PHP security · Australia
84% of Australian websites that show their PHP version haven’t updated to a patched release for this week’s critical PHP flaw, and a quarter are running PHP so outdated there’s no official fix for it
Placeholder data, Australian figures coming soonIn the week of 20 October 2026 the PHP project disclosed two critical vulnerabilities, nicknamed “PHP2Shell”, that can let someone take over a web server without a password. Fixed releases came out on 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Scale. 83.9% are still running a PHP version released before this week’s fix. Sites on a supported version (PHP 8.2 or newer) can fix that with a routine update.
Severity. 42.2% run PHP 8.1 or older, which won’t get the fix through normal updates, including 29.9% on end-of-life PHP 7.4 or older. Those sites need a major upgrade.
- Last updated
- PHP figures
- From the latest re-check of the 65,177 sites that showed an exact PHP version in our first scan. See the trend
- Sample
- n = 63,456 sites disclosing an exact PHP version at this check. The 21 October census checked 1,028,138 unique Australian (.au) domains.
- Patched release
- PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later) at the time of our check. Definitions
Explore this with AI
- Open in ChatGPT (opens in a new tab)
- Open in Claude (opens in a new tab)
- Open in Copilot (opens in a new tab)
- Open in Perplexity (opens in a new tab)
Opens an AI chat with a prompt about this page, including the latest figures.
Automated sweep · illustration
AI helped find the flaws. AI can find who’s exposed. The clock is ticking to patch.
- 42.2%no official fix (PHP 8.1 or older)
- 41.7%fix available, not yet applied
- 16.1%on a patched release
Each dot stands for about 57 of the 63,456 sites that show their PHP version. Dot positions are illustrative; the colours follow the scan’s shares.
Placeholder data, Australian figures coming soonNot yet on a patched release
83.9%
53,248 of 63,456 disclosing sites
On a patched release
16.1%
10,208 of disclosing sites
No official fix (8.1 or older)
42.2%
26,756 of disclosing sites
End-of-life (7.4 and older)
29.9%
18,945 of disclosing sites
Watch
Watch: what happened, in about a minute
A plain-English explainer on this week’s critical PHP flaw and what Australian site owners should do.
Australian explainer video coming soon.
Check a site
Is your site affected?
Enter a website address. We make one ordinary request to its homepage, the same as a visitor would, and read what the server says about itself.
Live · Patch tracker
Are Australian sites patching? We check every hour
Every hour we revisit the 65,177 Australian websites that showed an exact PHP version in our first scan, with one ordinary homepage request each, and count how many we have seen move to a release with the fix. That total only rises: each site counts once, the first time we see it upgraded. What each check sees right now is a separate measure, further down, and it can go down as well as up.
3,867
sites seen moving to a fixed release since tracking began
Last check 22 October 2026, 3:21 pm AEDT
Placeholder data, Australian figures coming soonTotal sites observed upgrading
New upgrades seen at each re-check
View as table
View as table
| Check (AEDT) | Window starts | Window (min) | New upgrades seen | Check status | Total observed upgrading |
|---|---|---|---|---|---|
| 3:21 pm, 22 October 2026 | 2:21 pm, 22 October 2026 | 60 | 139 | Complete | 3,867 |
| 2:21 pm, 22 October 2026 | 1:21 pm, 22 October 2026 | 60 | 134 | Complete | 3,728 |
| 1:21 pm, 22 October 2026 | 11:21 am, 22 October 2026 | 120 | 1,508 | Complete | 3,594 |
| 11:21 am, 22 October 2026 | 9:56 am, 22 October 2026 | 85 | 1,258 | Complete | 2,086 |
| 9:56 am, 22 October 2026 | 8:37 am, 22 October 2026 | 79 | 828 | Complete | 828 |
16.1%
on a patched release at the latest check · latest check 22 October 2026, 3:21 pm AEDT
Placeholder data, Australian figures coming soonShare on a patched PHP release at each check (can go down)
View as table
View as table
| Checked (AEDT) | Patched % | Not yet patched | Showing a PHP version |
|---|---|---|---|
| 3:21 pm, 22 October 2026 | 16.1% | 53,240 | 63,456 |
| 2:21 pm, 22 October 2026 | 15.3% | 53,805 | 63,524 |
| 1:21 pm, 22 October 2026 | 15.6% | 53,870 | 63,827 |
| 11:21 am, 22 October 2026 | 13.1% | 55,633 | 64,020 |
| 9:56 am, 22 October 2026 | 11.3% | 57,204 | 64,492 |
| 8:37 am, 22 October 2026 (first scan) | 9.9% | 58,724 | 65,177 |
Upgrades seen since tracking began
3,867
Placeholder data, Australian figures coming soon3,856 still on a fixed release, 13 later showed an older version, 18 hid their version at the last check.
We count a website once, the first time an hourly re-check sees it on a fixed release (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later) after it showed an older version on our tracking list. Sites that hide their version or don’t answer are never counted as upgraded. This is what we observed, not a claim that this page caused it, and a version number can’t prove a site is secure.
01 · The exposure
42.2% of disclosing sites sit outside PHP’s support window
Every site that disclosed a PHP version, grouped by whether the PHP project still ships security releases for it.
- End-of-lifePHP 7.4 and older29.9%18,945
- Out of supportPHP 8.0 and 8.112.3%7,811
- SupportedPHP 8.2 and newer57.8%36,700
View as table
| Status | Sites | % of disclosing |
|---|---|---|
| End-of-life (PHP 7.4 and older) | 18,945 | 29.9% |
| Out of support (PHP 8.0 and 8.1) | 7,811 | 12.3% |
| Supported (PHP 8.2 and newer) | 36,700 | 57.8% |
02 · Version by version
PHP 7.4 alone accounts for 15.5% of disclosing sites
PHP 7.4 reached end-of-life in November 2022. Supported releases 8.2 and 8.3 are the most common, but a supported version is not the same as a patched one: only the newest point releases contain the fix.
- End-of-life
- Out of support
- Supported
629 of the 2,331 sites on PHP 8.5 show 8.5.12, the newest release and the first 8.5 build with the fix. The fix also shipped in 8.4.27, 8.3.36 and 8.2.35; this scan does not yet break those out.
View as table
| PHP version | Status | Sites | % of disclosing |
|---|---|---|---|
| PHP 4.4 | End-of-life | 15 | 0.0% |
| PHP 5.1 | End-of-life | 4 | 0.0% |
| PHP 5.2 | End-of-life | 311 | 0.5% |
| PHP 5.3 | End-of-life | 739 | 1.2% |
| PHP 5.4 | End-of-life | 738 | 1.2% |
| PHP 5.5 | End-of-life | 416 | 0.7% |
| PHP 5.6 | End-of-life | 2,577 | 4.1% |
| PHP 7.0 | End-of-life | 639 | 1.0% |
| PHP 7.1 | End-of-life | 633 | 1.0% |
| PHP 7.2 | End-of-life | 1,332 | 2.1% |
| PHP 7.3 | End-of-life | 1,723 | 2.7% |
| PHP 7.4 | End-of-life | 9,818 | 15.5% |
| PHP 8.0 | Out of support | 1,639 | 2.6% |
| PHP 8.1 | Out of support | 6,172 | 9.7% |
| PHP 8.2 | Supported | 13,498 | 21.3% |
| PHP 8.3 | Supported | 14,114 | 22.2% |
| PHP 8.4 | Supported | 6,757 | 10.6% |
| PHP 8.5 | Supported | 2,331 | 3.7% |
03 · What Australia builds on
39.5% of identifiable sites run WordPress
Of the 481,598 sites where a platform could be identified, 33.5% use self-hosted PHP software such as WordPress, Joomla, Drupal or Magento. For those sites the owner or their hosting company chooses and updates the PHP version. Hosted builders such as Squarespace, Wix and Shopify run their own servers and patch them centrally.
- Self-hosted PHP software
- Hosted platform, vendor-managed
View as table
| Platform | Type | Sites | % of identified |
|---|---|---|---|
| WordPress | Self-hosted PHP | 150,219 | 39.5% |
| Squarespace | Hosted platform | 76,101 | 11.0% |
| Wix | Hosted platform | 66,112 | 16.5% |
| Shopify | Hosted platform | 50,635 | 13.0% |
| Weebly | Hosted platform | 10,813 | 1.6% |
| Webflow | Hosted platform | 5,478 | 0.8% |
| Joomla | Self-hosted PHP | 3,947 | 1.0% |
| Drupal | Self-hosted PHP | 3,916 | 0.6% |
| WooCommerce | Self-hosted PHP | 3,013 | 0.8% |
| BigCommerce | Hosted platform | 1,383 | 0.3% |
| Magento | Self-hosted PHP | 440 | 0.1% |
| Duda | Hosted platform | 8 | 0.0% |
04 · What this means
Two problems: sites that haven’t updated yet, and sites that can’t
The PHP project supports each version for a fixed period. After that it stops publishing security releases. On 21 October 2026 it released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
83.9%
Not yet patched (scale)
Still running a PHP version released before this week’s fix. For sites on PHP 8.2 or newer this is a routine update their host can install; many will catch up over the coming days.
42.2%
No official fix (severity)
Running PHP 8.1 or older, which won’t get the fix through normal updates. That includes 29.9% on end-of-life PHP 7.4 or older. These sites need a major PHP upgrade, which can mean updating the website software too.
- PHP 7.4, 8.0 and 8.1 get no official fixed release. The PHP security team published minimal source-code patches for 7.4 to 8.1, but a host has to build and install those themselves.
- PHP 7.3 and older get no fix of any kind from the PHP project.
- Supported versions are only safe once the host installs the new release and restarts the web server.
If you run a website
Ask your web developer or hosting company which PHP version your site uses and whether this week’s fix is installed. If the site runs PHP 8.1 or older, plan an upgrade to a supported version. Many hosts let you change the PHP version in their control panel, but test the site afterwards, because old themes and plugins can break. ASD’s Essential Eight sets a benchmark here: patch internet-facing services within 48 hours when a flaw is rated critical or a working exploit exists.
If you want to check a site
Some servers announce their PHP version in a response header called X-Powered-By, for example PHP/7.4.33. In most browsers, open the developer tools (F12), choose the Network tab, reload the page and select the first request to see its headers. No header does not mean a site is safe; it only means the version is not shown. The reliable answer comes from the people who run the site.
If you think your site was attacked
Report it to ASD’s ACSC at cyber.gov.au or call 1300 CYBER1 (1300 292 371). If personal information may have been accessed, check whether the Notifiable Data Breaches scheme applies.
05 · Questions
Frequently asked questions
What is this page?
A public reference on how many Australian websites run versions of PHP that have no official fix for this week’s critical PHP vulnerabilities. It is based on a census of 1,028,138 unique Australian (.au) domains checked on 21 October 2026, plus an hourly re-check of the sites in it that showed an exact PHP version. It does not name or list any individual site. The figures are placeholders until the Australian scan is published.
What happened with PHP this week?
In the week of 20 October 2026 the PHP project disclosed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”). In some set-ups they can let someone take over a web server without a password. PHP is the language behind roughly 70% of websites whose server language is known, including most WordPress sites. Fixed releases exist only for supported versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What does “end-of-life PHP” mean, and why can’t it be patched?
Each PHP version is supported for a fixed period, usually four years. After that, the PHP project stops publishing security releases for it, and the version is “end-of-life”. PHP 8.1 and older are past that point, so there is no official fixed release. The PHP security team published minimal source-code patches for 7.4 to 8.1, but a host has to build and install those themselves. PHP 7.3 and older get nothing. The dependable fix is to move to a supported version.
Is my website affected? How do I check?
Ask your web developer or hosting company which PHP version your site runs and whether this week’s update is installed. Some sites also show the version in a response header called X-Powered-By, which you can see in your browser’s developer tools (Network tab). If no version is shown, that does not mean the site is safe. The goal is PHP 8.2 or newer, kept up to date. Sites built on hosted services such as Squarespace, Wix or Shopify are maintained by those companies. You can also try the site check on this page.
I run a site on old PHP. What should I do?
Contact your host and ask them to move your site to a supported PHP version (8.2 or newer) with the latest update installed. Before or alongside that, update your website software, theme and plugins, because older ones may not work on newer PHP. Take a backup first and check the site afterwards. If you don’t know who hosts your site, your web developer or domain provider can usually tell you.
Do I have to report anything?
Patching an unexploited flaw isn’t reportable by itself. If your site was compromised, report it to ASD’s ACSC at cyber.gov.au or call 1300 CYBER1 (1300 292 371).
If personal information was likely accessed and could cause serious harm, organisations covered by the Privacy Act 1988 must notify the OAIC and affected people under the Notifiable Data Breaches scheme.
Responsible entities for critical infrastructure assets under the Security of Critical Infrastructure Act 2018 (SOCI Act) must report significant cyber incidents to ASD within 12 hours (significant impact) or 72 hours (relevant impact).
This is general information, not legal advice.
How accurate are these numbers?
They are a floor, not a total. We only count the 63,456 sites that openly disclose their PHP version; most servers don’t, so the real number of exposed sites is likely higher. The check is passive: one ordinary request per site for its homepage, reading the response headers and page, with no scanning, probing or attempts to exploit anything. It is a point-in-time snapshot that updates as the scan runs and hosts apply fixes. The “not yet patched” share (83.9%) is the most time-sensitive figure: the scan began on the day the fix was released, and servers patched by their Linux distribution may still report an older version number. See Methodology & caveats for detail.
Who made this?
The data and analysis are by Harbour Edge Intelligence. You’re welcome to cite the figures with credit.
Explore this with AI
- Open in ChatGPT (opens in a new tab)
- Open in Claude (opens in a new tab)
- Open in Copilot (opens in a new tab)
- Open in Perplexity (opens in a new tab)
Opens an AI chat with a prompt about this page, including the latest figures.
06 · Methodology and caveats
How we counted, and what the numbers can’t tell you
The domain list
We built a list of registrable names under .au from public sources: .com.au, .net.au, .org.au and .au direct domains. The sources are the Common Crawl web graph (2022 to 2026 releases), the Tranco, Cisco Umbrella and Majestic top-site lists, the Chrome UX Report (Australia and global), and the open tb0hdan domains dataset. Names that did not resolve in DNS were dropped. Government (.gov.au) and education (.edu.au) zones are not included.
What we collected
For each domain we made one ordinary request for the homepage, as a browser would, from a crawler that identifies itself (AUWebsitesCensus/1.0). If a site did not answer we tried at most a few address variations (https, http, www). Sites that failed were re-checked in later retry and rescue passes, so some domains have more than one check. Each domain counts once: we use its latest successful answer, or its latest failed attempt if it never answered. We read only what the server sends back to every visitor: the response headers and the homepage HTML. We did not probe for vulnerabilities, log in, request any other page, or test whether any site can be exploited.
How versions and platforms were identified
A site counts as “disclosing” when its Server or X-Powered-By header, or a technology fingerprint built from those headers, contains a full PHP version number. Platforms were identified with the open-source Wappalyzer fingerprints and the page’s generator tag. Percentages in the version charts use disclosing sites as the denominator; platform percentages use sites with an identifiable platform.
- Unique Australian (.au) domains checked
- 1,028,138
- Responded to the request
- 889,692
- Platform identified
- 481,598
- Disclosed a PHP version
- 63,456
Definitions
- Patched release: the site reports PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later release on the same branch. These are the first releases with the fix.
- Not yet patched: the site reports any other version, that is, a PHP version released before this week’s fix. That includes supported branches that have not been updated yet (for example 8.3.35) and every end-of-life version.
- No official fix: PHP 8.1 or older. End-of-life: PHP 7.4 or older.
All shares are of the 63,456 sites that disclosed an exact PHP version, unless stated otherwise. Each figure is a snapshot of the moment the site was checked.
Caveats
- The figures are a floor, not a total. Most servers do not announce their PHP version, so this counts only the 63,456 sites that do. Servers configured to hide version details tend to be better maintained, so the share of out-of-date PHP among all sites is unknown and the absolute number of exposed sites is very likely higher than shown here.
- A version number is not proof of exposure. Some Linux distributions and long-term-support vendors back-port security fixes without changing the version string, so a few sites listed as old may be patched. This matters most for the “not yet patched” figure: a server patched by its distribution can still report, say, 8.2.34. In the other direction, a supported version is only safe if the latest point release is installed.
- Very old versions. Published analysis traces the affected code back to PHP 5.4. The 1,069 sites showing PHP 5.3 or older may not be affected by these two flaws specifically, but have had no security fixes of any kind for over a decade. We count them as end-of-life.
- A snapshot in time. The scan began on 21 October 2026, the day the fixed releases were published, so many sites were checked within hours of the fix appearing. Hosts are updating servers now, and the “not yet patched” share in particular will fall. The last updated time at the top of the page shows when this data was generated.
- The patch tracker follows a fixed list. The over-time chart re-checks only the 65,177 sites that showed an exact PHP version in the first scan, every hour, one homepage request each with the same settings as the main scan. New sites are not added. Sites that stop answering or start hiding their version drop out of that check’s count, so the denominator moves a little from point to point. When the tracker has data, the PHP figures at the top of the page come from its latest check of this list; the platform and hosting figures stay from the full scan.
- One domain, one site. Many domains share a server or hosting account, so site counts are not counts of servers or organisations. We do not name or list individual sites.
Sources on the vulnerabilities
- PHP project security advisory, 21 October 2026
- Tenable: PHP2Shell (CVE-2026-109618, CVE-2026-109619) FAQ
- PHP supported versions
- ASD's ACSC: report a cyber security incident
Data and analysis by Harbour Edge Intelligence. You are welcome to cite and reproduce these figures with credit. Aggregate data files will be published here with the Australian figures.
07 · Corrections
Corrections
No corrections yet.
If we get something wrong, we will say so here: what changed, when, and why. Corrections are dated and stay on the page. To report a possible error, email hello@harbouredgeintelligence.au.