---
title: Tip: use OpenAI's php2shell-checker (or plain node phpcheck.js) to see if a site or local PHP binary is still on a vulnerable build | ctxsec
url: https://ctxsec.com/items/tip-openai-php2shell-checker-skill
description: ""
status: "how-to (OpenAI GitHub repo openai/php2shell-checker, created Oct 21)"
published: 2026-10-21
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-openai-php2shell-checker-skill.md)

how-to (OpenAI GitHub repo openai/php2shell-checker, created Oct 21)

2026-10-21

### Tip: use OpenAI's php2shell-checker (or plain node phpcheck.js) to see if a site or local PHP binary is still on a vulnerable build

1. Clone or point Codex at `https://github.com/openai/php2shell-checker` and install the skills, or run `node phpcheck.js https://example.com` / `node phpcheck.js --local`.
2. Exit codes: 0 OK (patched stable on a listed branch), 1 VULNERABLE, 3 UNKNOWN (no version header, odd branch, prerelease).
3. It only reads `X-Powered-By`/`Server` or `php -v` — it does **not** prove the SAPI serving traffic matches CLI, so still restart pools and check a live phpinfo after patching (see the verify tip).
4. Use as a fast inventory aid across many vhosts, not as a substitute for package/changelog confirmation.

Sources: [openai/php2shell-checker](https://github.com/openai/php2shell-checker) · [php.net security advisory](https://www.php.net/archive/2026.php#2026-10-21-5)