PHP2Shell flaw puts New Zealand websites at risk as the NCSC urges immediate patching and a scan finds most still unpatched

New Zealand’s National Cyber Security Centre is telling every organisation that runs a website to patch it now, after the PHP project released emergency fixes on Thursday morning for two flaws that let an attacker take over a web server without logging in. A scan of New Zealand websites on the same day found that most of those showing a PHP version had not yet installed the fix, and a third were running versions so old that no official fix exists.

PHP is the programming language behind WordPress, Drupal, Joomla and Magento, and so behind a large share of New Zealand business, council and government websites. Security researchers have given the two flaws the nickname PHP2Shell. The PHP project’s security advisory, published on 21 October, says the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and that “All PHP users are strongly encouraged to update immediately.” The advisory says every PHP installation serving web requests is at risk, and adds that “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”

The NCSC’s statement on 22 October puts the stakes in plain terms. “This vulnerability could be used by an attacker to take full control of a website, web server or web service; this could include defacing or taking down websites.” It says the patch was released at 3am New Zealand daylight time and that “The NCSC recommends that organisations patch immediately.” Organisations that cannot patch straight away should consider disabling public-facing web services, the agency says. Its separate vulnerability alert, updated at 10.20am on Thursday, says “The NCSC is aware of reports of active exploitation.” The alert also warns that firewalls, edge devices and other embedded products that bundle PHP may need their own separate updates from the vendor.

Global exploitation and emergency responses

The flaws were found with help from artificial intelligence. Cloud security company Wiz says in its research write-up that its team discovered the first vulnerability on 19 August and reported both to the PHP security team on 24 August, and that “We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research.” Cloudflare, the web security and content delivery company, says in its own post that Calif.io, Wiz, OpenAI and Quarkslab disclosed the vulnerabilities together, that they affect all web servers running PHP 5.4 or later, and that details leaked before the official release. “Cloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers,” the company says.

The scale of the attack traffic grew fast. Cloudflare chief executive Matthew Prince said in a post on X, quoted by Reuters, “In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” and “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now.” Reuters reports that Japanese companies including the brokerage Nomura, the airline ANA and East Japan Railway suspended some internet services on Thursday as a precaution, that Finland’s state IT provider had shut down government public web services the day before, and that the Dutch cyber security agency took its own site offline. Microsoft chief executive Satya Nadella told an event in Germany, “I’ve not seen anything like this in a long, long time.”

New Zealand website scans reveal wide exposure

In New Zealand the picture is quieter but not comfortable. The NCSC would not name sites, but a spokesperson told the New Zealand Herald that some websites will have been taken down to apply patches and mitigations, and that it was too early to tell the full impact. The Herald reported that major government websites remained up. The same report quoted tech consultant Adam Holt, who used AI agents to check every .nz website and found at midday on Thursday that 90 per cent had not applied the patch.

Holt’s tracker at TheColab.ai gives the detail. It checked 277,875 .co.nz domains between 8.53am and 12.45pm on Thursday with one ordinary homepage request each. Of the 19,122 sites that openly reported an exact PHP version, 9.1 per cent were on a patched release. Some 44.7 per cent were on PHP 8.1 or older, for which the PHP project ships no official release, and 33.6 per cent were on PHP 7.4 or older, which the PHP project no longer supports. WordPress made up 47.8 per cent of the sites where a platform could be identified. Hourly re-checks of the same sites since then show the patched share rising, and it stood at 15.8 per cent at the 9.21am check on Friday.

Those numbers come with a caveat the tracker itself leads with. Most sites do not reveal their PHP version at all, and many shared hosts apply a back-ported fix without changing the version number the server reports. “So this is the share we can see is patched, not a count of who is exposed,” the page says. In other words the figures show how many sites can be seen to be fixed, not how many are still vulnerable.

Expert advice and recommendations for site owners

Experts gathered by the Science Media Centre on Thursday were united on the advice. Dr Vimal Kumar, a senior lecturer in computer science at the University of Waikato, said “The good news is that the bug fixes are out, so the best advice would be to patch your systems as quickly as possible and take your website down if you can until that happens.” Dr Shawn Rasheed, a senior research software engineer at Victoria University of Wellington, said the flaws carry a severity score of 9.2 out of 10, and warned that “Applying a fix does not undo damage or remove access an attacker may have already established.” For the many New Zealand businesses that do not run their own servers, his advice was direct. “Small businesses and anyone who owns a website should contact their hosting provider or website administrator to confirm whether their services are affected and whether the necessary updates have been applied.”

Dr Farkhondeh Hassandoust, a senior lecturer in information systems at the University of Auckland Business School, said people should not read too much into a site that is down. “A website going offline does not necessarily mean it has been hacked. In some cases, temporarily shutting down a service is a sensible precaution while security teams apply the required fixes.” She also pointed to the AI angle that has made this episode different from earlier PHP scares. “The same tools that help security researchers discover hidden flaws can also help attackers exploit them.” Professor Dave Parry of Murdoch University, who spent most of his career in New Zealand, said PHP is old enough in internet terms to turn up in unexpected places, and “Site owners might not even know they are using it.”

For WordPress site owners, which means a large share of New Zealand small business sites, the fix is not a WordPress update. The WordPress project’s notice says “These vulnerabilities are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned for these issues.” It says site owners can see which PHP version their site runs under Tools, Site Health, Info and then Server in the WordPress dashboard, and that versions of PHP before 8.2 no longer receive security updates from the PHP project. The PHP advisory says the security team has published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source or have no long-term-support vendor, and that Linux distributions received the patches in advance.

The practical checklist for a New Zealand business is short. Ask your host, in writing, whether the PHP build serving your site has been patched against CVE-2026-109618 and CVE-2026-109619 and whether the fix is actually running. If you run your own server, update to one of the four fixed releases and restart PHP. If you are on PHP 8.1 or older, the NCSC’s advice is to consider taking the site offline until it can be moved to a supported version. And because a patch does not undo a break-in that has already happened, check logs and files for anything unusual from the past week.