[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

how-to (OpenAI GitHub repo openai/php2shell-checker, created Oct 21)

Tip: use OpenAI's php2shell-checker (or plain node phpcheck.js) to see if a site or local PHP binary is still on a vulnerable build

  1. Clone or point Codex at https://github.com/openai/php2shell-checker and install the skills, or run node phpcheck.js https://example.com / node phpcheck.js --local.
  2. Exit codes: 0 OK (patched stable on a listed branch), 1 VULNERABLE, 3 UNKNOWN (no version header, odd branch, prerelease).
  3. It only reads X-Powered-By/Server or php -v — it does not prove the SAPI serving traffic matches CLI, so still restart pools and check a live phpinfo after patching (see the verify tip).
  4. Use as a fast inventory aid across many vhosts, not as a substitute for package/changelog confirmation.

Sources: openai/php2shell-checker · php.net security advisory