Metamute Web Server: Cyber Threat Response

Mute’s website and web server came under a cyber threat in December 2025 and our website had to be taken offline. Although a version of the website is now back online as of February 2026, the incident requires a complete rebuild of our digital infrastructure.

Metamute server independence & vulnerability

Mute magazine has run its own web-publishing infrastructure for over thirty years. Since moving off the Bartlett School of Architecture server space kindly offered to our pilot in 1994, the magazine’s online content has been self-hosted, open access, and open-source. Metamute.org holds more than 10,000 articles covering culture, politics, and technology continuously from the early 1990s well into the 2020s.

But as all indy projects know, such digital sovereignty carries a hefty technical price tag and a guaranteed flow of cyber threats. Indeed, in December 2025, Mute was contacted by a ‘bug bounty service’ who gave notice of security vulnerabilities in the site, offering to fix these. When we made our own investigations, it became clear that some historical issues with the Metamute site had become critical, meaning a hack and takedown was possible if not imminent. The problems were deep-rooted enough to threaten other infrastructures on the server that hosted it, too. We decided to take it offline and start the first longer-term outage in more than thirty years.

We have put in place measures to prevent hacks; no content, software, or personal data have been compromised, and the server is backed up in multiple remote locations. We have also put up a temporary flat file website while we work out longer-term repair of the server.

Further information

Metamute needs you (more than ever)! The Metamute web server is run by a single Mute editor together with a small volunteer technical team, on a shoestring budget which cannot meet ongoing needs.

The site runs an outdated version of the Drupal CMS first installed in 2005, making updates time consuming and complicated. Metamute’s vulnerabilities put other services run from the same host server at risk, so it must be moved elsewhere, its architecture decommissioned and updated. (Requirements include: nginx virtualisation, mail, mail lists, operating systems, backup, archives, web projects, and more). At ten years plus, the age of the current server also impacts the efficacy of updates and fixes: contemporary software applications require significantly more compute resources, double the amount of RAM, and much more storage (the server e.g. still uses ‘spinning disks’!).

The bug bounty notice which triggered the outage is a routine feature of the online space. These ‘services’ operate by messaging website owners reporting a vulnerability and offering to fix the problem. The bug bounty service in question (openbugbounty.org) describes itself as ‘ethical’, due to not publicly disclosing the nature of the vulnerability, and instead offering to ‘put you in contact with one of their researchers who will fix the problems for you’. Informed by ongoing consultation with peer organisations – in the academic, museum and public sectors – Mute’s view is that bug bounty services are not ethical, rather they operate a protection racket style scam to extort cash for fixes, putting a bounty on the head of the websites they offer to ‘protect’ ). We have therefore neither contacted nor paid this provider.

Metamute fundraiser

Mute will be launching a fundraiser to support creation of a new secure server. Jobs covered by the drive are:

• a new dedicated web server

• restoring the Metamute website

• decommissioning some historical services (e.g., OpenMute, POD, mailing lists, file servers, VMs, DNS, and mail, etc)

• backup data for later archiving and cataloguing

• improved backup

• a new infrastructure to recover the content from the Drupal CMS, for Mute and Metamute articles and projects (The following will be used to replace Drupal CMS: MediaWiki, Wikibase, and a Nextcloud instance)

Mute print archive

To support this server rebuild, copies of the print magazine are being promoted for sale, with special emphasis on the full Mute Magazine collection. This is an original, limited edition set of all fifty-one issues of the print magazine, covering twenty years of publishing from 1994 to 2014.

You can order the collection here: https://archive.metamute.org/

Pricing tiers are set as follows:

• Contributors and supporters:* €1,200 (50% discount)

• Standard: €2,400 €

• Sponsors: €4,000 

• Distributor discount: €1,440 € (40% discount).

*We define supporters as those who had any working relationship or involvement with the magazine, including individuals or institutions. :-)

---

Any questions or comments please contact us: Email: theborg@metamute.org | Mastodon: https://fosstodon.org/@metamute