Gulf CybersecurityBaseline
العربيةCheck your domain
Doha at night from space, the city's lights spreading from the bay along its roads
Doha at night, photographed by NASA from the International Space Station on 9 December 2010

Readiness Qatar

Whenever an exploited vulnerability in software visible from outside is catalogued, the first page of every live domain is read within a day, so we know how many sites still announce an affected version, and the measurement is repeated after every issue to see how fast the patches arrive.

Readiness

Measured on 23 October 2026 by reading the first page of every live domain in Qatar, and 918 websites answered.

Exploited vulnerabilities

Every vulnerability CISA has added to its catalogue of exploited vulnerabilities that affects software announced from outside, newest first, with the share of sites announcing an affected version among the sites that announce a version.

  1. 47.6% Apache HTTP Server CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Vulnerability 10 of 21 announcing a full version Catalogued on 1 May 2025 CISA catalogue NVD
  2. 0.0% PHP CVE-2024-4577 PHP-CGI OS Command Injection Vulnerability 0 of 108 announcing a full version Catalogued on 12 June 2024 Used in ransomware campaigns CISA catalogue NVD
  3. 0.0% OpenSSL CVE-2014-0160 OpenSSL Information Disclosure Vulnerability 0 of 3 announcing a full version Catalogued on 4 May 2022 CISA catalogue NVD
  4. 0.9% PHP CVE-2012-1823 PHP-CGI Query String Parameter Vulnerability 1 of 108 announcing a full version Catalogued on 25 March 2022 CISA catalogue NVD
  5. 0.0% Drupal CVE-2020-13671 Drupal core Un-restricted Upload of File 0 of 13 announcing a full version Catalogued on 18 January 2022 CISA catalogue NVD
  6. 0.0% Apache HTTP Server CVE-2021-42013 Apache HTTP Server Path Traversal Vulnerability 0 of 21 announcing a full version Catalogued on 3 November 2021 Used in ransomware campaigns CISA catalogue NVD
  7. 0.0% Apache HTTP Server CVE-2021-41773 Apache HTTP Server Path Traversal Vulnerability 0 of 21 announcing a full version Catalogued on 3 November 2021 Used in ransomware campaigns CISA catalogue NVD
  8. 9.5% Apache HTTP Server CVE-2019-0211 Apache HTTP Server Privilege Escalation Vulnerability 2 of 21 announcing a full version Catalogued on 3 November 2021 CISA catalogue NVD
  9. 0.0% Drupal CVE-2018-7600 Drupal Core Remote Code Execution Vulnerability 0 of 23 announcing a full version Catalogued on 3 November 2021 Used in ransomware campaigns CISA catalogue NVD
  10. 0.0% Microsoft IIS CVE-2017-7269 Microsoft Windows Server Buffer Overflow Vulnerability 0 of 17 announcing a full version Catalogued on 3 November 2021 CISA catalogue NVD

And 7 more in Apache Tomcat and Joomla, which no site announces a full version of, so they are not measured yet.

Software past its support

Among the sites that announce the version of their software, the share running a version its maker no longer supports according to endoflife.date, so it receives no security patches.

  • 0.0% WordPress 0 of 119 announcing a version Most common 7.1, 7.0 and 6.9
  • 38.9% PHP 42 of 108 announcing a version Most common 8.2, 8.3 and 7.4
  • 89.8% nginx 53 of 59 announcing a version Most common 1.29, 1.24 and 1.18
  • 7.7% Drupal 2 of 26 announcing a version Most common 7
  • 0.0% Apache HTTP Server 0 of 23 announcing a version Most common 2.4
  • 5.9% Microsoft IIS 1 of 17 announcing a version Most common 10.0 and 8.5
  • 33.3% OpenSSL 1 of 3 announcing a version Most common 3.5 and 1.1.1

What sites announce

Only what a site writes about itself in the headers of its first page or in its generator tag is measured, so the figures are a floor, and sites behind a front such as Cloudflare do not announce their server.

  • 74.1% Announce their server 680 of 918 whose first page was read
  • 30.1% Announce a software version 276 of 918 whose first page was read
  • 30.2% Announce their content system 277 of 918 whose first page was read
  • 24.3% Behind a front that hides the server 223 of 918 whose first page was read
Doha at night from space, the city's lights spreading from the bay along its roads
A closer look at the photograph at the top of the page.

Most announced

  • 26.5% WordPress 243 websites, 119 of them announcing a version
  • 21.2% Apache HTTP Server 195 websites, 23 of them announcing a version
  • 16.0% nginx 147 websites, 59 of them announcing a version
  • 11.8% PHP 108 websites, 108 of them announcing a version
  • 9.9% LiteSpeed 91 websites, 0 of them announcing a version
  • 3.2% Drupal 29 websites, 26 of them announcing a version
  • 2.3% ASP.NET 21 websites, 7 of them announcing a version
  • 1.9% Microsoft IIS 17 websites, 17 of them announcing a version

How it is measured

The first page of every live domain is requested once, as any browser would, and its Server and X-Powered-By headers and the generator tag in its first 64 kilobytes are read, and nothing else is asked of the site.

The vulnerabilities come from CISA's catalogue of exploited vulnerabilities, the affected version ranges from NVD and the support cycles from endoflife.date, and all three are refreshed with every measurement.

It is measured after every weekly issue and within a day of a new entry for visible software, no domain is named and the states are never ranked.

A site can announce a version older than its code when its distribution backports the fixes, as Red Hat and Debian do, and it can announce only its major, in which case it is counted only when every version under it is affected or none is, so the share measures what a site announces, not exactly what runs inside it.

Sources

Follow the alerts

When the index first measures the Arabian Gulf against a recent exploited vulnerability, an issue opens in the repository with the figure and the link, so GitHub tells you if you watch its issues, and the Atom feed carries it too.