More Than Half of New Zealand's Visible PHP Servers Run Unsupported Software

In October 2026 the PHP project released emergency fixes for two critical security flaws, CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 out of 10. Both let an attacker run their own code on the server. Both are in the core of PHP, so they reach any website built on it. We wanted to know one simple thing: how many New Zealand websites could actually apply the fix?

So we checked. Using Shodan, a search engine that catalogues what is exposed on the internet, we looked at every New Zealand server that reveals it is running PHP. More than half of them run a version that stopped receiving security fixes years ago. For those sites, this week's fixes do not exist, and never will.

What we found

We identified 1,158 New Zealand servers visibly running PHP. Of the 991 that disclose a specific version:

• 560 of them, more than half, run a version of PHP that no longer receives security updates.
• Nearly 250 are on PHP 5 or older, and a handful still answer on PHP 4, software first released last century.
• The most common abandoned versions are PHP 7.4 and PHP 5.6.

The real number is much higher

These figures count only the servers whose software is visible from the outside. Any site behind a content delivery network such as Cloudflare hides its version, and many sites strip it on purpose. Our own servers do not show up in this count for that reason. What the data gives is a visible slice, not the full picture, so the true number of New Zealand sites on unsupported PHP is larger than this. Even as a slice, it is a clear read on where the country sits, and the read is not good.

What an attacker can do with this

Remote code execution is close to the worst case for a website. An attacker is no longer stuck at the front door of the site. They can run programs on the server itself.

In practice that means stealing whatever the site holds, which for most businesses includes customer names, email addresses and order history, and sometimes payment details. It can mean slipping a card skimmer into a checkout so every sale is quietly copied to the attacker. It can mean defacing the site, locking you out and demanding a ransom, or using your server to attack other people. Because the access is at the level of the server rather than the page, the owner often finds out only when a customer or a bank tells them.

A supported version of PHP with the latest patch closes the door the attacker needs. An end-of-life version leaves it open with no lock to fit, because the people who make PHP no longer ship one for that release.

Why so many sites are stuck

Upgrading PHP can break a website. Code written for PHP 5 often will not run on PHP 8 without changes, so the upgrade gets put off, and then put off again. The site keeps loading, nothing looks wrong, and the work never reaches the top of anyone's list. The gap widens quietly in the background until something finds it, and the flaws patched in October are exactly the kind of thing that does.

What to check this week

• Find out which PHP version your site runs. In WordPress, go to Tools, then Site Health, then Info, and open the Server section.
• If it is PHP 8.1 or older, ask your host or developer to move it to PHP 8.3 or 8.4, then test the site, because old plugins and themes sometimes break on a newer version.
• Ask your host whether they have installed the October 2026 PHP fixes. A good host will already have an answer.
• Keep a recent backup somewhere other than your hosting account.

If you are not sure who hosts your site, or the answers come back vague, we can look for you. Our free website audit checks for out-of-date software, and our hosting and maintenance plans keep PHP current as a matter of course.

Where we stand

Every site we host runs a supported version of PHP, and when the October fixes were published our servers were updated within minutes. Keeping PHP current is unglamorous work, and it is most of what good hosting is.

Want to know which PHP version your site runs, and whether it is safe? Get in touch and we will check it for you.