Is your site exposed to the October 2026 PHP and Node.js flaws?
On 21 October 2026, PHP fixed two critical flaws that let an attacker run code on a server, and Node.js published a set of fixes. Enter your address: we look at what your site shows, as a browser would, without testing or touching anything.
Many servers tell their PHP version to anyone who asks. That answer is what we read, nothing more.
Your browser asks for the home page.
The server answers and introduces itself: Apache, PHP 8.1.2.
PHP 8.1 no longer gets fixes: this site is exposed.
Updated to PHP 8.4.27, it no longer is.
A version on display that is out of date is enough to single out a site to attack.
Updating PHP fixes the flaw. Hiding its version avoids being singled out.
Any version equal or newer, within its branch, includes the 21 October 2026 fixes.
What exactly does this tool check?
It visits your home page once, like a browser, and reads what your server answers: the headers, the cookies, a few signs in the page. If your server shows its PHP version, we compare it with the fixed versions, and with the fixed Ubuntu and Debian packages. Nothing is tested, nothing is sent to your site.
Why is the Node.js version never given?
Node.js never shows it to visitors. We can only spot that it is probably in use, and the verdict never goes beyond “to check”. Whoever runs your site reads it by typing node -v.
My server shows a lower number than the fixed version. Am I at risk?
Not necessarily. Ubuntu and Debian fix their packages without changing the PHP number: 8.3.6-0ubuntu0.24.04.13, for example, includes the fixes. So we compare the whole package when it is visible, and say “to check” when the distribution is not known.
Does “not detected” mean my site is safe?
No. A technology can be hidden, or run somewhere other than the home page (an api. address, a back office). Only whoever runs your server can confirm the installed versions.
Reading example.com
0,0 sYour score is building.
A single visit to your home page. The verdict says what your server lets others see, never more.