Repolode
Submit
openai

openai/php2shell-checker

A Node.js CLI and agent skills that check whether a website or local PHP binary runs a version vulnerable to php2shell.

View on GitHub
Stars
435
Forks
31
Open issues
5
Last commit
10 hours ago

What is it?

PHP Version Checker is a small Node.js tool that tells you whether a PHP installation is running a version affected by the php2shell vulnerability. It can check a remote website by reading the PHP version exposed in HTTP response headers, or check the PHP binary installed on the local machine by running php -v.

Results are reported as OK, VULNERABLE, or UNKNOWN, with distinct exit codes so the tool can be used in scripts. A --json flag provides machine-readable output. The project also ships two Codex skills: one for checking a server you have access to, and one for checking only a URL.

Because it relies on version strings, the checker can only evaluate what is exposed. Hidden or altered headers return UNKNOWN, and distribution backports may not change the upstream version number, so results should be confirmed against the official PHP security release.

Key features

  • 01Checks a website by reading PHP version headers over HTTP.
  • 02Checks the local PHP CLI by running php -v.
  • 03Returns OK, VULNERABLE, or UNKNOWN with distinct exit codes.
  • 04Supports --json output for scripting.
  • 05Includes Codex skills for server-side and URL-only checks.

Use cases

  • Quickly checking whether a production website exposes a vulnerable PHP version.
  • Auditing PHP installations on servers you administer.
  • Scripting periodic version checks in a CI or monitoring job.

Quick start

  1. 1

    Clone the repository from GitHub

  2. 2

    Check a website's PHP version

    node phpcheck.js "https://example.com"
  3. 3

    Check the local CLI PHP

    node phpcheck.js --local

Things to know

  • Only evaluates PHP versions exposed in HTTP headers or via php -v; hidden or missing headers return UNKNOWN.
  • An OK result assumes later stable patches contain the fix and does not verify the security fix itself.
  • UNKNOWN does not mean the target is patched.

Topics

#security#php#vulnerability-scanning#cli#nodejs#version-check

FAQ

What is php2shell-checker?
A Node.js CLI and agent skills that check whether a website or local PHP binary runs a version vulnerable to php2shell. PHP Version Checker is a small Node.js tool that tells you whether a PHP installation is running a version affected by the php2shell vulnerability. It can check a remote website by reading the PHP version exposed in HTTP response headers, or check the PHP binary installed on the local machine by running php -v.
Is php2shell-checker free to use? What license does it have?
php2shell-checker is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is php2shell-checker still maintained?
Actively maintained. The last commit to php2shell-checker was on Oct 21, 2026.
What can I use php2shell-checker for?
Quickly checking whether a production website exposes a vulnerable PHP version. Auditing PHP installations on servers you administer. Scripting periodic version checks in a CI or monitoring job.
How do I install php2shell-checker?
Clone the repository from GitHub Check a website's PHP version: node phpcheck.js "https://example.com" Check the local CLI PHP: node phpcheck.js --local
Where can I get php2shell-checker?
The source code and installation instructions are on GitHub: https://github.com/openai/php2shell-checker

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects