Two critical PHP vulnerabilities have pushed administrators and organizations in several countries to review servers and apply updates urgently. Some sites have gone offline temporarily during remediation or protection checks. OpenAI has released a Codex checker for the initial version check.

terminal
skill-installer install both skills from https://github.com/openai/php2shell-checker
phpcheck-url check https://expasy.org/

Use it in the desktop ChatGPT app by selecting Codex from the selector at the top. A public URL needs no PHP project or server access. The two skills come from OpenAI’s official GitHub repository, openai/php2shell-checker. Codex identifies phpcheck-url and phpcheck-server, then asks for permission to access the Internet and write files in its skills directory. The installation adds instructions and a small script, not PHP itself or a large application.

phpcheck-url is for public websites. The example used Expasy.org as the test site. The checker first sends a HEAD request. If the server rejects that method, it can use GET instead. It reads public response headers such as Server and X-Powered-By, without downloading or analyzing the page content. It does not send exploit requests.

The Expasy.org test returned UNKNOWN. That means the site did not expose an identifiable PHP version. It does not prove that the site is vulnerable or protected. VULNERABLE means the detected version falls within the checker’s affected range. OK means the version is above its threshold. UNKNOWN means there is not enough information to classify the site. None of these outcomes replaces a complete audit, and even OK relies on the version declared publicly by the server.

With server access, phpcheck-server first checks the local PHP version and then compares it with the PHP-FPM or Apache installation actually serving the website. This provides stronger evidence than an external header check. OpenAI still recommends reviewing the installed package and vendor advisories because distributions may backport security fixes without changing the main version number. The checker is an initial guide, not proof that a site has or has not been compromised.