Method · Corrections

Method, caveats and corrections

How we built the lists and counted, what the numbers can’t tell you, where the data comes from, and every correction we have made.

Correction, 22 October 2026. We first published census figures that counted some websites more than once. The corrected counts, the withdrawn PHP share and our wording updates are in full in Corrections.

Method and caveats

How we counted, and what the numbers can’t tell you

The domain list

We built a list of registrable .co.nz names from public sources: the Common Crawl web graph (2022 to 2026 releases), the Tranco, Cisco Umbrella and Majestic top-site lists, the Chrome UX Report (New Zealand and global), and the open tb0hdan domains dataset. Names that did not resolve in DNS were dropped. Other New Zealand zones (.nz, .org.nz, .govt.nz and others) are not included.

Australia. We built a list of registrable .com.au names from public sources only, and from more of them than the New Zealand list: Common Crawl (2022 to 2026), the Tranco, Cisco Umbrella and Majestic lists, the Chrome UX Report (Australia and global), the tb0hdan Australia dataset, certificate transparency logs, and names that exist under other .au zones tried under .com.au. Names that did not resolve in DNS were dropped. There is no public list of every .com.au name, so this is a large public-source sample, not every Australian website. Other .au zones are not included. The Australian crawler identifies itself as AUWebsitesCensus/1.0 and started about 4½ hours after the New Zealand census finished.

Finish estimate (no longer shown). While the Australian census ran, the page showed a finish estimate, recalculated every hour from the speed of recent batches. The census finished at 3:53 am NZDT on 23 October, so its figures are now final.

What we collected

For each domain we made one ordinary request for the homepage, as a browser would, from a crawler that identifies itself (NZWebsitesCensus/1.0). If a site did not answer we tried at most a few address variations (https, http, www). Sites that failed were re-checked in later retry and rescue passes, so some domains have more than one check. Each domain counts once: we use its latest successful answer, or its latest failed attempt if it never answered. We read only what the server sends back to every visitor: the response headers and the homepage HTML. We did not probe for vulnerabilities, log in, request any other page, or test whether any site can be exploited.

How versions and platforms were identified

A site counts as “disclosing” when its Server or X-Powered-By header, or a technology fingerprint built from those headers, contains a full PHP version number. Platforms were identified with the open-source Wappalyzer fingerprints and the page’s generator tag. Percentages in the version charts use disclosing sites as the denominator; platform percentages use sites with an identifiable platform.

Sample sizes in each country
Stage	New Zealand	Australia
Unique domains checked	277,875	1,420,115
Responded to the request	253,113	1,254,985
Platform identified	113,184	624,670
Disclosed a PHP version	19,122	192,892

Definitions

Visibly patched: the site reports PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later release on the same branch. These are the first releases with the fix. The PHP project released them on 21 October 2026, 14:00 UTC (3 am, 22 October, NZ time); this site calls them “the 21 October fix”.
Version doesn’t show the fix: the site reports any other version, that is, a PHP version released before the 21 October fix. The host may still have backported the fix. That includes supported branches that have not been updated yet (for example 8.3.35) and every end-of-life version.
PHP 8.1 or older: all end of life, with no new PHP release. The host may have backported the fix. Where a chart splits them, “7.4 or older” and “8.0 or 8.1” are both end of life.

Shares of versions and patching are of the sites in each country that disclosed an exact PHP version, unless stated otherwise. Each figure is a snapshot of the moment the site was checked.

Caveats

Counts, not totals. Most servers do not announce their PHP version, so this counts only the sites that do, and we can’t say how the hidden ones compare. The share of out-of-date PHP among all sites is unknown. The page can’t count exposed sites at all: a version number doesn’t show a backported fix, and a hidden version shows nothing.
A version number is not proof of exposure. Hosting platforms such as cPanel, Plesk and CloudLinux, and Linux distributions, commonly ship backported fixes without changing the version number, so many sites shown on 7.4, 8.0, 8.1 or an older 8.2 or 8.3 release may be patched. It affects the “version doesn’t show the fix” figures most: a server patched by its distribution or hosting platform can still report, say, 8.2.34 or 7.4.33. In the other direction, a supported version only has the fix if the latest point release, or a backport, is installed.
A snapshot in time. The New Zealand census ran on 22 October 2026 (NZ time), within hours of the fixed releases, so many sites were checked soon after the fix appeared. Hosts that install new releases show up as a change in version. Hosts that backport don’t. The “Live · updated” time in the header shows when this data was generated.
The patch tracker follows a fixed list. The over-time chart re-checks only the 18,252 sites that showed an exact PHP version in the census’s main pass, which finished at 10:37 am NZDT on 22 October (the tracker baseline). It re-checks them every hour, one homepage request each with the census settings. The full census, with its retry passes, found 19,122 sites showing a version; sites first seen in those retries aren’t on the list. New sites are not added. Sites that stop answering or start hiding their version drop out of that check’s count, so the denominator moves a little from point to point. It covers New Zealand only and is not compared with Australia.
The Australian tracker is separate. It re-checks the 192,892 .com.au sites that showed an exact PHP version in the Australian census, one homepage request each with the census settings, every hour; each pass is timed and the chart shows how long the last one took. It started after the Australian census on its own list, so its figures are not compared with New Zealand’s tracker or either census.
Different times. Australia’s check started about 4½ hours after New Zealand’s finished, so its hosts had more time to install the fix. The comparison is of each census at the time it ran.
Different name lists. The Australian list drew on more public sources than the New Zealand one, including certificate transparency logs, so the two groups of sites weren’t assembled identically.
One domain, one site. Many domains share a server or hosting account, so site counts are not counts of servers or organisations. We do not name or list individual sites.

Sources on the vulnerabilities

PHP project release notes, 21 October 2026
NCSC NZ alert: “The NCSC is aware of reports of active exploitation.”
Plesk: fixed PHP 7.4, 8.0 and 8.1 builds
CloudLinux: fixed builds, including cPanel’s EasyApache PHP packages (ea-php74/80/81) for CloudLinux servers
Ubuntu USN-8948-1 and USN-8948-2
Red Hat and AlmaLinux are releasing updates; check your vendor (Red Hat bulletin RHSB-2026-013)
PHP supported versions

Data & analysis by TheColab.ai. You are welcome to cite and reproduce these figures with credit. The underlying aggregate numbers are published at data.json (as shown on this page) and census.json (the corrected census of 22 October, NZ time, with its selection rule). The two-country figures are at nz-vs-au.json.

Provenance

Where the figures come from

Every figure on this site is an aggregate count from our own scans. No file or response names a website.

data.json: the New Zealand figures as shown on this site, from the latest hourly re-check of the tracked list.
census.json: the corrected New Zealand census of 22 October (NZ time), with its selection rule.
nz-vs-au.json: the two-country census figures.
hosting.json: hosting stacks and host or network labels for the tracked New Zealand sites.
Open data API: the same figures as JSON, with the hourly series. No key, open CORS.

Scans are by TheColab.ai crawlers that identify themselves (NZWebsitesCensus/1.0 and AUWebsitesCensus/1.0), one ordinary homepage request per site.

Corrections

Correction, 22 October 2026. We first published census figures that counted some websites more than once: when a site was re-checked in our retry and rescue passes, each extra check was counted as another website. We originally said we scanned 322,710 .co.nz websites; that was 322,710 checks of 277,875 unique domains. The PHP sample of 19,644 checks becomes 19,122 unique sites when each domain is counted once, at its latest successful check, and the census share not visibly patched moves from 91.0% to 90.9%. We have also withdrawn our claim that about 73% of identifiable New Zealand websites run on PHP. The mistake was ours. The details are below.

22 October 2026: census counted some websites twice

What went wrong. Our census checked each domain once, then re-checked sites that hadn’t answered in a retry pass and a rescue pass. Our report counted every check as a separate website. Sites checked two or three times were counted two or three times, which inflated the totals. This was our error. We have recounted so that each domain appears once, using its latest successful answer by check time, or its latest failed attempt if it never answered.

Census figures as originally published and as corrected
Figure (census of 22 October, NZ time)	Originally published	Corrected
.co.nz websites scanned	322,710 “websites”	277,875 unique domains (322,710 checks)
Sites disclosing an exact PHP version	19,644	19,122 unique sites
Of those, not visibly patched	17,877 (91.0%)	17,385 (90.9%)
Visibly patched	1,767	1,737
PHP 8.1 or older (no new PHP release)	8,784 (44.7%)	8,540 (44.7%)
Responded to the request	269,260	253,113
Platform identified	114,829	113,184
“Run on PHP”	about 73% of identifiable sites	Withdrawn (see below)

Both headline shares round to 91%, so the main finding stands, but the counts behind it were too high. Interim totals shown while the scan was still running were counted the same way and are replaced too.

Withdrawn: “about 73% of identifiable New Zealand websites run on PHP”. That figure divided sites showing any sign of PHP by the sites whose platform we could name. Many sites in the first group are not in the second, so it was not a real share and should not have been presented as one. It also came from a .co.nz sample, not every New Zealand website. We have removed it. As a narrower observation: 32.7% of the 253,113 unique domains that answered showed some PHP indicator in their headers or detected technology. That is a lower bound for this sample, not an estimate of how many New Zealand sites use PHP.

The patch tracker was not affected. The hourly tracker re-checks a fixed list of 18,252 sites that showed an exact PHP version in the main census pass, counting each domain once. Its first point (22 October, 10:37 am NZDT) and the hourly upgrade counts are unchanged. Its figures are a separate, later measurement: the PHP share on the home page comes from the latest hourly check of that list, so it differs from the census’s 90.9%, which is on the Versions page (shown as 9.1% visibly patched on NZ vs AU).

Update, 23 October 2026: sources, times and a tracker note. We now link the NCSC NZ alert and the vendor notices, give the tracker baseline as 10:37 am NZDT on 22 October, and show all times, including the Australian tracker’s, in NZDT. We no longer list cPanel as a source of confirmed fixes; cPanel’s own EasyApache update is reported but not yet confirmed by cPanel. We removed a line on PHP’s share of all websites and a line on who found the flaws, because we couldn’t source them on this site. Both trackers now carry a dated note: 23 Oct, about 5 pm NZDT, a large jump, mostly on PHP 8.2 and newer. CloudLinux renumbered its PHP 8.2-8.5 builds to match php.net that day, so some of these sites may have had the fix earlier under the old number. The figures didn’t change.

Update, 23 October 2026: site layout. The site is now split into pages. The home page leads with the latest hourly tracker figure, and the New Zealand and Australian census comparison has its own page. Links to the old sections still work. The figures didn’t change.

Update, 23 October 2026: wording. We had described sites whose PHP version is below the fix as “not patched” and PHP 8.1 or older as having “no official fix”. Hosting platforms such as cPanel, Plesk and CloudLinux, and Linux distributions, commonly ship backported fixes without changing the version number, so a version number can’t show whether a site is patched. We now say “visibly patched” and “version doesn’t show the fix”. The figures didn’t change.

Update, 22 October 2026. The page now leads with a comparison of the New Zealand and Australian censuses, so the PHP shares at the top no longer come from the hourly tracker. The tracker’s figures are in its own section. (Superseded on 23 October: the home page now leads with the tracker; the comparison is on NZ vs AU.)

What we changed: the census summary, the downloadable report and chart, the page text and its search and social descriptions. The corrected census is published at census.json with its selection rule. Our explainer video and earlier social posts still show the original counts; we have marked the video on its page.