October 2026
PHP security · New Zealand vs Australia
In the week of 20 October 2026 the PHP project disclosed two critical flaws, nicknamed “PHP2Shell”, that can let someone take over a web server without a password, and released fixes on 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We gave .co.nz and .com.au websites the same check: one ordinary homepage request each, reading what the server says about itself.
Head to head · on a patched release for PHP2Shell
Australia Still scanningScan complete
4.2%
on a patched release, interim
of 60,425 sites showing a PHP version, from 441,573 .com.au names checked so far
30.2% of an estimated 1.46 million live .com.au names checked
Expected to finish between 1:30 am and 8:00 am on 23 Oct, NZ time. In Sydney that’s between 11:30 pm on 22 Oct and 6:00 am on 23 Oct.
Checked 22 Oct, 5:10 pm to 22 Oct, 7:53 pm NZ time (updates hourly)
New Zealand Census complete
9.1%
on a patched release
of 19,122 sites showing a PHP version, from 277,875 .co.nz domains checked
Checked 22 Oct, 8:53 am to 22 Oct, 12:45 pm NZ time
We have re-checked these New Zealand sites every hour since. That tracker is further down and isn’t compared with Australia.
A fair fight, with caveats. Australia’s check started about 4½ hours after New Zealand’s finished, so its hosts had more time to install the fix. While the scan runs, names are checked in roughly alphabetical order, so interim figures aren’t a random sample of Australian sites and can shift. Both shares count only sites that show an exact PHP version, and a version number isn’t proof either way: some hosts patch without changing it. This isn’t a measure of which country is more secure.
Dots are illustrative: their positions are made up, their colours follow each country’s real shares. Agents sweep the map to show what automated checking looks like. AI tools helped researchers at Calif, OpenAI and Wiz find PHP2Shell (Wiz).
The scoreboard
Every figure is a share of a stated group of sites, so the two countries can be read side by side even though Australia has more websites. Australia’s column is interim while its scan runs: names are checked in roughly alphabetical order, so interim figures aren’t a random sample of Australian sites and can shift.
| Measure | New ZealandNZ | AustraliaAU (interim) |
|---|---|---|
| Domains checked | 277,875 | 441,573 so far |
| Answered our request % of domains checked | 91.1% | 88.0% |
| Showed an exact PHP version % of those that answered | 7.6% | 15.6% |
| On a patched release % of those showing a version · head to head | 9.1% | 4.2% |
| No official fix, PHP 8.1 or older % of those showing a version | 44.7% | 46.5% |
| End-of-life, PHP 7.4 or older % of those showing a version | 33.6% | 37.0% |
| WordPress % of sites with an identified platform | 47.8% | 57.6% |
| WordPress sites on a patched release % of WordPress sites showing a version | 10.3% | 4.5% |
| Behind Cloudflare % of those that answered | 32.0% | 27.3% |
New Zealand census: 19,122 sites showing a version, checked 22 Oct, 8:53 am to 22 Oct, 12:45 pm NZ time. Australia: 60,425 sites showing a version, checked 22 Oct, 5:10 pm to 22 Oct, 7:53 pm NZ time, figures as of 22 Oct, 7:53 pm and updated hourly while the scan runs.
01 · Who shows a version
Most servers keep their PHP version to themselves, and that’s good practice. Everything below about versions and patching is about the sites that do show it, so it’s a floor, not a count of every exposed site.
| Measure | New Zealand | Australia |
|---|
02 · Patched vs not patched
Two different problems hide in that number. Sites on PHP 8.2 or newer can fix it with a routine update. Sites on PHP 8.1 or older get no official fix at all: 44.7% in New Zealand and 46.5% in Australia need a bigger upgrade.
| Group | New Zealand | Australia |
|---|
03 · Top versions
PHP 7.4.33, the last 7.4 release from 2022, is near the top on both sides of the Tasman. The supported releases just before the fix, 8.2.34 and 8.3.35, are common too: those sites are one routine update away.
| Version | Status | Sites | % showing a version |
|---|
| Version | Status | Sites | % showing a version |
|---|
04 · Platforms
Self-hosted software such as WordPress runs on PHP that the owner or their host has to update. Hosted builders such as Squarespace, Wix and Shopify run their own servers and patch them centrally.
Of WordPress sites showing a PHP version, 10.3% in New Zealand (1,201 of 11,636) and 4.5% in Australia (1,861 of 41,601) were on a patched release.
| Platform | New Zealand | Australia |
|---|
05 · CDN and hosting
What answered our request: a CDN in front, or the web server software itself. A CDN or firewall can hide the PHP version and block some attacks, but it isn’t a fix. The server behind it still runs PHP and still needs the update.
| CDN or server | New Zealand | Australia |
|---|
New Zealand only · Live patch tracker
Every hour we revisit the 18,252 websites that showed an exact PHP version in our first scan, with one ordinary homepage request each, and count how many we have seen move to a release with the fix. That total only rises: each site counts once, the first time we see it upgraded. What each check sees right now is a separate measure, further down, and it can go down as well as up.
This tracker follows New Zealand sites only, after the census. Its figures are a later, separate measurement and aren’t compared with Australia’s census figures above.
–
Loading the hourly series…
Total sites observed upgrading
| Check (NZ time) | Window starts | Window | New upgrades seen | Check status | Total observed upgrading |
|---|
14.4%
on a patched release at the latest check · latest check 22 October 2026, 7:21 pm NZDT
Share of tracked sites on a patched PHP release
Tracking started 22 October 2026, 10:37 am NZDT — first update in ~1 hour.
| Checked (NZ time) | Patched | Not yet patched | Showing a PHP version |
|---|
–
Loading the count…
We count a website once, the first time an hourly re-check sees it on a fixed release (8.5.12, 8.4.27, 8.3.36, 8.2.35 or later) after it showed an older version on our tracking list. Sites that hide their version or don’t answer are never counted as upgraded. This is what we observed, not a claim that this page caused it, and a version number can’t prove a site is secure.
We aren’t sending email yet. When delivery is switched on, we’ll send one confirmation email, and alerts start only if you click it. Until then you won’t get anything from us about this website.
06 · What this means
The PHP project supports each version for a fixed period. After that it stops publishing security releases. On 21 October 2026 it released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
46.3% NZ · 49.3% AU
Haven’t updated yet. On PHP 8.2 or newer but not yet on a patched release, as a share of sites showing a version. This is a routine update a host can install, and many will catch up over the coming days.
44.7% NZ · 46.5% AU
Can’t update the normal way. Running PHP 8.1 or older, which won’t get the fix through normal updates. That includes 33.6% (NZ) and 37.0% (AU) on end-of-life PHP 7.4 or older. These sites need a major PHP upgrade, which can mean updating the website software too.
Ask your web developer or hosting company which PHP version your site uses and whether this week’s fix is installed. If the site runs PHP 8.1 or older, plan an upgrade to a supported version. Many hosts let you change the PHP version in their control panel, but test the site afterwards, because old themes and plugins can break.
Some servers announce their PHP version in a response header called X-Powered-By, for example PHP/7.4.33. In most browsers, open the developer tools (F12), choose the Network tab, reload the page and select the first request to see its headers. No header does not mean a site is safe; it only means the version is not shown. The reliable answer comes from the people who run the site.
Check a site
Enter a website address. We make one ordinary request to its homepage, the same as a visitor would, and read what the server says about itself.
We’ll only email you about security incidents that matter to New Zealand websites. Every email has an unsubscribe link.
A plain-English explainer on this week's critical PHP flaw and what New Zealand site owners should do. It was made before the Australian comparison.
Older figures in this video. It was made before our 22 October correction and shows the original count of 19,644 PHP sites, which included some sites twice. The corrected census count is 19,122 unique sites, and the 91% headline is unchanged after rounding. See the correction
07 · Questions
A public reference on how New Zealand and Australian websites stand on this week’s critical PHP vulnerabilities. It compares a census of 277,875 unique .co.nz domains checked on 22 October 2026 (NZ time) with a census of .com.au domains given the same check, starting about 4½ hours after New Zealand’s finished, which is still running. For New Zealand it also shows an hourly re-check of the sites that showed an exact PHP version. We corrected the census counts on 22 October; see Corrections. It does not name or list any individual site.
Both countries got the same check: one ordinary homepage request per domain, the same software reading the same headers, and the same rule for counting each domain once. The lists of names differ: the Australian list drew on more public sources (see Method), which may be part of why more Australian sites showed a version. The head-to-head figure is the share of sites showing an exact PHP version that were on a patched release when we checked them: 9.1% of 19,122 in New Zealand and 4.2% of 60,425 in Australia so far. Every figure is a percentage of a group we name next to it, because Australia has many more websites. Australia’s check started about 4½ hours after New Zealand’s finished, which gave its hosts more time to install the fix. While the scan runs, names are checked in roughly alphabetical order, so interim figures aren’t a random sample of Australian sites and can shift. The New Zealand hourly tracker is a later, separate measurement, so we don’t set it against Australia.
There are many more .com.au names than .co.nz names, and we check them politely, one request per site at a steady rate. The page shows how far through the scan is and a finish estimate, based on how fast recent batches have gone. Until it finishes, the Australian figures are interim and update every hour. Names are checked in roughly alphabetical order, so the interim figures aren’t a random sample and can move as more sites are checked. The scan has now finished.
No. It compares one thing: how many sites that announce their PHP version were on a patched release at the moment we checked. Most sites don’t announce a version, some hosts patch without changing the version number, and Australia was checked later. A higher share patched is good news for those sites, not a security rating for a country.
In the week of 20 October 2026 the PHP project disclosed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”). In some set-ups they can let someone take over a web server without a password. PHP is the language behind roughly 70% of websites whose server language is known, including most WordPress sites. Fixed releases exist only for supported versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Each PHP version is supported for a fixed period, usually four years. After that, the PHP project stops publishing security releases for it, and the version is “end-of-life”. PHP 8.1 and older are past that point, so there is no official fixed release. The PHP team published unofficial source-code patches for 7.4 to 8.1, but a host has to build and install those themselves; PHP 7.3 and older get nothing. The dependable fix is to move to a supported version.
Ask your web developer or hosting company which PHP version your site runs and whether this week’s update is installed. Some sites also show the version in a response header called X-Powered-By, which you can see in your browser’s developer tools (Network tab). If no version is shown, that does not mean the site is safe. The goal is PHP 8.2 or newer, kept up to date. Sites built on hosted services such as Squarespace, Wix or Shopify are maintained by those companies.
Contact your host and ask them to move your site to a supported PHP version (8.2 or newer) with the latest update installed. Before or alongside that, update your website software, theme and plugins, because older ones may not work on newer PHP. Take a backup first and check the site afterwards. If you don’t know who hosts your site, your web developer or domain provider can usually tell you.
They are a floor, not a total. We only count sites that openly disclose their PHP version (19,122 in New Zealand, 60,425 in Australia so far); most servers don’t, so the real number of exposed sites is likely higher. The check is passive: one ordinary request per site for its homepage, reading the response headers and page, with no scanning, probing or attempts to exploit anything. It is a point-in-time snapshot that updates as the scan runs and hosts apply fixes. The “not yet patched” share is the most time-sensitive figure: the scan began on the day the fix was released, and servers patched by their Linux distribution may still report an older version number. See Methodology & caveats for detail.
The data and analysis are by TheColab.ai. You’re welcome to cite the figures with credit.
08 · Methodology & caveats
We built a list of registrable .co.nz names from public sources: the Common Crawl web graph (2022 to 2026 releases), the Tranco, Cisco Umbrella and Majestic top-site lists, the Chrome UX Report (New Zealand and global), and the open tb0hdan domains dataset. Names that did not resolve in DNS were dropped. Other New Zealand zones (.nz, .org.nz, .govt.nz and others) are not included.
Australia. We built a list of registrable .com.au names from public sources only, and from more of them than the New Zealand list: Common Crawl (2022 to 2026), the Tranco, Cisco Umbrella and Majestic lists, the Chrome UX Report (Australia and global), the tb0hdan Australia dataset, certificate transparency logs, and names that exist under other .au zones tried under .com.au. Names that did not resolve in DNS were dropped. There is no public list of every .com.au name, so this is a large public-source sample, not every Australian website. Other .au zones are not included. The Australian crawler identifies itself as AUWebsitesCensus/1.0 and started about 4½ hours after the New Zealand census finished; it is still running, in roughly alphabetical order, so Australian figures are interim and not yet a random sample.
Finish estimate. We count the live names still to check, plus names DNS hasn’t answered yet for the late end, and divide by the speed of the last six completed batches of 40,000 names: the early end uses the fastest of those, the late end the slowest plus 15%. It’s recalculated every hour.
For each domain we made one ordinary request for the homepage, as a browser would, from a crawler that identifies itself (NZWebsitesCensus/1.0). If a site did not answer we tried at most a few address variations (https, http, www). Sites that failed were re-checked in later retry and rescue passes, so some domains have more than one check. Each domain counts once: we use its latest successful answer, or its latest failed attempt if it never answered. We read only what the server sends back to every visitor: the response headers and the homepage HTML. We did not probe for vulnerabilities, log in, request any other page, or test whether any site can be exploited.
A site counts as “disclosing” when its Server or X-Powered-By header, or a technology fingerprint built from those headers, contains a full PHP version number. Platforms were identified with the open-source Wappalyzer fingerprints and the page’s generator tag. Percentages in the version charts use disclosing sites as the denominator; platform percentages use sites with an identifiable platform.
| Stage | New Zealand | Australia (so far) |
|---|---|---|
| Unique domains checked | 277,875 | 441,573 |
| Responded to the request | 253,113 | 388,447 |
| Platform identified | 113,184 | 193,482 |
| Disclosed a PHP version | 19,122 | 60,425 |
Shares of versions and patching are of the sites in each country that disclosed an exact PHP version, unless stated otherwise. Each figure is a snapshot of the moment the site was checked.
Data & analysis by TheColab.ai. You are welcome to cite and reproduce these figures with credit. The underlying aggregate numbers are published at data.json (as shown on this page) and census.json (the corrected 21 October census, with its selection rule). The two-country figures are at nz-vs-au.json.
09 · Corrections
Correction, 22 October 2026. We first published census figures that counted some websites more than once: when a site was re-checked in our retry and rescue passes, each extra check was counted as another website. We originally said we scanned 322,710 .co.nz websites; that was 322,710 checks of 277,875 unique domains. The PHP sample of 19,644 checks becomes 19,122 unique sites when each domain is counted once, at its latest successful check, and the census share not on a patched release moves from 91.0% to 90.9%. We have also withdrawn our claim that about 73% of identifiable New Zealand websites run on PHP. The mistake was ours. The details are below.
What went wrong. Our census checked each domain once, then re-checked sites that hadn’t answered in a retry pass and a rescue pass. Our report counted every check as a separate website. Sites checked two or three times were counted two or three times, which inflated the totals. This was our error. We have recounted so that each domain appears once, using its latest successful answer by check time, or its latest failed attempt if it never answered.
| Figure (21 October census) | Originally published | Corrected |
|---|---|---|
| .co.nz websites scanned | 322,710 “websites” | 277,875 unique domains (322,710 checks) |
| Sites disclosing an exact PHP version | 19,644 | 19,122 unique sites |
| Of those, not on a patched release | 17,877 (91.0%) | 17,385 (90.9%) |
| On a patched release | 1,767 | 1,737 |
| No official fix (PHP 8.1 or older) | 8,784 (44.7%) | 8,540 (44.7%) |
| Responded to the request | 269,260 | 253,113 |
| Platform identified | 114,829 | 113,184 |
| “Run on PHP” | about 73% of identifiable sites | Withdrawn (see below) |
Both headline shares round to 91%, so the main finding stands, but the counts behind it were too high. Interim totals shown while the scan was still running were counted the same way and are replaced too.
Withdrawn: “about 73% of identifiable New Zealand websites run on PHP”. That figure divided sites showing any sign of PHP by the sites whose platform we could name. Many sites in the first group are not in the second, so it was not a real share and should not have been presented as one. It also came from a .co.nz sample, not every New Zealand website. We have removed it. As a narrower observation: 32.7% of the 253,113 unique domains that answered showed some PHP indicator in their headers or detected technology. That is a lower bound for this sample, not an estimate of how many New Zealand sites use PHP.
The patch tracker was not affected. The hourly tracker re-checks a fixed list of 18,252 sites that showed an exact PHP version in the main census pass, counting each domain once. Its first point (21 October) and the hourly upgrade counts are unchanged. Its figures are a separate, later measurement: the PHP shares at the top of this page come from the latest hourly check of that list, so they differ from the census’s 90.9%.
Update, 22 October 2026. The page now leads with a comparison of the New Zealand and Australian censuses, so the PHP shares at the top no longer come from the hourly tracker. The tracker’s figures are in its own section.
What we changed: the census summary, the downloadable report and chart, the page text and its search and social descriptions. The corrected census is published at census.json with its selection rule. Our explainer video and earlier social posts still show the original counts; we have marked the video on this page.