BREAKING
Haryana Health Minister calls for intensified food safety surveillanceMeta fined $25 billion in privacy case: How much is that compared to its profits?Mysuru Dasara: Stir over Dalit ministers being stopped from performing puja by senior copTiger Shroff shooting: Who helped the shooters? Missing guns and Rs 2 lakh payment under scannerJodhpur-Hyderabad train halted for 2 hrs in Maharashtra over youth ‘assault’; RPF denies chargeCan’t disclose details of PM’s foreign visits on IAF plane: HCChina-linked Storm-0940 hackers use AI tool ARTEX to launch 2,900 login attempts per minuteRising air pollution in Delhi-NCR: How to protect your lungs and stay healthyKanpur man dies after being dragged on car roof for 1.5 km, hands trapped in windowsHospital reconstructs accident victim’s skull using his bone
Technology

OpenAI releases PHP2Shell checker: Here’s how to check if your website is at risk

hellohimachalse@gmail.com 22 Oct 2026 50 min ago
OpenAI has released a new PHP2Shell checker to help website owners find out whether their servers may be exposed to critical PHP security flaws. The tool, available on GitHub, works with OpenAI’s Codex coding agent and can check the PHP version running on a website. The release comes after the discovery of serious PHP vulnerabilities that have prompted security warnings and emergency updates for website administrators worldwide.

PHP runs behind millions of websites, including many built using WordPress. The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious commands on affected servers. OpenAI says its AI-assisted security research contributed to identifying the flaws, with cybersecurity company Wiz independently reporting both issues. PHP’s maintainers coordinated the fixes.

:

What is OpenAI’s PHP2Shell checker?

The PHP2Shell checker is a small utility that examines a website’s PHP version and compares it against known security update thresholds.

OpenAI has packaged the tool into two Codex skills. One checks websites through their public URL, and the other works directly on a server.

It does not attempt to exploit the security flaws. The checker relies on version information, making it a preliminary screening tool rather than a complete security test.

:

How to check your website using Codex

OpenAI has published the checker at:

Website administrators can follow these steps:

  1. Open Codex and install both skills using the command below.

  2. Run the URL checker if you only know your website address.

  3. Use the server checker if you have access to the machine hosting the website.

  4. Review the result and compare it with the official PHP security updates.

Install the Codex skills:

$skill-installer install both skills from https://github.com/openai/php2shell-checker

Check your website:

$phpcheck-url check https://example.com

Check the hosting server:

$phpcheck-server check the PHP version serving my site

Users with Node.js can run the checker directly using node phpcheck.js "https://example.com" after obtaining the repository files.

:

What do the PHP2Shell checker results mean?

Result Meaning
OK Detected version is above the checker’s security cutoff
VULNERABLE Detected version falls within the affected range
UNKNOWN PHP version could not be reliably determined

There is a catch. Websites often hide their PHP version from public visitors. The checker may return UNKNOWN even when PHP is installed.

An OK result is not proof that the website is completely secure. The checker does not independently test whether the vulnerability has been fixed.

:

What should website owners do next?

Administrators should verify their installed PHP version, consult official PHP security advisories and install the relevant updates. Websites using outdated PHP versions need particular attention.

OpenAI’s checker can help identify potential exposure. Installing the correct PHP security patch remains the priority.

Related News