Get a version-based PHP2Shell warning from a website's PHP headers or local installation.
To install both skills, ask Codex:
$skill-installer install both skills from https://github.com/openai/php2shell-checker
Use phpcheck-server when you have server access, or phpcheck-url when you only have a URL:
$phpcheck-url check https://example.com
$phpcheck-server check the PHP version serving my site
Check a website:
node phpcheck.js "https://example.com"| Result | Exit code | Meaning |
|---|---|---|
OK |
0 |
Advertised version meets an upstream fixed release. |
POTENTIALLY VULNERABLE |
1 |
Advertised version is in an affected range. |
UNKNOWN |
3 |
Missing or unrecognized version, prerelease, or failed check. |
Use --json for machine-readable output. patch_status is ok,
potentially_vulnerable or unknown. Invalid arguments exit with code 2.
Versions below a listed upstream fix return potentially_vulnerable and
exit 1. PHP 5.4–5.6, 7.0–7.4, 8.0 and 8.1 also return this warning, even
with a higher patch number such as 8.1.35.
URL mode reads X-Powered-By and Server, sends HEAD, and falls back to
GET only when HEAD returns 405 or 501. It does not follow redirects or
inspect response bodies. Missing or hidden PHP headers return UNKNOWN.
The upstream fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, from the
October 21 PHP advisory.
HTTP headers cannot tell whether the version contains a backported fix. Even OK
only describes the advertised version - it doesn't verify the installation!
The checker does not send exploit probes.
OpenAI is not accepting external code contributions to this project. Bug reports and non-code feedback are welcome through GitHub issues. See CONTRIBUTING.md.
This project is licensed under the Apache License 2.0.