Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
php2shell-checker — CLI that checks a website's PHP version or a local PHP binary against embedded patch cutoffs to determine php2shell vulnerability status, with JSON output and exit codes. | Kitploit
Tools/GitHubGitHub/openai/php2shell-checker
Defensive ToolsVulnerability ScannersWeb Vulnerability ScannersVulnerability AnalysisInformation GatheringWeb Security
GitHubopenai/php2shell-checker

php2shell-checker

CLI that checks a website's PHP version or a local PHP binary against embedded patch cutoffs to determine php2shell vulnerability status, with JSON output and exit codes.

View Repository
63152431 day agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

PHP Version Checker

Check a website or local PHP binary to see if it's vulnerable to php2shell.

To install both skills, ask Codex:

$skill-installer install both skills from https://github.com/openai/php2shell-checker

Use phpcheck-server when you have server access, or phpcheck-url when you only have a URL:

$phpcheck-url check https://example.com

$phpcheck-server check the PHP version serving my site

Run directly

Check a website:

node phpcheck.js "https://example.com"

Check the local CLI PHP

node phpcheck.js --local

Results

ResultExit codeMeaning
OK0Stable PHP patch version above the embedded cutoff for a listed major/minor branch.
VULNERABLE1PHP version at or below the embedded cutoff for that branch.
UNKNOWN3No PHP version or response, an unrecognized version/branch, or a newer prerelease build.

Use --json for machine-readable output (patch_status is ok, vulnerable, or unknown). Invalid arguments exit with code 2.

Tests

node --test phpcheck.test.js

Tests run the CLI against local HTTP servers and a fake PHP executable. No PHP installation or external website is required.

Limitations

The checker only evaluates versions exposed in HTTP response headers or by php -v. It reads X-Powered-By and Server, sends HEAD, and falls back to GET only when HEAD returns 405 or 501. It does not follow redirects or inspect response bodies. Missing or hidden PHP headers return UNKNOWN.

OK is a version comparison based on the assumption that subsequent stable patches in each listed branch contain the fix. It does not independently verify a security fix. Check the versions against the official PHP security release. Headers can be hidden or changed, and distribution backports may not change the upstream version. UNKNOWN does not mean the target is patched!

Contributing

OpenAI is not accepting external code contributions to this project. Bug reports and non-code feedback are welcome through GitHub issues. See CONTRIBUTING.md.

License

This project is licensed under the Apache License 2.0.

Download Tool