PHP versions · New Zealand and Australia
PHP versions, platforms and what each group means
Which PHP versions and platforms the sites showing a version run, side by side for the two censuses, and what each version group means for the fix. These are census figures; the hourly tracker is on the Tracker page.
Who shows a version
7.6% of New Zealand sites and 15.4% of Australian sites announce their exact PHP version
Most servers keep their PHP version to themselves, and that’s good practice. Everything below about versions and patching is about the sites that do show it. And a version number doesn’t show whether a host has backported the fix.
- New Zealand
- Australia (interim)
View as table
| Measure | New Zealand | Australia |
|---|---|---|
| Answered our request (of names checked) | 91.1% (253,113) | 88.4% (1,254,985) |
| Platform could be identified (of those that answered) | 44.7% (113,184) | 49.8% (624,670) |
| Showed an exact PHP version (of those that answered) | 7.6% (19,122) | 15.4% (192,892) |
Visibly patched or not
In the 22 to 23 October censuses, 90.9% in New Zealand and 95.5% in Australia didn’t show a patched version number
Two groups hide in that number. Sites on PHP 8.2 or newer get the fix through a routine update. Sites on PHP 8.1 or older get no new PHP release: 44.7% in New Zealand and 46.0% in Australia. Hosting platforms such as cPanel, Plesk and CloudLinux, and Linux distributions, commonly ship backported fixes for old PHP without changing the version number, so the first step is to ask the host. Moving to PHP 8.2 or newer is still the long-term fix.
- PHP 7.4 or older (end of life)
- 8.0 or 8.1 (end of life, no new PHP release)
- 8.2 or newer, version doesn’t show the fix
- Visibly patched
View as table
| Group | New Zealand | Australia |
|---|---|---|
| 7.4 or older (end of life, no new PHP release) | 33.6% (6,425) | 36.6% (70,646) |
| 8.0 or 8.1 (end of life, no new PHP release) | 11.1% (2,115) | 9.4% (18,141) |
| 8.2 or newer (version doesn’t show the fix) | 46.3% (8,845) | 49.5% (95,390) |
| Visibly patched (8.5.12, 8.4.27, 8.3.36, 8.2.35 or later) | 9.1% (1,737) | 4.5% (8,715) |
Top versions
The same old releases lead in both countries
PHP 7.4.33, the last 7.4 release from 2022, is near the top on both sides of the Tasman. The supported releases just before the fix, 8.2.34 and 8.3.35, are common too: those sites are one routine update away. Linux distribution builds of 8.2 and 8.3 may already carry the fix under the old number.
- 7.4 or older (end of life)
- 8.0/8.1 (end of life, no new PHP release)
- Version doesn’t show the fix
- Visibly patched
New Zealand
Australia (interim)
View as tables
| Version | Status | Sites | % showing a version |
|---|---|---|---|
| 7.4.33 | End of life | 3,433 | 18.0% |
| 8.3.35 | Version doesn’t show the fix | 2,243 | 11.7% |
| 8.2.34 | Version doesn’t show the fix | 2,122 | 11.1% |
| 8.2.33 | Version doesn’t show the fix | 1,618 | 8.5% |
| 8.1.34 | 8.0/8.1, end of life | 1,502 | 7.9% |
| 8.4.26 | Version doesn’t show the fix | 1,004 | 5.3% |
| 5.6.40 | End of life | 824 | 4.3% |
| 8.3.36 | Visibly patched | 777 | 4.1% |
| Version | Status | Sites | % showing a version |
|---|---|---|---|
| 8.2.34 | Version doesn’t show the fix | 42,285 | 21.9% |
| 7.4.33 | End of life | 40,410 | 20.9% |
| 8.3.35 | Version doesn’t show the fix | 28,126 | 14.6% |
| 8.4.26 | Version doesn’t show the fix | 14,155 | 7.3% |
| 8.1.34 | 8.0/8.1, end of life | 12,202 | 6.3% |
| 5.6.40 | End of life | 8,439 | 4.4% |
| 7.2.34 | End of life | 7,132 | 3.7% |
| 8.5.11 | Version doesn’t show the fix | 7,107 | 3.7% |
Platforms
WordPress leads in both: 47.8% of identifiable New Zealand sites, 56.8% in Australia
Self-hosted software such as WordPress runs on PHP that the owner or their host has to update. Hosted builders such as Squarespace, Wix and Shopify run their own servers and patch them centrally.
Of WordPress sites showing a PHP version, 10.3% in New Zealand (1,201 of 11,636) and 4.9% in Australia (6,475 of 132,432) were visibly patched.
- New Zealand
- Australia (interim)
View as table
| Platform | New Zealand | Australia |
|---|---|---|
| WordPress | 47.8% (54,133) | 56.8% (355,074) |
| Squarespace | 15.8% (17,885) | 12.8% (79,926) |
| Wix | 15.8% (17,868) | 14.5% (90,415) |
| Shopify | 14.2% (16,100) | 10.7% (66,968) |
| Weebly | 2.1% (2,338) | 1.8% (11,255) |
| Webflow | 1.2% (1,346) | 0.7% (4,323) |
| WooCommerce | 0.9% (1,018) | 0.9% (5,844) |
What this means
Two groups: sites whose version doesn’t show the fix, and sites on old PHP
The PHP project supports each version for a fixed period. After that it stops publishing security releases. On 21 October 2026 it released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
46.3% NZ · 49.5% AU
Version doesn’t show the fix. On PHP 8.2 or newer but below the fixed release, as a share of sites showing a version. Either the host hasn’t installed the update yet, or it has backported the fix and kept the old number. The update is routine, so ask the host which it is.
44.7% NZ · 46.0% AU
PHP 8.1 or older. All end of life, so there is no new PHP release with the fix. That includes 33.6% (NZ) and 36.6% (AU) on PHP 7.4 or older. Hosting platforms such as cPanel, Plesk and CloudLinux, and Linux distributions, commonly ship backported fixes without changing the version number, so some of these sites may already be fixed. Only the host can say. The long-term fix is to move to PHP 8.2 or newer, which can also mean updating the website software.
- PHP 7.4, 8.0 and 8.1 get no new release from the PHP project. Hosts that backport fixes can still patch them without changing the number. Ask your host whether the fix is installed.
- PHP 7.3 and older get no patch from the PHP project. Some hosting vendors still patch very old PHP, so ask your host. These versions have also missed years of other security fixes.
- Supported versions are only fixed once the host installs the new release (or its backport) and restarts the web server.