⏳ This skill is pending AI review.
Scores will appear once the review pipeline completes.
phpcheck-server
Check PHP2Shell patch status with local or server access.
Choose how to use this skill
You do not need every option. Choose the path your AI client supports. The stable page stays the same; versioned files are immutable.
1. Native installer
This listing has no registered native installer command. Use the complete package or source fallback below, depending on what your client supports.
Do not guess an installer command or replace an existing version without reviewing the diff.
2. Complete package recommended
Download the ZIP when available. It includes SKILL.md plus the references, security notes and version metadata.
No complete ProSkills package is published for this listing yet.3. Prompt-only
Copy the prompt above when the agent can read the stable page or when you want to adopt the workflow without installing a skill.
Need only the instruction file?
Download SKILL.md only if your client requires a single file. The complete ZIP is safer for a full installation because it preserves the references and release context.
No path installs or executes anything by itself. Your agent still needs access to the project files. Before updating, compare the installed version and review the diff.
// RATINGS
Not yet listed on ClawHub or SkillsMP
// README
PHP Version Checker
Get a version-based PHP2Shell warning from a website's PHP headers or local installation.
To install both skills, ask Codex:
$skill-installer install both skills from https://github.com/openai/php2shell-checker
Use phpcheck-server when you have server access, or phpcheck-url when you only have a URL:
$phpcheck-url check https://example.com
$phpcheck-server check the PHP version serving my site
Run directly
Check a website:
node phpcheck.js "https://example.com"
Results
| Result | Exit code | Meaning |
|---|---|---|
OK | 0 | Advertised version meets an upstream fixed release. |
POTENTIALLY VULNERABLE | 1 | Advertised version is in an affected range. |
UNKNOWN | 3 | Missing or unrecognized version, prerelease, or failed check. |
Use --json for machine-readable output. patch_status is ok,
potentially_vulnerable or unknown. Invalid arguments exit with code 2.
Versions below a listed upstream fix return potentially_vulnerable and
exit 1. PHP 5.4–5.6, 7.0–7.4, 8.0 and 8.1 also return this warning, even
with a higher patch number such as 8.1.35.
URL checks
URL mode reads X-Powered-By and Server, sends HEAD, and falls back to
GET only when HEAD returns 405 or 501. It does not follow redirects or
inspect response bodies. Missing or hidden PHP headers return UNKNOWN.
The upstream fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, from the
October 21 PHP advisory.
HTTP headers cannot tell whether the version contains a backported fix. Even OK
only describes the advertised version - it doesn't verify the installation!
The checker does not send exploit probes.
Contributing
OpenAI is not accepting external code contributions to this project. Bug reports and non-code feedback are welcome through GitHub issues. See CONTRIBUTING.md.
License
This project is licensed under the Apache License 2.0.
// HOW IT'S BUILT
KEY FILES