so quickly in 1988? The Morris worm spread from an MIT computer around 6:00 p.m. Pacific time and reached the University of Pittsburgh within an hour, then Berkeley, Princeton, University of North Carolina, University of Maryland, UCLA, Harvard, and University of Chicago within 13 hours, infecting roughly 10% of all connected computers at the time, equivalent to about 1 billion devices by today's connectivity scale. _daily.dev surfaces historical security incidents like this for developers studying how malware propagation shaped modern defenses._ ### What logic did the Morris worm use to decide whether to spread or stop? The worm first checked whether it needed population control, deciding whether to kill itself to avoid over-replicating on a single machine. It then searched for connected systems to spread to and attempted local password cracking by guessing account passwords, repeating this two-step loop continuously unless the population control check terminated it. _understanding self-replication logic like this helps developers reason about malware behavior, something daily.dev readers track over time._ ## Similar posts on daily.dev - [37 years ago this week, the Morris worm infected 10% of the Internet within 24 hours — worm slithered out and sparked a new era in cybersecurity](https://daily.dev/posts/37-years-ago-this-week-the-morris-worm-infected-10-of-the-internet-within-24-hours-worm-slithere-b1l95b00d) · Hacker News · 3 upvotes · 0 comments - [Nobody needs Mythos or 0-days to build a chaos-causing computer worm – free open source models work just fine](https://daily.dev/posts/nobody-needs-mythos-or-0-days-to-build-a-chaos-causing-computer-worm-free-open-source-models-work--1mg8ymhge) · The Register · 1 upvotes · 0 comments - [AI worm prototype shows attackers don’t need Mythos to take over your network](https://daily.dev/posts/ai-worm-prototype-shows-attackers-don-t-need-mythos-to-take-over-your-network-oeid0golx) · CSO Online · 0 upvotes · 0 comments - [Schneier on Security](https://daily.dev/posts/schneier-on-security-eratbz74j) · Schneier on Security · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/the-morris-worm-b9nnejfxd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Morris Worm","url":"https://daily.dev/posts/the-morris-worm-b9nnejfxd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-morris-worm-b9nnejfxd"},"datePublished":"2026-08-19T13:16:25.656Z","dateModified":"2026-09-14T06:17:58.194Z","description":"An account of the Morris Worm's 1988 spread, describing how it launched from MIT and reached about 10% of connected computers across major universities within...","image":"https://i.ytimg.com/vi/6ujwNIhOSrg/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/6ujwNIhOSrg/sddefault.jpg","isAccessibleForFree":true,"articleSection":"ThePrimeTime","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ThePrimeTime","logo":"https://media.daily.dev/image/upload/s--J5-GjDeo--/f_auto/v1704628081/logos/primeagen.jpg","url":"https://daily.dev/sources/primeagen"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-morris-worm-b9nnejfxd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware","timeRequired":"PT1M","video":{"@type":"VideoObject","name":"The Morris Worm","description":"An account of the Morris Worm's 1988 spread, describing how it launched from MIT and reached about 10% of connected computers across major universities within...","thumbnailUrl":"https://i.ytimg.com/vi/6ujwNIhOSrg/sddefault.jpg","uploadDate":"2026-08-19T13:16:25.656Z","duration":"PT1M","url":"https://api.daily.dev/r/B9nNEJFXd","embedUrl":"https://www.youtube.com/embed/6ujwNIhOSrg"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ThePrimeTime","item":"https://daily.dev/sources/primeagen"},{"@type":"ListItem","position":3,"name":"The Morris Worm"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-morris-worm-b9nnejfxd#faq","mainEntity":[{"@type":"Question","name":"How did the Morris worm spread so quickly in 1988?","acceptedAnswer":{"@type":"Answer","text":"The Morris worm spread from an MIT computer around 6:00 p.m. Pacific time and reached the University of Pittsburgh within an hour, then Berkeley, Princeton, University of North Carolina, University of Maryland, UCLA, Harvard, and University of Chicago within 13 hours, infecting roughly 10% of all connected computers at the time, equivalent to about 1 billion devices by today's connectivity scale. daily.dev surfaces historical security incidents like this for developers studying how malware propagation shaped modern defenses."}},{"@type":"Question","name":"What logic did the Morris worm use to decide whether to spread or stop?","acceptedAnswer":{"@type":"Answer","text":"The worm first checked whether it needed population control, deciding whether to kill itself to avoid over-replicating on a single machine. It then searched for connected systems to spread to and attempted local password cracking by guessing account passwords, repeating this two-step loop continuously unless the population control check terminated it. understanding self-replication logic like this helps developers reason about malware behavior, something daily.dev readers track over time."}}]} ```