OpenAI releases a Codex skill to check if your PHP is vulnerable to php2shell
OpenAI packaged a PHP version-checking tool as a Codex skill after its Patch the Planet team helped disclose the php2shell PHP flaws. Website operators can point Codex at the repo to check whether they are vulnerable.
What happened
On October 21, 2026, OpenAI announced on X that it had packaged a Codex skill to help website operators check whether their sites are affected by the critical PHP vulnerabilities disclosed this week. The tool walks users through identifying vulnerable PHP versions and determining which security updates to apply, following guidance from PHP developers and their service providers.
"If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it." - OpenAI (@OpenAI), October 21, 2026.
The flaws, dubbed "php2shell", were surfaced by OpenAI researcher Calif under the Patch the Planet initiative: a version spotted in August by GPT-5.6 Sol and a fuller version found by the OpenAI team in September, alongside an independent discovery by Wiz. OpenAI spent two months working with PHP developers, security researchers, Wiz, and Cloudflare before disclosure.
Why it matters
PHP powers a large share of websites, and these flaws can give attackers a path to server file systems and databases. The NSA's cyber division urged organizations to patch, or take systems offline until they can if immediate patching is not feasible, and Cloudflare has since observed millions of exploit attempts against the disclosed flaws. Shipping the check tool as a Codex skill is also a milestone: OpenAI is distributing incident-response tooling through its own agent platform, not just a download page.
Verified Oct 22, 2026.
Sources
Get updates like this every morning
- ② Card on Stripe
- ③ 7 days free
Then $2/month · cancel anytime in one click