91% of New Zealand websites that show their PHP version haven’t updated to a patched release for this week’s critical PHP flaw — and a third are running PHP so outdated there’s no official fix for it

The PHP project supports each version for a fixed period. After that it stops publishing security releases. On 21 October 2026 it released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

• PHP 7.4, 8.0 and 8.1 get no official fixed release. The PHP security team published minimal source-code patches for 7.4 to 8.1, but a host has to build and install those themselves.
• PHP 7.3 and older get no fix of any kind from the PHP project.
• Supported versions are only safe once the host installs the new release and restarts the web server.

The domain list

We built a list of registrable .co.nz names from public sources: the Common Crawl web graph (2022 to 2026 releases), the Tranco, Cisco Umbrella and Majestic top-site lists, the Chrome UX Report (New Zealand and global), and the open tb0hdan domains dataset. Names that did not resolve in DNS were dropped. Other New Zealand zones (.nz, .org.nz, .govt.nz and others) are not included.

What we collected

For each domain we made one ordinary request for the homepage, as a browser would, from a crawler that identifies itself (NZWebsitesCensus/1.0). If a site did not answer we tried at most a few address variations (https, http, www). We read only what the server sends back to every visitor: the response headers and the homepage HTML. We did not probe for vulnerabilities, log in, request any other page, or test whether any site can be exploited.

How versions and platforms were identified

A site counts as “disclosing” when its Server or X-Powered-By header, or a technology fingerprint built from those headers, contains a full PHP version number. Platforms were identified with the open-source Wappalyzer fingerprints and the page’s generator tag. Percentages in the version charts use disclosing sites as the denominator; platform percentages use sites with an identifiable platform.

.co.nz sites scanned

252,433

Responded to the request

217,507

Platform identified

99,529

Disclosed a PHP version

16,565

Definitions

• Patched release: the site reports PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later release on the same branch. These are the first releases with the fix.
• Not yet patched: the site reports any other version, that is, a PHP version released before this week’s fix. That includes supported branches that have not been updated yet (for example 8.3.35) and every end-of-life version.
• No official fix: PHP 8.1 or older. End-of-life: PHP 7.4 or older.
• Runs on PHP: sites whose response headers or detected technology mention PHP or a PHP-based platform such as WordPress, as a share of the 99,529 sites whose platform we could identify.

All shares are of the 16,565 sites that disclosed an exact PHP version, unless stated otherwise. Each figure is a snapshot of the moment the site was checked.

Caveats

• The figures are a floor, not a total. Most servers do not announce their PHP version, so this counts only the 16,565 sites that do. Servers configured to hide version details tend to be better maintained, so the share of out-of-date PHP among all sites is unknown and the absolute number of exposed sites is very likely higher than shown here.
• A version number is not proof of exposure. Some Linux distributions and long-term-support vendors back-port security fixes without changing the version string, so a few sites listed as old may be patched. This matters most for the “not yet patched” figure: a server patched by its distribution can still report, say, 8.2.34. In the other direction, a supported version is only safe if the latest point release is installed.
• Very old versions. Published analysis traces the affected code back to PHP 5.4. The 293 sites showing PHP 5.3 or older may not be affected by these two flaws specifically, but have had no security fixes of any kind for over a decade. We count them as end-of-life.
• A snapshot in time. The scan began on 21 October 2026, the day the fixed releases were published, so many sites were checked within hours of the fix appearing. Hosts are updating servers now, and the “not yet patched” share in particular will fall. The “last updated” time above shows when this data was generated.
• One domain, one site. Many domains share a server or hosting account, so site counts are not counts of servers or organisations. We do not name or list individual sites.

Sources on the vulnerabilities

• PHP project security advisory, 21 October 2026
• Tenable: PHP2Shell (CVE-2026-109618, CVE-2026-109619) FAQ
• PHP supported versions

Data & analysis by TheColab.ai. You are welcome to cite and reproduce these figures with credit. The underlying aggregate numbers are published at data.json.