TUANZ upgrades site after PHP vulnerability warning

TUANZ upgraded its website from PHP 7.4 to PHP 8.2 after a cybersecurity alert about vulnerabilities in PHP. An internal audit found its web infrastructure was running on unsupported software.

The move followed warnings from national cybersecurity agencies, including New Zealand's National Cyber Security Centre, about critical flaws affecting PHP, a programming language widely used across the web and in content management systems such as WordPress.

Craig Young, Chief Executive Officer of TUANZ, said the issue highlighted the risks for organisations that leave older web systems in place.

"When national cybersecurity agencies, including our own National Cyber Security Centre (NCSC), sounded the alarm over critical vulnerabilities in PHP, it was an urgent call to action," Young said.

PHP underpins a large share of websites globally. TUANZ's own site was using an Enfold WordPress theme dating to 2018, which complicated the upgrade because older themes and plugins can fail when server software is advanced by several versions.

Young said the organisation began with full backups before making code changes, then completed the upgrade under time pressure. The work addressed the immediate exposure, but further updates are still planned.

"Following the NCSC alert, an audit of our web infrastructure revealed a common reality: our website was running on an unsupported PHP 7.4 runtime, anchored by an Enfold WordPress theme dating back to 2018," Young said.

TUANZ said the incident showed why website maintenance should not be treated as optional, particularly by non-profits, member bodies and smaller businesses that may see websites as static assets rather than operational systems.

Young said unsupported software creates growing operational risk once security updates stop.

"It is tempting for non-profits, associations and small businesses to treat websites as digital brochures: set them up and assume they look after themselves. But software ages quickly. The moment a dependency stops receiving security updates, operational risk compounds. Proactive digital maintenance is an essential requirement for every organisation," Young said.

Sector backdrop

The cybersecurity update appeared in a wider newsletter marking TUANZ's 40-year milestone and outlining issues it says are shaping New Zealand's digital sector, including health technology, rural connectivity and artificial intelligence governance.

Among them, TUANZ highlighted its recent Tech Users Summit in Auckland, where leaders from government, healthcare and the technology sector discussed digital infrastructure and public services. The event concluded with the TUANZ Member Awards, where Auckland University of Technology was recognised for AUTGPT, a secure gateway to artificial intelligence models and Microsoft Teams integration hosted under New Zealand jurisdiction.

Other award recipients included Te Hapori Matahiko for community work focused on Māori participation in technology, Jo Stansfield of FortySouth, and Tristana Bessier of Databricks. The Chair's Award went jointly to Vanessa Sorenson and Serge Van Dam, while Liz Gosling and Grant Forsyth received life membership awards.

Rural concerns

TUANZ also pointed to pressure on mobile coverage in rural areas after the shutdown of 3G networks. It cited a Federated Farmers survey of nearly 650 farmers across New Zealand that found 65% could not reliably call 111 emergency services from most of their land.

The same survey found 8% of respondents had no mobile coverage across their entire property, while one in seven farms had replaced 3G-dependent equipment such as irrigation controllers and livestock collars at a cost of thousands of dollars.

Federated Farmers telecommunications spokesperson Mark Hooper said removing older mobile infrastructure before newer satellite-to-mobile services are fully established has created safety and operational gaps for primary producers. TUANZ said it continues to support policy settings that avoid losses in rural coverage during technology transitions.

AI oversight

Artificial intelligence was another focus, with TUANZ pointing to guidance from the Reserve Bank of New Zealand and the Financial Markets Authority on cyber risk and frontier AI risk in financial services. The guidance set expectations for boards and executive teams on third-party vendor risk, operational resilience, incident reporting and data sovereignty.

TUANZ also cited research suggesting AI use is spreading quickly across New Zealand businesses, while implementation remains uneven. A survey in the NZ Herald's Mood of the Boardroom found 34% of chief executives ranked adopting AI effectively as a leading concern, second only to broader economic uncertainty.

Separate research from Xero found 61% of New Zealand small and medium enterprises were actively using AI. TUANZ said the data showed interest in the technology was broadening, even as businesses worked through how to redesign workflows and measure returns.

The association said the mix of cybersecurity, connectivity and AI governance issues showed why organisations need sustained attention to digital systems rather than one-off investments. "As an organisation advocating for a digitally capable, secure, and connected New Zealand, TUANZ must embody digital resilience," Young said.