Gulf CybersecurityBaseline
العربيةCheck your domain
Riyadh at night from space, a wide grid of white and amber light in the desert
Riyadh at night, photographed by NASA from the International Space Station on 28 December 2024

Readiness Saudi Arabia

Whenever an exploited vulnerability in software visible from outside is catalogued, the first page of every live domain is read within a day, so we know how many sites still announce an affected version, and the measurement is repeated after every issue to see how fast the patches arrive.

Readiness

Measured on 23 October 2026 by reading the first page of every live domain in Saudi Arabia, and 6,924 websites answered.

Exploited vulnerabilities

Every vulnerability CISA has added to its catalogue of exploited vulnerabilities that affects software announced from outside, newest first, with the share of sites announcing an affected version among the sites that announce a version.

  1. 54.8% Apache HTTP Server CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Vulnerability 34 of 62 announcing a full version Catalogued on 1 May 2025 CISA catalogue NVD
  2. 0.3% PHP CVE-2024-4577 PHP-CGI OS Command Injection Vulnerability 2 of 791 announcing a full version Catalogued on 12 June 2024 Used in ransomware campaigns CISA catalogue NVD
  3. 0.0% OpenSSL CVE-2014-0160 OpenSSL Information Disclosure Vulnerability 0 of 14 announcing a full version Catalogued on 4 May 2022 CISA catalogue NVD
  4. 0.1% PHP CVE-2012-1823 PHP-CGI Query String Parameter Vulnerability 1 of 791 announcing a full version Catalogued on 25 March 2022 CISA catalogue NVD
  5. 0.0% Drupal CVE-2020-13671 Drupal core Un-restricted Upload of File 0 of 40 announcing a full version Catalogued on 18 January 2022 CISA catalogue NVD
  6. 0.0% Apache HTTP Server CVE-2021-42013 Apache HTTP Server Path Traversal Vulnerability 0 of 62 announcing a full version Catalogued on 3 November 2021 Used in ransomware campaigns CISA catalogue NVD
  7. 0.0% Apache HTTP Server CVE-2021-41773 Apache HTTP Server Path Traversal Vulnerability 0 of 62 announcing a full version Catalogued on 3 November 2021 Used in ransomware campaigns CISA catalogue NVD
  8. 8.1% Apache HTTP Server CVE-2019-0211 Apache HTTP Server Privilege Escalation Vulnerability 5 of 62 announcing a full version Catalogued on 3 November 2021 CISA catalogue NVD
  9. 0.0% Drupal CVE-2018-7600 Drupal Core Remote Code Execution Vulnerability 0 of 49 announcing a full version Catalogued on 3 November 2021 Used in ransomware campaigns CISA catalogue NVD
  10. 0.3% Microsoft IIS CVE-2017-7269 Microsoft Windows Server Buffer Overflow Vulnerability 1 of 378 announcing a full version Catalogued on 3 November 2021 CISA catalogue NVD

And 7 more in Apache Tomcat and Joomla, which no site announces a full version of, so they are not measured yet.

Software past its support

Among the sites that announce the version of their software, the share running a version its maker no longer supports according to endoflife.date, so it receives no security patches.

  • 0.0% WordPress 0 of 1,141 announcing a version Most common 7.1, 7.0 and 6.8
  • 23.1% PHP 183 of 791 announcing a version Most common 8.3, 8.2 and 8.4
  • 2.9% Microsoft IIS 11 of 378 announcing a version Most common 10.0, 8.5 and 6.0
  • 92.3% nginx 250 of 271 announcing a version Most common 1.29, 1.18 and 1.24
  • 1.5% Apache HTTP Server 1 of 67 announcing a version Most common 2.4 and 2.2
  • 16.4% Drupal 10 of 61 announcing a version Most common 7
  • 85.7% OpenSSL 12 of 14 announcing a version Most common 1.1.1, 1.0.2 and 3.5

What sites announce

Only what a site writes about itself in the headers of its first page or in its generator tag is measured, so the figures are a floor, and sites behind a front such as Cloudflare do not announce their server.

  • 83.5% Announce their server 5,784 of 6,924 whose first page was read
  • 34.0% Announce a software version 2,356 of 6,924 whose first page was read
  • 29.4% Announce their content system 2,036 of 6,924 whose first page was read
  • 43.4% Behind a front that hides the server 3,002 of 6,924 whose first page was read
Riyadh at night from space, a wide grid of white and amber light in the desert
A closer look at the photograph at the top of the page.

Most announced

  • 28.2% WordPress 1,955 websites, 1,141 of them announcing a version
  • 14.2% Apache HTTP Server 984 websites, 67 of them announcing a version
  • 12.0% nginx 828 websites, 271 of them announcing a version
  • 11.4% PHP 791 websites, 791 of them announcing a version
  • 8.2% LiteSpeed 567 websites, 0 of them announcing a version
  • 6.0% ASP.NET 413 websites, 80 of them announcing a version
  • 5.5% Microsoft IIS 378 websites, 378 of them announcing a version
  • 2.1% Next.js 145 websites, 0 of them announcing a version

How it is measured

The first page of every live domain is requested once, as any browser would, and its Server and X-Powered-By headers and the generator tag in its first 64 kilobytes are read, and nothing else is asked of the site.

The vulnerabilities come from CISA's catalogue of exploited vulnerabilities, the affected version ranges from NVD and the support cycles from endoflife.date, and all three are refreshed with every measurement.

It is measured after every weekly issue and within a day of a new entry for visible software, no domain is named and the states are never ranked.

A site can announce a version older than its code when its distribution backports the fixes, as Red Hat and Debian do, and it can announce only its major, in which case it is counted only when every version under it is affected or none is, so the share measures what a site announces, not exactly what runs inside it.

Sources

Follow the alerts

When the index first measures the Arabian Gulf against a recent exploited vulnerability, an issue opens in the repository with the figure and the link, so GitHub tells you if you watch its issues, and the Atom feed carries it too.