[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fy9ca88wddeyi":3},{"code":4,"message":5,"data":6,"timestamp":30},10000,"success",{"full_name":7,"position":8,"description":9,"language":10,"stars":11,"forks":12,"stars_gained":13,"age_days":14,"hn_threads":15,"one_liner":21,"summary_md":22,"topic":23,"github_topics":26,"license":27,"homepage":9,"updated_at":28,"history":29},"openai\u002Fphp2shell-checker",1,null,"JavaScript",1381,126,344,4,[16],{"id":17,"title":18,"points":19,"comments":8,"posted_at":20},50184078,"Php2shell-Checker",2,"2026-10-21","Tells you whether a site's advertised PHP version falls in a known vulnerable range.","## The problem\n\nWhen a PHP advisory like the October 21 one lands, the first question for anyone running or auditing a site is boring and urgent: is this box on a patched release? Finding out normally means logging in, checking `php -v`, and mentally mapping that version against advisory ranges — or, from the outside, eyeballing the `X-Powered-By` header and guessing. This checker turns that into a single command with a scriptable exit code, for both a URL and a local server.\n\n## What's different\n\nMost people solve this with a scanner such as Nikto or Nuclei, or by wiring version strings into their own monitoring. Those are general-purpose and heavy; this is a deliberately narrow verdict engine. Three things set it apart: an explicit three-state result (`OK`, `POTENTIALLY VULNERABLE`, `UNKNOWN`) with distinct exit codes so CI can branch on it; a hard-coded table of upstream fixed releases drawn from the advisory, with whole branches like PHP 5.4–8.1 flagged regardless of patch number; and aggressive honesty about its limits — it does not follow redirects, does not read bodies, does not send exploit probes, and states that `OK` only describes the advertised version, not the installation. It is also shipped as two installable Codex skills (`phpcheck-server`, `phpcheck-url`), which is the more novel packaging choice.\n\n## Who it's for\n\nOps and security engineers doing quick triage across many hosts, and anyone who wants a cheap pre-deploy gate in CI that fails when a site advertises an unpatched PHP. It suits people who already know that header-based checks are a hint, not proof. It is not for teams wanting a real vulnerability scanner, authenticated checks, or backport-aware analysis — HTTP headers cannot reveal a distro-patched build, and the README says so plainly. Anyone needing coverage beyond PHP should look at mature scanners instead.\n\n## Cost of adoption\n\nNeeds Node.js to run `phpcheck.js` directly, or a Codex setup to use the skills; the README documents install only through the skill installer, so the standalone path is `node phpcheck.js \"https:\u002F\u002Fexample.com\"`. The rule table is hard-coded to one advisory's fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12), so it will go stale as new advisories appear and needs manual upkeep. Apache-2.0. OpenAI states it is not accepting external code contributions, so do not expect to upstream fixes yourself; bug reports only. Maturity is essentially zero: three days old.\n\n## Verdict\n\nThis is a brand-new, single-purpose tool, created 2026-10-21 and tracked for three days with roughly +366 stars per day on the new-projects board — an advisory-driven spike, not an established project. The README is unusually candid about false confidence, which is the right posture for a header check, but the hard-coded advisory table means it is a snapshot rather than a maintained scanner. Use it as a fast triage ping or CI smoke check today, and verify anything important on the server itself. Do not treat `OK` as a clean bill of health.",{"slug":24,"name":25},"security","Security & Privacy",[],"Apache-2.0","2026-10-24T22:35:11Z",[],1792898393]