Menlo Security has scanned 750,000 websites and found several with known vulnerabilities.
More than a fifth (21%) of websites have known vulnerabilities, including in their Web servers, according to the State of the Web March 2015 that scanned 750,000 domains.
“The homepage of each of these 750,000 domains in the Alexa 1 million list [Alexa's top 1 million Websites] has been visited by users at least once,” Kowsik Guruswamy, CTO of Menlo Security, tells eWEEK.
Examining the data, Guruswamy said that 10 percent of the scanned sites were running a vulnerable version of PHP. By “vulnerable” we mean a site running a version of PHP that shows at least one outstanding vulnerability in the CVE database. PHP is an open-source language widely deployed in Web server infrastructure and used by many content management systems (CMSes), including WordPress, Drupal and Joomla.
Vulnerable Web server software was also a common feature, with 4% of sites running a vulnerable version of Apache HTTP or a vulnerable version of Microsoft Internet Information Services (IIS).
The risk of older, unpatched software is an issue that others have highlighted in recent months. Hewlett-Packard's 2015 Cyber Risk, published on February 23, found that 44% of breaches could be attributed to patched vulnerabilities that were between two and four years old.
To scan the sites, Menlo Security used a custom tool to simulate a full-page browser load on each domain, according to Guruswamy. In addition, the company used its own technology to collect the relevant data.
As a company, Menlo Security is still in the "obscurity", while the technology it uses and its offered products have not yet been fully revealed.
