A Patch Tuesday reboot storm broke Skype's 'self-healing' P2P network for two days

On Thursday 16 August 2007, Skype — the Luxembourg-based internet-telephony service owned by eBay, then counting 220 million users — stopped working for most of the day, and the disruption stretched into a prolonged outage of almost two days. The trigger was ordinary: Microsoft's monthly Patch Tuesday pushed security updates that required a reboot, and millions of Windows machines restarted and tried to log back into Skype's peer-to-peer network within hours of each other. Skype called it 'a massive restart of our users' computers across the globe within a very short timeframe.'

Skype's peer-to-peer architecture had, in its words, an 'inbuilt ability to self-heal' — churn from clients joining and leaving was normally absorbed automatically. The reboot storm revealed a previously unseen software bug in the network resource-allocation algorithm that prevented self-healing from working quickly. The recovery machinery itself failed under a failure scale it had never seen. As Skype put it, the service was 'unavailable to the majority of its users for approximately two days.'

As the outage stretched on, security researchers speculated that a denial-of-service vulnerability disclosed the same week was to blame; Skype denied it — the network was not attacked, it could simply not heal fast enough. The episode became an early canonical lesson that distributed does not mean failure-proof: peer-to-peer systems still face globally correlated events, and self-healing capacity has to be sized and tested against them.

Service unavailable to the majority of Skype's 220 million users for roughly two days; small businesses that had dropped landlines lost their phone service

Patch Tuesday created a correlated global event: millions of Windows machines rebooted and re-logged within a few hours, far beyond the churn the network normally absorbed.

A previously unseen bug in the network resource-allocation algorithm meant the built-in self-healing function 'did not work quickly' once the storm hit — the recovery path itself failed under load.

The failure scale had never been exercised: self-healing capacity was implicitly sized for ordinary join/leave patterns, not synchronized restarts of the whole client base.

A denial-of-service vulnerability disclosed the same week muddied the diagnosis, forcing Skype to publicly deny an attack theory while it debugged its own software.

Peer-to-peer does not mean maintenance-free. Size the recovery path for correlated events — one patch cycle can hit every client at once — and exercise it before the whole network depends on it.

Service was restored and Skype published a detailed postmortem on its Heartbeat blog, taking responsibility: the trigger was Microsoft's patch cycle, but the fault was Skype's own resource-allocation code, and the company stressed nothing was security-related. The outage is still cited as the textbook case of correlated failure in peer-to-peer networks — and of the gap between 'distributed, therefore resilient' and resilience that has actually been tested.