openai

php2shell-checker: Check PHP Versions for php2shell Exposure

A JavaScript CLI that checks a website’s exposed PHP version or a local PHP binary against embedded php2shell cutoffs. It helps operators identify versions that may be vulnerable, while treating missing or unclear version data as unknown rather than safe.

NewJavaScriptApache-2.0CLISecuritySecurity Tools
View on GitHub Compare
Stars
791
Forks
80
Last commit
1 day ago
Contributors
1
Releases, 12 months
0

Our take

Newless than six months old

Health score

36/100

How it is scored
Activity
33
Community
4
Issues
47
Pull requests
61
  • Fewer contributors than 91% of the projects we track

This is a narrowly scoped, actively changing version checker that can be useful for triage, but its one-contributor development and lack of releases call for caution when relying on its embedded cutoffs.

Good fit if

  • You need a quick CLI check of a reported PHP version from a URL or local binary.
  • You can treat UNKNOWN as unresolved and independently verify findings against official PHP security releases.
  • You are comfortable evaluating a very new project whose work is concentrated in one contributor.

Look elsewhere if

  • You need confirmation that a security fix is present, rather than a comparison against an embedded version cutoff.
  • Your target hides PHP headers, redirects to another location, or requires response-body inspection.
  • Your adoption process requires established releases or a broader contributor base.
All health signals
Last commit2026-10-21 (1 day ago)
Commits, last 90 days7
Releases, last 12 months0
Contributors1
Issues closed, last 90 days1
Pull requests merged, last 90 days4 (typically merged in 0 days)
Project age1 days

Checked on 2026-10-22 with the GitHub API.

Overview

php2shell-checker is a JavaScript command-line tool for checking whether a website or local PHP binary reports a version at or below an embedded cutoff for a listed PHP branch. It is aimed at site operators and developers who need a quick version-based signal about possible php2shell exposure.

For websites, it checks the X-Powered-By and Server response headers, using HEAD and falling back to GET for specific unsupported-method responses. It does not inspect page bodies or follow redirects, so it cannot assess targets that do not expose a usable PHP version.

Key Features

  • Check a website URL or the local CLI PHP binary.
  • Classify results as OK, VULNERABLE, or UNKNOWN, with distinct exit codes.
  • Emit machine-readable JSON with --json.
  • Use HTTP response headers to identify the reported PHP version.
  • Fall back from HEAD to GET when the server returns 405 or 501.
  • Test the CLI with local HTTP servers and a fake PHP executable, without requiring an external website or PHP installation.

Use Cases

  • A site operator can check whether their web server exposes a PHP version at or below the tool’s cutoff.
  • A developer can check the PHP version installed in a local environment before deployment.
  • An operations team can use JSON output and exit codes in a script to flag vulnerable or unresolved checks.
  • A security reviewer can use the result as an initial version check, then verify the relevant release against official PHP security information.

What you need

Detected in the repository

  • JavaScript (main language on GitHub)

License in plain words

Apache-2.0permissive

  • Commercial use: yes
  • Modify and redistribute: yes
  • You must keep: the license, the NOTICE file and a note of your changes
  • Share your changes: no
  • Includes an explicit patent grant from the contributors:

A summary, not legal advice: the LICENSE file is what applies.

Getting Started

Run a check against a website:

node phpcheck.js "https://example.com"

For local PHP, use node phpcheck.js --local. See the README for skill installation, output details, and tests.

Considerations

The project is very new, with recent commits and merged pull requests but no releases in the past year; all measured contributor activity is concentrated in one person. Only one issue was closed in the recent measurement period, so there is little issue-handling history to assess. The checker does not independently verify fixes, and its OK result assumes subsequent stable patches in a listed branch contain the fix. Hidden or altered headers, distribution backports, unrecognized branches, and prerelease versions can produce misleading or unknown results. The repository also states that external code contributions are not accepted, though bug reports and non-code feedback are welcome through GitHub issues.

Found this useful?

Share it with someone who would like php2shell-checker.