1.4K ·GitHub
What is this?
A command-line tool (plus matching Codex skills) that checks whether a PHP website or a local PHP binary is running a version vulnerable to php2shell, based on reported version numbers.
A command-line tool (plus matching Codex skills) that checks whether a PHP website or a local PHP binary is running a version vulnerable to php2shell, based on reported version numbers.Is this a standalone CLI or does it need Codex?It works both ways: you can run the CLI directly, or install it as two Codex skills, phpcheck-server for when you have server access and phpcheck-url for when you only have a URL.
It works both ways: you can run the CLI directly, or install it as two Codex skills, phpcheck-server for when you have server access and phpcheck-url for when you only have a URL.How do I check a site or a local PHP binary?Run the CLI against a website URL or against the local php executable; add --json to get machine-readable output instead of plain text.
Run the CLI against a website URL or against the local php executable; add --json to get machine-readable output instead of plain text.Do I need a real PHP install to try it?No, the test suite runs entirely against local fake HTTP servers and a fake PHP executable, so no PHP installation or external website is needed just to try the checker.
No, the test suite runs entirely against local fake HTTP servers and a fake PHP executable, so no PHP installation or external website is needed just to try the checker.How reliable is the VULNERABLE or OK verdict?It only reads the version from HTTP response headers (X-Powered-By, Server) or 'php -v' output, never follows redirects or checks response bodies, and an OK result just assumes later patches in that branch include the fix rather than confirming it.
It only reads the version from HTTP response headers (X-Powered-By, Server) or 'php -v' output, never follows redirects or checks response bodies, and an OK result just assumes later patches in that branch include the fix rather than confirming it.What do the OK, VULNERABLE and UNKNOWN results actually mean?OK (exit 0) means the detected PHP patch is above the embedded cutoff for its branch; VULNERABLE (exit 1) means it's at or below the cutoff; UNKNOWN (exit 3) means no usable version was found, such as a hidden header or unrecognized branch.
OK (exit 0) means the detected PHP patch is above the embedded cutoff for its branch; VULNERABLE (exit 1) means it's at or below the cutoff; UNKNOWN (exit 3) means no usable version was found, such as a hidden header or unrecognized branch.Does an UNKNOWN result mean the target is safe?No. The README explicitly warns that UNKNOWN does not mean the target is patched - it just means the checker couldn't determine the version.
No. The README explicitly warns that UNKNOWN does not mean the target is patched - it just means the checker couldn't determine the version.Could a server hide or spoof its real PHP version from this checker?Yes - the tool relies on headers like X-Powered-By and Server, or php -v, and the README notes these can be hidden, changed, or affected by distro backports that don't update the reported version.
Yes - the tool relies on headers like X-Powered-By and Server, or php -v, and the README notes these can be hidden, changed, or affected by distro backports that don't update the reported version.What are similar projects?SolidityScanLegend, dingtalk-workspace-cli, reelbench-skills, codex-security, php2shell-scanner, miller, cve-lite-cli, cf
SolidityScanLegend, dingtalk-workspace-cli, reelbench-skills, codex-security, php2shell-scanner, miller, cve-lite-cli, cfWhich topics is it in?php-security, vulnerability-scanner, codex-skill, php, cli-tool, json, skill, security-tools, testing, command-line, agent-skills, command-line-tool
php-security, vulnerability-scanner, codex-skill, php, cli-tool, json, skill, security-tools, testing, command-line, agent-skills, command-line-tool