Is your PHP site affected? Point Codex at OpenAI's free checker skill before you upgrade

#What changed

Alongside its PHP critical-flaw disclosure, OpenAI posted a Codex skill package that checks whether a site is running a vulnerable PHP version. The repo openai/php2shell-checker contains two skills: phpcheck-server, for when you have server access (it reads php -v), and phpcheck-url, for when you only have a URL (it reads the X-Powered-By and Server response headers with a HEAD request). It sends no exploit requests and needs only Node.js. Install both by asking Codex: $skill-installer install both skills from https://github.com/openai/php2shell-checker, then run $phpcheck-server check the PHP version serving my site or $phpcheck-url check example.com. You can also run node phpcheck.js "https://example.com" or node phpcheck.js --local directly.

#Who is affected

Anyone running or maintaining a PHP site, including WordPress and other PHP-based hosting, who wants a quick first check from inside Codex.

#What to do now

Run phpcheck-server if you have shell access, since headers are often hidden. Read the result: OK means the version is above the embedded October 20, 2026 cutoff for its branch, VULNERABLE means at or below it, and UNKNOWN means no version could be read. Treat UNKNOWN as not yet checked, not as safe. If you are VULNERABLE or unsure, upgrade to the fixed releases listed in our earlier PHP update (8.5.12, 8.4.27, 8.3.36, 8.2.35).

#What is not confirmed

The checker only compares version numbers; it does not verify that a fix is actually present. Linux distributions often backport security fixes without changing the upstream version string, so a VULNERABLE result on a distro package may be a false alarm, and headers can be hidden or faked. Confirm against the official PHP security advisory.