In the May 2009 survey we received responses from 235,890,526 sites, an increase of 4.3 million on last month. Apache remains firmly in the lead, having gained 3.3 million sites, and Microsoft-IIS remains second, having lost almost 0.9 million (mostly due to less activity seen at accounts on Microsoft's own Live Spaces service). QQ.com, the popular IM service in China, remains third with 29M sites. Google takes fourth place, after gaining approximately 1.5 million sites, and remains ahead of nginx which gained 200,000. The Russian nginx web server web server nginx has been steadily increasing in popularity for several years. The chart below shows the geographical distribution of sites using nginx and in particular illustrates that China now has the most nginx sites, with almost 2.5 million and that the US is close behind with almost 2.4 million. nginx was written by Igor Sysoev and is well known for its rich feature set and low resource consumption.

Developer	April 2009	Percent	May 2009	Percent	Change
Apache	106,368,727	45.95%	109,672,897	46.49%	0.55
Microsoft	67,767,928	29.27%	66,871,466	28.35%	-0.92
qq.com	28,905,133	12.49%	28,905,135	12.25%	-0.23
Google	7,229,033	3.12%	8,678,011	3.68%	0.56
nginx	6,100,424	2.64%	6,342,250	2.69%	0.05

(more...)

The most recent Netcraft Web Server Survey found more than 62 million websites running Microsoft IIS 6.0, but many of these are unlikely to be affected by the latest WebDAV remote authentication bypass vulnerability.

A new WebDAV vulnerability was published by Nikolaos Rangos on Friday, and details how attackers can bypass access restrictions using a flaw in the WebDAV functionality on IIS 6.0. By failing to handle Unicode tokens properly, the bug gives attackers access to password protected folders and, in some cases, the ability to upload files to the affected web servers.

Although IIS 6.0 accounts for more than 90% of the Microsoft sites on the Internet, the total number of vulnerable sites is likely to be substantially less than 62 million because WebDAV is not a default component of IIS 6.0 when a Windows Server 2003 machine is given the role of Application Server. Nonetheless, some people may install and enable WebDAV to provide a convenient means of publishing and managing web server content through firewalls – because WebDAV is an extension to the HTTP protocol, it can operate over the same port number as HTTP.

Microsoft issued a security advisory on Monday, which also lists IIS 5.0 as vulnerable. This issue may affect a much larger proportion of the 2.8 million IIS 5.0 websites as, unlike its successor, Windows 2000 Server automatically installs WebDAV alongside IIS 5.0.

DataPipe, New York Internet, Virtual Internet and Hosting 4 Less had the most reliable hosting company sites in April 2009.

Jersey City based DataPipe's commitments to customer service were recognised in this year's Stevie Awards, where the company was listed as a finalist in the Customer Service Department of the Year - IT & Telecommunications category. The company has more than 1,500 customers in six data centres and eight business office locations in the United States, the United Kingdom and China.

New York Internet was established in 1996 and is located in the heart of the Wall Street area. The company's core services include dedicated servers, colocation and virtual web hosting - all backed with a 99.999% uptime guarantee.

Virtual Internet (VI) offers a comprehensive range of hosting solutions, including managed hosting and dedicated servers running Windows or Linux. VI also offers domain registration services - in October 2000, it was the first UK public company to become an official ICANN accredited registrar. VI's own website is served by Microsoft IIS 6.0 on Windows Server 2003.

April saw Hosting 4 Less make its second consecutive appearance as one of the most reliable hosting company sites. The California based company runs its own site on Linux, offers a 99.9% uptime guarantee and also runs backup4less.com, which offers an online solution for remote backups.

Among April's top ten hosting company sites, four companies run their sites on Linux. Three companies run their sites on FreeBSD (including DataPipe and New York Internet), while the remaining two identifiable operating systems are Windows Server 2003.

(more...)