openai/php2shell-checker

The problem

When a PHP advisory like the October 21 one lands, the first question for anyone running or auditing a site is boring and urgent: is this box on a patched release? Finding out normally means logging in, checking php -v, and mentally mapping that version against advisory ranges — or, from the outside, eyeballing the X-Powered-By header and guessing. This checker turns that into a single command with a scriptable exit code, for both a URL and a local server.

What's different

Most people solve this with a scanner such as Nikto or Nuclei, or by wiring version strings into their own monitoring. Those are general-purpose and heavy; this is a deliberately narrow verdict engine. Three things set it apart: an explicit three-state result (OK, POTENTIALLY VULNERABLE, UNKNOWN) with distinct exit codes so CI can branch on it; a hard-coded table of upstream fixed releases drawn from the advisory, with whole branches like PHP 5.4–8.1 flagged regardless of patch number; and aggressive honesty about its limits — it does not follow redirects, does not read bodies, does not send exploit probes, and states that OK only describes the advertised version, not the installation. It is also shipped as two installable Codex skills (phpcheck-server, phpcheck-url), which is the more novel packaging choice.

Who it's for

Ops and security engineers doing quick triage across many hosts, and anyone who wants a cheap pre-deploy gate in CI that fails when a site advertises an unpatched PHP. It suits people who already know that header-based checks are a hint, not proof. It is not for teams wanting a real vulnerability scanner, authenticated checks, or backport-aware analysis — HTTP headers cannot reveal a distro-patched build, and the README says so plainly. Anyone needing coverage beyond PHP should look at mature scanners instead.

Cost of adoption

Needs Node.js to run phpcheck.js directly, or a Codex setup to use the skills; the README documents install only through the skill installer, so the standalone path is node phpcheck.js "https://example.com". The rule table is hard-coded to one advisory's fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12), so it will go stale as new advisories appear and needs manual upkeep. Apache-2.0. OpenAI states it is not accepting external code contributions, so do not expect to upstream fixes yourself; bug reports only. Maturity is essentially zero: three days old.

Verdict

This is a brand-new, single-purpose tool, created 2026-10-21 and tracked for three days with roughly +366 stars per day on the new-projects board — an advisory-driven spike, not an established project. The README is unusually candid about false confidence, which is the right posture for a header check, but the hard-coded advisory table means it is a snapshot rather than a maintained scanner. Use it as a fast triage ping or CI smoke check today, and verify anything important on the server itself. Do not treat OK as a clean bill of health.