Key Notes
- OpenAI has released two Codex skills that check advertised website PHP versions or investigate the runtime serving a site with authorized server access.
- The checker compares versions with embedded cutoffs and reports unknown when it cannot establish a result, rather than proving a website is protected.
- Server runtime verification and vendor security advisories remain essential because command-line versions can differ and backported fixes may retain older version numbers.
OpenAI has published a PHP version checker with two Codex skills to help website operators assess their exposure to PHP2Shell. One workflow starts with a website address; the other uses local or server access to identify the PHP installation actually serving the site. The tool reports a version-based patch assessment and helps determine whether further verification or an update is needed.
The GitHub project follows the emergency PHP security releases we covered on October 21. It offers a convenient starting point for administrators, but a URL alone cannot establish that a server is safe. Hidden version headers, distribution backports and differences between installed PHP runtimes can all change what a result means.
Two Skills for Different Levels of Access
The repository’s instructions tell users to ask Codex’s skill installer to install both skills from the project. After installation, the URL workflow can be invoked with a short prompt:
$phpcheck-url check https://example.com
The URL skill checks the PHP version advertised by the site and compares it with current security guidance. This is useful when someone has a public website address but no direct access to its hosting environment. If the version is hidden, the workflow is supposed to report that it cannot determine the status.
For an administrator with authorized server access, the project provides a different prompt:
$phpcheck-server check the PHP version serving my site
The server workflow starts with a local PHP version check, then asks the agent to verify that it matches the PHP-FPM or Apache installation handling the website. That distinction matters on machines with multiple PHP versions: the command-line executable can differ from the runtime processing visitors’ requests.
What the Checker Reads—and What It Leaves Unknown
The underlying JavaScript checker reads HTTP response headers rather than testing an exploit. It looks for PHP information in Server and X-Powered-By, sends a HEAD request, and tries GET only if the server responds that the first method is unsupported. It does not inspect page contents or follow redirects.
Its three outcomes describe the available evidence. OK means a reported stable version falls above the built-in vulnerable cutoff for a listed branch. VULNERABLE means it falls at or below that cutoff. UNKNOWN covers cases such as an unavailable version, a failed response, an unlisted branch or a newer prerelease build.
Those labels require interpretation. A website that suppresses PHP headers may be patched or unpatched; the tool cannot decide from the missing information. Equally, an OK result reflects a version comparison, rather than independent verification that the security fix is present. The project explicitly warns against treating an unknown result as evidence of protection.
Server Packages Can Complicate a Simple Version Check
The server skill directs the agent to compare the running version and full package revision with current PHP or vendor advisories. A Linux distribution or long-term-support provider may backport a fix while retaining an older upstream version number. A bare version string can therefore suggest vulnerability even when the relevant vendor package has been patched.
This is where the skill adds value around a small script: it gives the agent a workflow for checking evidence, identifying uncertainty and explaining the required update. OpenAI’s skills documentation describes these packages as reusable instructions and supporting resources. In this case, both packaged workflows prohibit exploit probes, and the checker itself does not install security updates.
The Follow-Up Is Still Patching
PHP’s security advisory identifies PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as fixed upstream releases for the two critical vulnerabilities. It also provides minimal source backports for selected unsupported branches, alongside the separate fixes some vendors supply. Operators need to verify which remedy applies to their actual deployment.
For website owners, the checker can turn a broad security alert into a more specific question for their host: which PHP build is running, and has the relevant fix been applied? That makes it a practical triage aid. A confirmed patched runtime and the latest maintainer or vendor guidance remain the basis for deciding whether remediation is complete.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
