The methodology behind the "110,000 PHP servers" figure is actually more interesting than the number itself. AhnLab's ASEC team used a combination of passive DNS data and active banner grabbing to enumerate publicly-facing PHP installations in Korean IP ranges.
Technical Breakdown: – Methodology: They queried known PHP-related paths (/phpinfo.php, /index.php) on Korean IPs and analyzed HTTP response headers for X-Powered-By: PHP or Server headers containing PHP version strings. – Scope: This only counts servers with publicly accessible PHP endpoints. Internal, firewalled, or non-responsive servers are excluded. – Relevance: This is a classic internet-wide scanning approach (similar to Shodan/Censys methodology) applied at a national level. It highlights the attack surface for the two recently disclosed critical PHP CVEs (likely CVE-2024-4577 and CVE-2024-5585, which allow RCE via CGI argument injection). – IOCs: No specific IPs or hashes provided—this is a census, not a compromise report.
Defense: If you're operating in Korea (or any region with a high PHP density), this is a reminder that internet-facing PHP servers are being actively enumerated by both researchers and threat actors. Patch immediately, and consider moving PHP behind a reverse proxy or WAF to reduce the banner-grabbing surface.
Source: r/SecOpsDaily · by /u/falconupkid