Gulf CybersecurityBaseline
العربيةCheck your domain
Kuwait City at night from space, its streets in amber light along the dark water of the bayRiyadh at night from space, a wide grid of white and amber light in the desertDubai at night from space, with Palm Jumeirah lit in the sea below the coast roadDoha at night from space, the city's lights spreading from the bay along its roadsBahrain at night from space, the island's towns joined by lit roads in a dark seaMuscat and Al Seeb at night from space, the coast road and the airport in amber light beside a dark sea

Readiness

Whenever an exploited vulnerability in software visible from outside is catalogued, the first page of every live domain is read within a day, so we know how many sites still announce an affected version, and the measurement is repeated after every issue to see how fast the patches arrive.

Readiness

Measured on 23 October 2026 by reading the first page of every live domain in the Arabian Gulf, and 10,101 websites answered.

Exploited vulnerabilities

Every vulnerability CISA has added to its catalogue of exploited vulnerabilities that affects software announced from outside, newest first, with the share of sites announcing an affected version among the sites that announce a version.

  1. 55.3% Apache HTTP Server CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Vulnerability 68 of 123 announcing a full version Catalogued on 1 May 2025 CISA catalogue NVD
  2. 0.4% PHP CVE-2024-4577 PHP-CGI OS Command Injection Vulnerability 4 of 1,097 announcing a full version Catalogued on 12 June 2024 Used in ransomware campaigns CISA catalogue NVD
  3. 0.0% OpenSSL CVE-2014-0160 OpenSSL Information Disclosure Vulnerability 0 of 32 announcing a full version Catalogued on 4 May 2022 CISA catalogue NVD
  4. 0.3% PHP CVE-2012-1823 PHP-CGI Query String Parameter Vulnerability 3 of 1,097 announcing a full version Catalogued on 25 March 2022 CISA catalogue NVD
  5. 0.0% Drupal CVE-2020-13671 Drupal core Un-restricted Upload of File 0 of 65 announcing a full version Catalogued on 18 January 2022 CISA catalogue NVD
  6. 0.0% Apache HTTP Server CVE-2021-42013 Apache HTTP Server Path Traversal Vulnerability 0 of 123 announcing a full version Catalogued on 3 November 2021 Used in ransomware campaigns CISA catalogue NVD
  7. 0.0% Apache HTTP Server CVE-2021-41773 Apache HTTP Server Path Traversal Vulnerability 0 of 123 announcing a full version Catalogued on 3 November 2021 Used in ransomware campaigns CISA catalogue NVD
  8. 8.1% Apache HTTP Server CVE-2019-0211 Apache HTTP Server Privilege Escalation Vulnerability 10 of 123 announcing a full version Catalogued on 3 November 2021 CISA catalogue NVD
  9. 0.0% Drupal CVE-2018-7600 Drupal Core Remote Code Execution Vulnerability 0 of 87 announcing a full version Catalogued on 3 November 2021 Used in ransomware campaigns CISA catalogue NVD
  10. 0.4% Microsoft IIS CVE-2017-7269 Microsoft Windows Server Buffer Overflow Vulnerability 2 of 539 announcing a full version Catalogued on 3 November 2021 CISA catalogue NVD

And 7 more in Apache Tomcat and Joomla, which no site announces a full version of, so they are not measured yet.

Software past its support

Among the sites that announce the version of their software, the share running a version its maker no longer supports according to endoflife.date, so it receives no security patches.

  • 0.1% WordPress 2 of 1,448 announcing a version Most common 7.1, 7.0 and 6.9
  • 27.9% PHP 306 of 1,097 announcing a version Most common 8.3, 8.2 and 7.4
  • 3.9% Microsoft IIS 21 of 539 announcing a version Most common 10.0, 8.5 and 7.5
  • 89.5% nginx 375 of 419 announcing a version Most common 1.29, 1.24 and 1.18
  • 2.2% Apache HTTP Server 3 of 135 announcing a version Most common 2.4 and 2.2
  • 12.5% Drupal 13 of 104 announcing a version Most common 7
  • 75.0% OpenSSL 24 of 32 announcing a version Most common 1.0.2, 1.1.1 and 3.5

What sites announce

Only what a site writes about itself in the headers of its first page or in its generator tag is measured, so the figures are a floor, and sites behind a front such as Cloudflare do not announce their server.

  • 79.4% Announce their server 8,025 of 10,101 whose first page was read
  • 31.8% Announce a software version 3,208 of 10,101 whose first page was read
  • 27.2% Announce their content system 2,744 of 10,101 whose first page was read
  • 37.8% Behind a front that hides the server 3,819 of 10,101 whose first page was read
Riyadh at night from space, a wide grid of white and amber light in the desert
Riyadh at night, photographed by NASA from the International Space Station on 28 December 2024

Most announced

  • 25.8% WordPress 2,602 websites, 1,448 of them announcing a version
  • 15.3% Apache HTTP Server 1,544 websites, 135 of them announcing a version
  • 12.9% nginx 1,300 websites, 419 of them announcing a version
  • 10.9% PHP 1,097 websites, 1,097 of them announcing a version
  • 7.7% LiteSpeed 780 websites, 0 of them announcing a version
  • 5.8% ASP.NET 587 websites, 127 of them announcing a version
  • 5.3% Microsoft IIS 539 websites, 539 of them announcing a version
  • 1.9% Next.js 188 websites, 0 of them announcing a version

How it is measured

The first page of every live domain is requested once, as any browser would, and its Server and X-Powered-By headers and the generator tag in its first 64 kilobytes are read, and nothing else is asked of the site.

The vulnerabilities come from CISA's catalogue of exploited vulnerabilities, the affected version ranges from NVD and the support cycles from endoflife.date, and all three are refreshed with every measurement.

It is measured after every weekly issue and within a day of a new entry for visible software, no domain is named and the states are never ranked.

A site can announce a version older than its code when its distribution backports the fixes, as Red Hat and Debian do, and it can announce only its major, in which case it is counted only when every version under it is affected or none is, so the share measures what a site announces, not exactly what runs inside it.

Sources

Follow the alerts

When the index first measures the Arabian Gulf against a recent exploited vulnerability, an issue opens in the repository with the figure and the link, so GitHub tells you if you watch its issues, and the Atom feed carries it too.