How to check your site's PHP version for php2shell with OpenAI's Codex skills

When OpenAI disclosed the php2shell PHP remote code execution flaws on October 21, it also published two Codex skills in openai/php2shell-checker on GitHub for checking whether your site is affected. Use phpcheck-url when you only have a URL and phpcheck-server when you have server access.

1. Install both skills in Codex. If a new skill doesn't appear, restart Codex.

$skill-installer install both skills from https://github.com/openai/php2shell-checker

1. Check a URL.

$phpcheck-url check https://example.com

1. With server access, check the PHP that actually serves the site, and confirm that php -v matches the site's PHP-FPM or Apache installation.

$phpcheck-server check the PHP version serving my site

1. You can also run it directly without Codex.

git clone https://github.com/openai/php2shell-checker
cd php2shell-checker
node phpcheck.js "https://example.com"
node phpcheck.js --local

There are three results: OK (exit code 0), VULNERABLE (1), and UNKNOWN (3). The checker only reads the version in the X-Powered-By and Server response headers or from php -v. A site that hides those headers returns UNKNOWN, which does not mean it's patched. Distribution backports may not change the version number, so compare even an OK result with the official PHP security release. Don't run exploit probes.