Live · , data updated 23 October 2026, 6:21 pm NZDT

Live patch tracker · New Zealand

Are sites patching? We keep checking

After the census we kept re-checking the New Zealand sites that showed an exact PHP version in the census’s main pass (by 10:37 am on 22 October), with one ordinary homepage request each, and we count how many we see move to a release with the fix. The list is re-checked every hour. Australia has a separate tracker on a list about ten times longer, on the NZ vs AU page. The two trackers started at different times on different lists, so we never compare them.

New Zealand: we check every hour

Every hour we revisit the 18,252 websites that showed an exact PHP version in the census’s main pass, which finished at 10:37 am NZDT on 22 October. That moment is the tracker baseline. The full census, with its retry passes, found 19,122 sites showing a version; the sites first seen in those retries aren’t on the tracking list. We revisit each one with one ordinary homepage request and count how many we have seen move to a release with the fix. That total only rises: each site counts once, the first time we see it upgraded. What each check sees right now is a separate measure, further down, and it can go down as well as up.

This tracker follows New Zealand sites only, after the census. Its figures are a later, separate measurement and aren’t compared with Australia’s census figures or with the Australian tracker.

–

View as table
New upgrades seen at each re-check
Checked (NZDT)Window startsWindowNew upgrades seenCheck statusTotal observed upgrading

23 Oct, about 5 pm NZDT: a large jump, mostly on PHP 8.2 and newer. CloudLinux renumbered its PHP 8.2-8.5 builds to match php.net that day, so some of these sites may have had the fix earlier under the old number.

The upper chart is the number of distinct tracked sites we have seen move from an older version to a fixed release since the tracker baseline. It only rises because each site is counted once, at the first check that sees it upgraded. A site that later hides its version, stops answering or shows an older release again stays counted as an observed upgrade, so this total is not the number of sites on a fixed release right now; that is the separate chart below.

Each bar in the lower chart is one re-check, placed at the time it ran. It counts tracked sites seen on a fixed release (8.5.12, 8.4.27, 8.3.36, 8.2.35 or later) for the first time, after showing an older version at the tracker baseline. The upgrade happened some time in the window since the previous check, not necessarily at that hour, and a site that didn’t answer the previous check may have upgraded earlier than that. The census’s main pass took hours and the first window starts when it finished, so a site checked early in that pass may have upgraded before the first window and is then counted in the first bar. Re-checks ran every one to two hours until the afternoon of 22 October and every hour since, so early windows are longer; the table gives each window’s exact length.

A check whose site results didn’t arrive is shown as a gap and is never counted as zero; a zero appears only when every result of a check arrived. Each site counts once. Sites that were already fixed, hide their version or aren’t on the list are never counted. These are upgrades we observed, not proof a site is secure, and not something this page caused. Servers patched by their Linux distribution or by hosting platforms such as cPanel, Plesk and CloudLinux may still report an older number.

Detail: the share at each check

This is a different measure from the total above: the share of tracked sites that answered, showed a PHP version, and showed a fixed release at that check. It can go down as well as up, because sites that were on a fixed release drop out of it when they don’t answer, stop showing a version or show an older release. For example, between the 3:21 pm and 4:21 pm checks on 22 October it dipped from 13.7% to 13.4%: 49 sites newly showed a fixed release, while 90 that had shown one didn’t answer (most on LiteSpeed or Cloudflare-fronted hosting), 16 stopped showing a version and 2 showed an older release. The hover details give the number of sites showing a version at each check.

20.5%

visibly patched · latest check 23 Oct, 6:21 pm

Share of tracked sites visibly patched

Tracker baseline 22 October 2026, 10:37 am NZDT. First update in about an hour.

View as table
Share of tracked sites visibly patched at each check
Checked (NZDT)Visibly patchedVersion doesn’t show the fixShowing a PHP version
23 Oct, 6:21 pm20.5%14,00817,611
23 Oct, 5:21 pm19.7%14,12117,581
23 Oct, 4:21 pm17.3%14,62517,692
23 Oct, 3:21 pm16.4%14,78817,697
23 Oct, 2:21 pm16.2%14,80917,668
23 Oct, 1:21 pm16.2%14,82817,698
23 Oct, 12:21 pm16.0%14,89117,718
23 Oct, 11:21 am15.9%14,89117,709
23 Oct, 10:21 am15.8%14,85517,645
23 Oct, 9:21 am15.8%14,90017,700
23 Oct, 8:21 am15.8%14,93317,726
23 Oct, 7:21 am15.8%14,86917,667
23 Oct, 6:21 am15.8%14,89517,680
23 Oct, 5:21 am15.7%14,88917,657
23 Oct, 4:22 am15.7%14,70117,440
23 Oct, 3:22 am15.7%14,78017,535
23 Oct, 2:22 am15.7%14,75717,505
23 Oct, 1:21 am15.6%14,90017,645
23 Oct, 12:21 am15.4%14,97717,707
22 Oct, 11:21 pm15.3%15,00017,710
22 Oct, 10:21 pm15.1%15,04517,714
22 Oct, 9:21 pm14.8%15,13017,762
22 Oct, 8:21 pm14.7%15,15617,759
22 Oct, 7:21 pm14.4%15,23917,802
22 Oct, 6:21 pm14.3%15,22617,774
22 Oct, 5:21 pm14.1%15,26217,770
22 Oct, 4:21 pm13.4%15,40017,789
22 Oct, 3:21 pm13.7%15,42617,874
22 Oct, 1:21 pm11.5%15,87017,928
22 Oct, 11:56 am9.9%16,27818,060
22 Oct, 10:37 am (tracker baseline)8.7%16,65818,252
The first point is the tracker baseline (10:37 am NZDT, 22 October, the end of the census’s main pass); each later point is a fresh re-check of the same list. A site counts only if it answered and still showed an exact PHP version that time, so the number checked moves a little between points, and some of the change can come from that mix rather than from patching. Visibly patched means PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. Servers patched by their Linux distribution or by hosting platforms such as cPanel, Plesk and CloudLinux may still report an older number.

Upgrades seen since the tracker baseline

2,131

of the 16,658 tracked sites that showed a version below the fix, seen on a fixed release since the tracker baseline (22 Oct, 10:37 am NZDT) · last check 23 Oct, 6:21 pm

Of those, 4 later showed an older version again and 16 hid the version at the last check. They still count once, as an upgrade we saw.

23 Oct, about 5 pm NZDT: a large jump, mostly on PHP 8.2 and newer. CloudLinux renumbered its PHP 8.2-8.5 builds to match php.net that day, so some of these sites may have had the fix earlier under the old number.

We count a website once, the first time an hourly re-check sees it on a fixed release (8.5.12, 8.4.27, 8.3.36, 8.2.35 or later) after it showed an older version at the tracker baseline. Sites that hide their version or don’t answer are never counted as upgraded. This is what we observed, not a claim that this page caused it, and a version number can’t prove a site is secure.

Notify me when a change is observed

For one website on our tracking list: an email when an hourly re-check sees its PHP status change, for example from “version doesn’t show the fix” to a fixed release.

Not sending email yet. We’re saving requests now. Nothing is sent, including the confirmation email, until delivery is switched on, and alerts start only after you confirm.

Only websites already on our list of 18,252 re-checked sites can get alerts. We don’t start checking new websites. A change is only noticed when a re-check runs, about every hour, and when the site answers and shows its PHP version. If it hides the version or doesn’t answer, we can’t tell you anything. Signing up for incident updates doesn’t sign you up for this. Privacy note