PHP security · New Zealand vs Australia
On 21 October 2026 the PHP project disclosed and fixed two serious flaws (rated critical by the PHP project), nicknamed “PHP2Shell”, that can let someone take over a web server without a password. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We gave .co.nz and .com.au websites the same check: one ordinary homepage request each, reading what the server says about itself.
Read this before the number. “Visibly patched” means the server reports a PHP version that includes the 21 October fix. The other sites show a version number that doesn’t include it. That isn’t proof they are unpatched: hosting platforms such as cPanel, Plesk and CloudLinux, and Linux distributions, commonly ship backported fixes without changing the version number. So the true unpatched share is likely lower than the rest of the bar, and it can’t be measured from outside. How to read these numbers →
Side by side · visibly patched
Australia Census completeCensus complete
4.5%
visibly patched, interim
of 192,892 sites showing a PHP version, from 1,420,115 .com.au names checked so far
100.0% of an estimated 1.44 million live .com.au names checked
Scan finished 23 Oct, 1:57 am NZDT.
Checked 22 Oct, 5:10 pm to 23 Oct, 3:53 am NZDT (updates hourly)
New Zealand Census complete
9.1%
visibly patched
of 19,122 sites showing a PHP version, from 277,875 .co.nz domains checked
Checked 22 Oct, 8:53 am to 22 Oct, 12:45 pm NZDT
We have re-checked these New Zealand sites every hour since. That tracker is on its own page and isn’t compared with Australia.
Read the comparison with care. Australia’s check started about 4½ hours after New Zealand’s finished, so its hosts had more time to install the fix. While the scan runs, names are checked in roughly alphabetical order, so interim figures aren’t a random sample of Australian sites and can shift. Both shares count only sites that show an exact PHP version, and a version number isn’t proof either way: many hosts patch without changing it. This isn’t a measure of which country is more secure.
Dots are illustrative: their positions are made up, their colours follow each country’s real shares. Agents sweep the map to show what automated checking looks like.
Census · New Zealand and Australia
Every figure is a share of a stated group of sites, so the two countries can be read side by side even though Australia has more websites. Australia’s column is interim while its scan runs: names are checked in roughly alphabetical order, so interim figures aren’t a random sample of Australian sites and can shift.
| Measure | New ZealandNZ | AustraliaAU (interim) |
|---|---|---|
| Domains checked | 277,875 | 1,420,115 so far |
| Answered our request % of domains checked | 91.1% | 88.4% |
| Showed an exact PHP version % of those that answered | 7.6% | 15.4% |
| Visibly patched % of those showing a version | 9.1% | 4.5% |
| PHP 8.1 or older, all end of life % of those showing a version · there’s no new PHP release; the host may have backported the fix | 44.7% | 46.0% |
| PHP 7.4 or older % of those showing a version · end of life since 2022 or earlier | 33.6% | 36.6% |
| WordPress % of sites with an identified platform | 47.8% | 56.8% |
| WordPress sites visibly patched % of WordPress sites showing a version | 10.3% | 4.9% |
| Behind Cloudflare % of those that answered | 32.0% | 27.5% |
New Zealand census: 19,122 sites showing a version, checked 22 Oct, 8:53 am to 22 Oct, 12:45 pm NZDT. Australia: 192,892 sites showing a version, checked 22 Oct, 5:10 pm to 23 Oct, 3:53 am NZDT, figures as of 23 Oct, 4:45 am and updated hourly while the scan runs.
We revisit the 192,892 .com.au websites that showed an exact PHP version in the Australian census, with one ordinary homepage request each and the same software and settings as the census. Each full pass of that list is timed, and a new pass starts every hour. The total of sites seen upgrading only rises: each site counts once, the first pass that sees it on a fixed release after it showed an older version in the census. The share on a fixed release at each pass is a separate chart and can go down as well as up.
This tracker follows Australian sites only, after the Australian census. It is a later, separate measurement: it isn’t compared with the census figures above or with the New Zealand tracker.
24,107
Australian sites observed moving to a fixed release since the Australian census
13.1% of the 184,177 tracked sites that showed a version below the fix in the census. Latest pass 23 Oct, 6:11 pm NZDT: 6,682 new.
Re-checked every hour.
Total Australian sites observed upgrading
–
| Pass (NZDT) | Took | Answered | Showing a PHP version | On a fixed release | New upgrades seen | Total observed upgrading |
|---|
23 Oct, about 5 pm NZDT: a large jump, mostly on PHP 8.2 and newer. CloudLinux renumbered its PHP 8.2-8.5 builds to match php.net that day, so some of these sites may have had the fix earlier under the old number.
The first point is the Australian census of these sites (finished 23 Oct, 3:53 am NZDT); each later point is one full re-check pass of the same list, placed at the time it finished. The upper chart counts distinct sites seen on a fixed release (8.5.12, 8.4.27, 8.3.36, 8.2.35 or later) after showing an older version in the census. It only rises: a site that later hides its version, stops answering or shows an older release stays counted, so it is not the number on a fixed release right now.
That is the lower chart, the share of sites that answered and showed a PHP version that were on a fixed release at that pass. It can fall, because sites drop in and out of what we can see, and we show it as measured. A pass where fewer than 70% of sites answered is not published. These are upgrades we observed, not proof a site is secure. Servers patched by their Linux distribution or by hosting platforms such as cPanel, Plesk and CloudLinux may still report an older number.
