{"slug": "php2shell-checker", "title": "Php2shell-Checker", "summary": "OpenAI released php2shell-checker, a Node.js command-line tool that checks whether a website or local PHP installation runs a version at or below embedded October 20, 2026 security cutoffs, without sending exploit requests. The tool reads the X-Powered-By and Server headers via HEAD requests (falling back to GET on 405 or 501) or runs php -v locally, returning exit code 0 for OK, 1 for VULNERABLE, 3 for UNKNOWN and 2 for invalid arguments, with --json output for machine-readable results. OpenAI states it is not accepting external code contributions, and the project is licensed under Apache License 2.0.", "body_md": "Check a website or local PHP version without exploit requests. Uses Node.js. No packages to install.\n\nTo install both skills, ask Codex:\n\n```\n$skill-installer install both skills from https://github.com/openai/php2shell-checker\n```\n\nUse [phpcheck-server](https://github.com/openai/php2shell-checker/blob/main/skills/phpcheck-server/SKILL.md) when you have server\naccess, or [phpcheck-url](https://github.com/openai/php2shell-checker/blob/main/skills/phpcheck-url/SKILL.md) when you only have a URL:\n\n```\n$phpcheck-server check the PHP version serving my site\n$phpcheck-url check example.com\n```\n\nCheck a website:\n\n```\nnode phpcheck.js \"https://example.com\"\n```\n\nCheck the local CLI PHP\n\n```\nnode phpcheck.js --local\n```\n\n| Result | Exit code | Meaning | \n|---|---|---|\n| `OK` | `0` | Stable PHP patch version above the embedded cutoff for a listed major/minor branch. | \n| `VULNERABLE` | `1` | PHP version at or below the embedded cutoff for that branch. | \n| `UNKNOWN` | `3` | No PHP version or response, an unrecognized version/branch, or a newer prerelease build. | \n\nUse `--json` for machine-readable output (`patch_status` is `ok`, `vulnerable`,\nor `unknown`). Invalid arguments exit with code `2`.\n\n```\nnode --test phpcheck.test.js\n```\n\nTests run the CLI against local HTTP servers simulating PHP response headers; no PHP installation or external website is required.\n\nThe checker only evaluates versions exposed in HTTP response headers or by\n`php -v`. It reads `X-Powered-By` and `Server`, sends `HEAD`, and falls back to\n`GET` only when `HEAD` returns 405 or 501. It does not follow redirects or\ninspect response bodies. Missing or hidden PHP headers return `UNKNOWN`.\n\n`OK` is a version comparison against the embedded October 20, 2026 cutoffs,\nassuming subsequent stable patches in each listed branch contain the fix;\nit does not independently verify a security fix. Check the cutoffs against\nthe official PHP security release when its affected and fixed versions are\npublished. Headers can be hidden or changed, and distribution backports may\nnot change the upstream version. `UNKNOWN` does not mean the target is patched.\n\nOpenAI is not accepting external code contributions to this project. Bug\nreports and non-code feedback are welcome through GitHub issues. See\n[CONTRIBUTING.md](https://github.com/openai/php2shell-checker/blob/main/CONTRIBUTING.md).\n\nThis project is licensed under the [Apache License 2.0](https://github.com/openai/php2shell-checker/blob/main/LICENSE).", "url": "https://wpnews.pro/news/php2shell-checker", "canonical_source": "https://github.com/openai/php2shell-checker", "published_at": "2026-10-21 16:55:26+00:00", "updated_at": "2026-10-21 17:12:54.149295+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools"], "entities": ["OpenAI", "php2shell-checker", "Node.js", "PHP", "GitHub", "Apache License 2.0"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/php2shell-checker", "markdown": "https://wpnews.pro/news/php2shell-checker.md", "text": "https://wpnews.pro/news/php2shell-checker.txt", "jsonld": "https://wpnews.pro/news/php2shell-checker.jsonld"}}