PHP2Shell Checker
1.4kA free check from OpenAI: given a site's address, it tells you whether the site runs a PHP version with the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619). It only reads the response headers and never attacks the site. Runs with one command or as a Codex skill. Apache-2.0.
We have not run it ourselves: described from the docs and the repository.
In numbers
What it is
On October 21 the PHP team shipped an urgent update: two critical vulnerabilities let an attacker run code on the server without logging in. Every PHP installation that serves web requests is at risk, which means sites on WordPress, Drupal, Joomla and any other PHP engine. The risk is highest for Apache with mod_php, where the attack fires before the site's own code even starts.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything below needs an update. PHP 8.1 and older no longer get updates from the PHP project: only fixes from your host or distribution, or else a move to a supported version.
OpenAI published a small utility that checks this from the outside. You give it a site's address, it sends one ordinary request and reads the X-Powered-By and Server headers, where many servers report the PHP version. There are three answers: OK, POTENTIALLY VULNERABLE (the version is in the affected range) or UNKNOWN (the version is not visible). The utility sends no exploits.
How it works
phpcheck.js from the repository and run node phpcheck.js "https://your-site.com". For scripts there is a --json flag with a patch_status field: ok, potentially_vulnerable or unknown.$skill-installer install both skills from https://github.com/openai/php2shell-checker. Then $phpcheck-url check https://your-site.com if you only have the address, or $phpcheck-server check the PHP version serving my site if you have server access.UNKNOWN. On WordPress the version is in the admin: Tools → Site Health → Info → Server. Compare it with the fixed versions above, and if it is lower, ask your host whether the fix is installed.Know before installing
OK does not prove the server is fine, and POTENTIALLY VULNERABLE does not prove a hole: hosts and distributions often ship the fix without changing the version number. Only a check on the server or an answer from your host is exact.memory_limit=-1 or session.upload_progress.enabled=0 a stopgap: they close specific attack paths but do not make the server safe. The only complete fix is the update.
Comments