NCSC says patch PHP now; consultant's scan finds most .nz sites that show their PHP version still exposed

The National Cyber Security Centre has told New Zealand organisations to patch a critical flaw in PHP immediately. Organisations that can't patch should consider switching off their public-facing web services. By 4pm, most .nz websites that show which version of PHP they run still hadn't applied the fix, according to one consultant's scan.

PHP is the programming language behind a large share of the web. The NCSC said New Zealand organisations use it in "a significant number of websites and web services". It said an attacker could use the vulnerability to take full control of a website, web server or web service. That could include defacing a site or taking it down.

The PHP Foundation released its patch at 3am NZDT on 22 October. The NCSC had already warned its cyber security customers and trust groups the day before. It told them to watch PHP's website and apply updates as a priority. On 23 October it published a second notice, urging small businesses to act now to find out whether their websites or online services could be affected.

The patch was slow to spread. Tech consultant Adam Holt told the Herald he used AI agents to scan every website with a .nz address, and at midday 90% had not applied it. By 4pm, he said, 86% of the sites that display their PHP version were still unpatched. A third were "running PHP so outdated there was no official fix for it". Holt has put a live tracker online. These are his figures, not the NCSC's. The 4pm figure only covers sites that show which version of PHP they run, so it isn't measured on the same base as the midday one.

The outdated sites are the harder problem. The NCSC said the patch only protects systems running versions of PHP that are still supported. Older "end-of-life" versions stay vulnerable unless technical teams build their own fix from PHP's source code or get one from an enterprise operating system vendor. For most businesses, that means calling a developer or hosting provider.

Patching won't fix a system that has already been broken into, the NCSC said. Software and web service providers may also need to release further updates.

For a New Zealand business, the first step is finding out whether its site uses PHP at all. Many small firms don't run their own servers. An agency built the site, or a provider hosts it, and the owner may not know what language it's written in. The NCSC's advice covers this: check with third-party suppliers whether they use PHP. If a site can't be patched straight away, the NCSC suggests taking public-facing services offline, so customers may find some sites unavailable for a while.

Some organisations have already done that. The Herald asked whether any New Zealand government sites had been taken offline. An NCSC spokesperson replied: "NCSC is aware that some websites will have been taken down to apply patching and mitigation strategies." According to the Herald, the spokesperson would not name the sites, because doing so "could make those or other sites targets of malicious activity." Major New Zealand government websites were up and running, the paper reported.

Elsewhere, several government websites in France, Denmark and the Netherlands were taken offline as a precaution, according to an AFP report cited by the Herald.

The Herald said there had been no reports, in New Zealand or anywhere else, of sites being compromised through the flaw. The NCSC isn't ready to call it contained. "At this point, it is too early to tell the full impacts of these vulnerabilities," its spokesperson told the Herald.