“Approximately 110,000 PHP Servers” in Korea: How Were They Counted?

After an article titled “Two Critical PHP Vulnerabilities Discovered… Urgent Updates Needed Due to Risk of Web Server Attacks” was posted on the AhnLab website yesterday (October 21), we received many inquiries asking for the basis of the figure “approximately 110,000 Korean PHP server IP addresses” cited in the article. This article explains how that figure was calculated and what to keep in mind when interpreting the number.

 

First, a Point to Note

“Approximately 110,000” is not a figure obtained by counting domestic websites one by one. It is the number of search results identified as “PHP” by an internet asset search engine that locates servers and services connected to the internet.

Therefore, this number should not be interpreted as the number of websites in Korea or the number of web servers exposed to vulnerabilities. Further details are provided below in the section titled “Points to Consider When Interpreting the Figures.”

 

Search Method and Overall Results

AhnLab ASEC queried three private internet asset search services in the US, South Korea, and China for services using PHP. In this article, these services are referred to as Company A, Company B, and Company C, respectively. The search criteria used were as follows.

• Company A: host.Services.Software: (product = "php")
• Company B: product: php
• Company C: app="php"

Search Service	Total Number of Results
Company A	3,035,754
Company B	852,802
Company C	19,093,049

 

The top 20 results by region and country for each service are as follows. Since the aggregation criteria differ by service, the numbers in the table should only be compared within the same service.

 

Company a Search Results – Top 20

Rank	Region/Country	Number of Results	Percentage of Total Results
1	US	650,463	21.4%
2	Germany	272,951	9.0%
3	China	237,542	7.8%
4	France	166,591	5.5%
5	Japan	150,757	5.0%
6	South Korea	125,859	4.1%
7	Russia	105,481	3.5%
8	Hong Kong	101,822	3.4%
9	Brazil	89,464	2.9%
10	Italy	80,332	2.6%
11	United Kingdom	80,117	2.6%
12	Netherlands	74,374	2.4%
13	Singapore	65,163	2.1%
14	India	64,239	2.1%
15	Canada	58,579	1.9%
16	Spain	57,871	1.9%
17	Indonesia	47,970	1.6%
18	Taiwan	45,520	1.5%
19	Ireland	33,292	1.1%
20	Australia	32,569	1.1%

The figure of “approximately 110,000” mentioned in AhnLab’s previous post is based on search results from Company A. On October 21, the number of results in South Korea was 112,183, and on October 22, it was confirmed to be 125,859. Search results may vary depending on the time of the survey.

 

Search Results from Company B – Top 20

Rank	Region/Country	Number of Results	Percentage of Total Results
1	US	233,477	27.4%
2	Japan	69,427	8.1%
3	Germany	48,627	5.7%
4	South Korea	47,209	5.5%
5	China	45,518	5.3%
6	France	40,691	4.8%
7	Netherlands	31,018	3.6%
8	United Kingdom	22,884	2.7%
9	Singapore	21,749	2.6%
10	Brazil	20,233	2.4%
11	Italy	17,767	2.1%
12	India	17,037	2.0%
13	Canada	16,562	1.9%
14	Australia	12,862	1.5%
15	Hong Kong	12,784	1.5%
16	Indonesia	10,930	1.3%
17	Taiwan	10,672	1.3%
18	Mexico	9,703	1.1%
19	Ireland	9,648	1.1%
20	Spain	8,353	1.0%

Company B’s total results amounted to 852,802 instances, representing approximately 28% of Company A’s total, while South Korea ranked fourth with 47,209 instances. It is reasonable to view this discrepancy not as a difference in the actual number of PHP servers, but rather as a result of differences in the scope of the survey and the units of aggregation for each Service.

 

Company C Search Results – Top 20

Rank	Region/Country	Number of Results	Percentage of Total Results
1	United States (US)	100,096,425	44.3%
2	China (CN)	31,796,955	14.1%
3	Germany (DE)	11,837,540	5.2%
4	Hong Kong	10,562,763	4.7%
5	Singapore (SG)	7,864,949	3.5%
6	Japan (JP)	5,878,224	2.6%
7	France (FR)	5,804,484	2.6%
8	United Kingdom (GB)	4,294,377	1.9%
9	Netherlands (NL)	4,011,204	1.8%
10	Russia (RU)	3,343,903	1.5%
11	Canada (CA)	2,903,649	1.3%
12	Brazil (BR)	2,858,407	1.3%
13	South Korea (KR)	2,848,656	1.3%
14	India (IN)	2,691,022	1.2%
15	Poland (PL)	2,035,516	0.9%
16	Italy (IT)	2,000,012	0.9%
17	Spain (ES)	1,972,981	0.9%
18	Indonesia (ID)	1,829,070	0.8%
19	Australia (AU)	1,736,216	0.8%
20	United Kingdom of the Virgin Islands (VG)	1,571,503	0.7%

Company C showed a significantly higher number of results than Companies A and B. In Company C’s search results, South Korea ranked 13th with 2,848,656 entries. This appears to be due to differences in how results are counted, rather than indicating that there are actually that many PHP servers or websites.

 

Why the Numbers Vary Across Search Services

What constitutes “one result” varies from service to service. Some services count a single IP address as one result, while others count each combination of an IP address and port, or each individual domain, as one result. This is similar to how the number changes depending on whether an apartment building is counted as “one building” or “100 households.”

PHP, in particular, is widely used in “shared hosting” environments where multiple websites share a single web server. In such cases, even though there is only one web server, results may be recorded separately for each domain, so the number of results can vary by several times across services even under similar search conditions. Furthermore, since the scope of the survey and the time of the search vary, it is not appropriate to compare or aggregate figures across different Services.

 

Points to Note When Interpreting the Figures

• This is not the number of websites. Since Company A’s results are based on hosts (IP addresses), it is more accurate to describe them as “results of queries for PHP-identified hosts in Korea” rather than “the number of domestic websites” when explaining them to external parties.
• It does not represent the number of vulnerable servers. Since the search criteria do not include criteria for checking PHP versions or vulnerability status, these results cannot be interpreted as the number of servers affected by specific vulnerabilities.

• “Korea” refers to geographic location. Since the results are classified based on the search service’s region-level location data, they do not represent all websites operated by domestic companies and organizations.

   

Summary

Since the scope of data collection and aggregation criteria vary by search engine, it is difficult to determine the exact number of servers or websites using PHP worldwide or in Korea. However, what matters more than the exact number is the scale. PHP is used very widely across the global web, with approximately 3 million PHP-related results found using Company A’s search engine and approximately 19 million using Company C’s. In Korea alone, 125,859 instances were identified using Company A’s search engine.

This vulnerability affects virtually all PHP versions—including PHP 8.2 Through 8.5, Which are currently supported, as well as older versions that are no longer supported. Therefore, PHP servers that have not applied security updates could become Attack Targets, regardless of whether they are located in Korea or globally. If you operate a PHP-based service, you should check the version you are using and immediately update to the latest version with security updates.

AhnLab plans to continue monitoring related trends to minimize damage to customers and will promptly share any additional information as it becomes available.