What is OpenAI’s php2shell-checker?
php2shell-checker is an open-source tool OpenAI published on 21 October 2026, under the Apache 2.0 licence, alongside the coordinated disclosure of PHP2Shell (CVE-2026-109618 and CVE-2026-109619). It is one short Node.js script with two modes:
- URL mode sends a HEAD request to a website and reads the
X-Powered-ByandServerheaders for a PHP version. It falls back to GET only if HEAD is refused, doesn’t follow redirects and doesn’t read the page. - Local mode runs
php -von the machine and reads the version.
It then compares the version with an embedded table of the last vulnerable release per branch, from 5.4 to 8.5. It sends no attack traffic: OpenAI’s own instructions say “Do not run exploit probes.”
How do I run OpenAI’s checker?
You need Node.js and a copy of the repository from GitHub. From the repository folder:
- On your server, to check the command-line PHP:
node phpcheck.js --local - Against your own website:
node phpcheck.js "https://your-site.example" - For machine-readable output, add
--json.
Only run URL mode against sites you own or manage. The command-line PHP that --local checks can differ from the PHP that serves your website, so also check what the site itself reports, for example in WordPress under Tools → Site Health → Info → Server.
What do OK, VULNERABLE and UNKNOWN mean?
| Result | Exit code | What the tool means | What to do |
|---|---|---|---|
OK | 0 | The version is above the last vulnerable release for its branch | Confirm it’s the version your site runs and that PHP was restarted |
VULNERABLE | 1 | The version is at or below the last vulnerable release | Update PHP, unless your vendor backported the fix (see below) |
UNKNOWN | 3 | No version found, the branch isn’t listed, or it’s a pre-release | Check the version in your control panel or on the server |
UNKNOWN does not mean your site is safe. Most well-configured servers hide the PHP version in their headers, so URL mode often returns UNKNOWN.
Where can OpenAI’s checker be wrong?
It compares version numbers only, and OpenAI says so: OK “does not independently verify a security fix.” Three cases matter in practice:
- Distribution backports: Ubuntu, Debian, Red Hat and others fix older-numbered PHP packages. A patched
8.3.6-0ubuntu0.24.04.13still reads as VULNERABLE. See Update PHP on Ubuntu and Debian. - Panel and vendor build numbers: on old branches, any number above the cutoff reads as OK, including numbers PHP never released. 宝塔 and aaPanel ship patched builds such as 7.4.34 and 8.1.35, but 8.0.27 is both a 宝塔 build and an old unpatched release. See aaPanel PHP.
- Headers: a proxy or CDN can hide or rewrite
X-Powered-By, and one server can host many sites on different PHP versions.
How do I combine it with the PHP2Shell checker?
Paste the tool’s output straight into the version box of the PHP2Shell checker. It accepts the --json output, a line such as OK: PHP 8.3.36, php -v output or an X-Powered-By: PHP/8.3.36 header, and pulls out the version. Then choose where your PHP comes from, such as an OS package, 宝塔 / aaPanel or another control panel. That lets the checker account for backports and panel builds that a version-only comparison misses. The check runs in your browser and nothing you paste is sent anywhere.
The fixed releases are:
| Branch | First fixed release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
| 8.1 and older | No new release; official source patches for 7.4, 8.0 and 8.1 |
If the result says you’re affected, follow the PHP2Shell patch guide for your setup. After updating, check for signs of an earlier intrusion with the compromise checklist.
Can php2shell.help run this check on my URL for me?
Yes. The URL box in the PHP2Shell checker reads your site's headers with the same logic, then judges the version with this site's rules. Running the tool yourself is useful on the server, where --local reads php -v.
OpenAI's checker says OK. Is my site safe from PHP2Shell?
Not necessarily. OK only means the advertised version is above the last vulnerable release for its branch; the tool doesn't verify the fix itself, and headers can be changed. Confirm the version your site actually runs and that every PHP worker was restarted.
Check your PHP for PHP2Shell
Enter the version your website reports. We compare it with the first fixed release for its branch and tell you what to do next.
PHP2Shell checker →Sources
The core facts on this page (fixed versions, CVE details, vendor packages and agency warnings) come from official sources. Research, news and community posts are labelled as such.
- php2shell-checker: check a website or local PHP binary for php2shellResearch OpenAI (GitHub)
- Security advisory: Critical remote code execution vulnerabilities, update nowOfficial The PHP Group
- RCE via OOM corruptionOfficial The PHP Group
- RCE via stale global stateOfficial The PHP Group
- Site Health screenOfficial WordPress.org