Security vulnerabilities affecting websites globally#

Recently identified security vulnerabilities affecting websites and online applications globally are impacting some organisations in New Zealand.

We are actively monitoring the situation and taking necessary action to prevent any compromise to our digital environments and protect the privacy of our users.

We're coordinating our response with N4L, whose services are unimpacted. If you would like more information about the steps N4L have taken and to stay across further updates, visit here:

PHP critical vulnerabilities – N4L 

Action for schools/early learning services#

If you have a website, online resource or web-based application:

• contact your website administrator, ICT provider or technical support team
• ask them to check whether your systems are affected
• make sure any recommended security updates are applied as soon as possible.

If updates can't be applied straight away, consider taking affected services offline until security updates are installed. Leaving affected systems online without security updates will increase the risk of them being compromised.

Below are links to further technical information to share with your website administrator, technical lead, or ICT provider:

• NCSC encourages immediate patching against PHP vulnerability – NCSC
• UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP – NCSC
• Drupal core - Critical - Remote code execution - SA-CORE-2026-014 – Drupal

Some Ministry systems temporarily offline#

We have urgently updated systems where possible. Some Ministry websites and services have been taken offline while security updates are applied and checks are completed.

Below is the list of sites that are currently unavailable.

We recognise this may have an impact and are taking action to address the issue.

We will provide further updates through the next Bulletin, or as soon as there are new developments.