Is Car Show Expert Affected by the PHP and Node.js Fixes?
You may have seen news about security fixes for PHP and Node.js this week. If you run a show or enter one on Car Show Expert, the short answer is that nothing is required of you. Here is the plain version of what those fixes are, and how they relate to this site.
PHP and Node.js are programming tools that many websites are built with. When the people who maintain them find a weakness, they publish a fix, and anyone who uses the tool is expected to update. That is a normal, healthy part of running software, and it is why these announcements appear regularly.
PHP: Car Show Expert does not use PHP anywhere. The site is written in TypeScript with Next.js (React), runs on Cloudflare's network using Cloudflare Workers, and stores its data in a Postgres database, with photos kept in Cloudflare R2. Because there is no PHP in that list, PHP security fixes do not apply to this site.
Node.js: The Node.js project published security releases on 21 October 2026. Its own announcement lists 10 vulnerabilities, four of them rated high severity, and new versions for its 22, 24 and 26 release lines. You can read it at https://nodejs.org/en/blog/vulnerability/october-2026-security-releases. We use Node.js to develop the site, and we updated the version on our development machines to the patched 24.x release (24.22.1) the same week.
To be precise about where Node.js sits: the live site runs on Cloudflare's own runtime, not on a Node.js server that we operate ourselves. Cloudflare maintains and patches that runtime. So the update we made covers the tools we develop with, and we are not claiming anything beyond that.
Other protections are already in place and are not new this week. Sign-in attempts are rate limited, and automated bots are challenged at the edge before they reach the sign-in page. Passwords are stored securely hashed, never in readable form. Payments are handled by Stripe, so card numbers never touch our servers. And we rotate our secret keys whenever that is called for.
What you should do: nothing is required of organisers or entrants. As good general practice, use a strong password that you do not use anywhere else, or sign in with Google if you prefer not to manage another password. If anything on your account ever looks odd, contact support the usual way and we will look into it.
Is my data affected? We have no reason to think so. The PHP fixes do not apply to this site, and we updated the Node.js we develop with promptly.
Do I need to change my password? No. There is nothing in this news that calls for it. If you reuse a password from another site, changing it is a good idea at any time.
What are PHP and Node.js? They are tools developers use to write and run websites. PHP is an older, very widely used one. Node.js runs JavaScript outside the browser. Car Show Expert uses Node.js for developing the site, and does not use PHP.
How do I know? You can check the Node.js announcement linked above, and the facts about our own setup are the ones we have stated here. We have not claimed any outside audits or certifications, and we would rather tell you exactly what we did than overstate it.
If you would like to see how the site works for yourself, try the live demo at /demo, or create your own account at /sign-up.