Half of New Zealand PHP servers run unsupported versions

More than half of New Zealand servers visibly running PHP are using unsupported versions that no longer receive security updates. The finding follows emergency fixes for two critical PHP flaws affecting supported releases.

Analysis by web hosting company Webscape identified 1,158 New Zealand servers visibly running PHP, with 991 disclosing a specific version. Of those, 560 were running versions that no longer receive security updates from the PHP project, leaving those systems without the latest fixes.

The data came from Shodan, which catalogues internet-facing services, and covered servers that revealed PHP through HTTP response headers, server banners or PHP session cookies. Webscape said it did not scan or probe third-party sites and relied on passive public data.

The issue came to light after the PHP project issued emergency patches for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. The flaws allow remote code execution, enabling an intruder to run commands on a server.

That access can extend beyond a single web page or application. An attacker who gains control at server level may be able to read or copy customer information, alter website content, insert malicious code into online checkouts, lock operators out of their systems, or use the machine in wider attacks.

Visible slice

The figures represent only a partial view of the New Zealand market because many websites do not reveal their software versions publicly. Sites behind content delivery networks, and those configured to suppress version details, would not appear in the count. That means the total number of unsupported installations is likely to be higher.

Even so, the visible sample offers a useful indication of the state of PHP deployments in New Zealand. Among unsupported systems, the most common abandoned versions were PHP 7.4 and PHP 5.6, while nearly 250 servers were still running PHP 5 or older. A small number were reported as responding with PHP 4, software first released before 2000.

Under the support policy described in the data, every PHP 7 release and earlier is out of security support, along with PHP 8.0 and 8.1. Supported branches currently run from PHP 8.2 through 8.5.

There is an important technical qualification to the figures. A version string exposed in a server header does not by itself prove a site is vulnerable, because some Linux distributions backport security fixes while continuing to show an older version number. But for versions that have reached end of life in the main PHP project, the emergency fixes issued for supported branches were not released for those older versions.

Upgrade backlog

The figures highlight a longstanding problem in web infrastructure: software upgrades can break websites, especially when older applications were written for earlier versions of PHP. Businesses often postpone the work if a site appears to function normally, even as its security position deteriorates over time.

That creates a widening gap between supported and unsupported systems. When a severe flaw is discovered, organisations on current versions can install a patch. Those on end-of-life releases may need a more disruptive migration or redevelopment project before they can remove the risk.

A spokesperson for Webscape said the latest data showed the scale of that exposure in New Zealand. “The two flaws patched on 21 October were serious, but at least there was a fix to install. What worries us is the hundreds of New Zealand servers where there is nothing to install, because the software stopped getting fixes years ago. Those sites are not one patch behind. They are off the end of the road,” the spokesperson said.

The spokesperson said the public figures probably understated the problem because many systems are hidden from this type of measurement. “We expect the true number to be much higher than what we can see from the outside. Even so, it tells us where we are as a country, and it is not a good place. If you run a website and cannot say which version of PHP it uses, that is the thing to find out this week,” the spokesperson said.