HeyHomees Lab Notes · No. 7 · OpenAI · Published October 22, 2026
By HeyHomees Newsroom ·
In 30 seconds
- Runs against a URL or local PHP binary to detect vulnerable versions
- Outputs OK, VULNERABLE, or UNKNOWN with corresponding exit codes
- Can emit JSON with patch_status field via --json
What is it?
php2shell-checker is a command-line tool that checks a website or a local PHP binary to see if it is vulnerable to php2shell. It can be run as phpcheck-server for server access or phpcheck-url when only a URL is available.
How does it work?
The checker reads PHP version information from HTTP response headers (X-Powered-By, Server) or from the output of php -v. It sends a HEAD request and falls back to GET only when HEAD returns 405 or 501, without following redirects or inspecting bodies.
What does it need to run?
It requires a PHP binary to query (local CLI) or network access to a web server that returns version headers. No external PHP installation is needed for the test suite, which uses local HTTP servers and a fake PHP executable.
By the numbers
- OK exit code: 0
- VULNERABLE exit code: 1
- UNKNOWN exit code: 3
The honest read
The exit codes (0, 1, 3) indicate how the tool classifies a version but they are self-reported by OpenAI and do not constitute an independent security verification. The checker only looks at version strings in headers or php -v output; hidden, altered, or back-ported versions may be reported as UNKNOWN even if patched.
What we don't know yet
- Exact detection accuracy on non-standard server configurations
- Support for newer PHP prerelease versions beyond those embedded
Sources
- README, GitHub (primary)
Researched and drafted with AI from the sources above; every figure is checked against them by code before it is published, and a line that fails is dropped.