Free tools

PHP & Node.js version check

PHP and Node.js keep releasing fixes for serious flaws. Enter your domain and we look at the PHP or Node.js version your website shows every visitor, then compare it with the latest security release.

We open your website’s home page once, like an ordinary visitor. We only read what the server sends every visitor: the headers, the cookie names and the page’s generator tag. We do not try to log in, we do not test the flaws, and we do not keep the result. Privacy policy

This is a passive check of public information only, not a security test. “Can’t tell” or “has the fix” is not a guarantee: a version can be hidden, and other flaws can exist.

The security release we compare with

The PHP and Node.js security releases of 21 October 2026. Each time a new security release comes out, we update what we compare with.

PHP

Two critical flaws (CVE-2026-109618, CVE-2026-109619, CVSS v4 9.2) can let an attacker run code on the server from afar. Fixed in 8.2.35, 8.3.36, 8.4.27 or 8.5.12; every older version of those series is affected.

PHP 8.2 gets no security fixes after 31 December 2026. Plan a move to a newer series.

Node.js

One high-severity flaw (CVE-2026-111497) in the Brotli decoder can permit remote code execution. Fixed in 22.23.4, 24.22.1 or 26.12.1. End-of-Life versions are always affected.

Read the full explanation →

What we look at

  • The X-Powered-By and Server headers, which often show a version (PHP/8.4.26).
  • Cookie names that PHP and Node.js frameworks set, such as PHPSESSID or connect.sid (names only, never values).
  • Addresses ending in .php in your home page’s redirects.
  • The generator tag of CMSs that run on PHP, such as WordPress, Joomla or Drupal.