{"name":"php2shell-checker: Check PHP Versions for php2shell Exposure","description":"A JavaScript CLI that checks a website’s exposed PHP version or a local PHP binary against embedded php2shell cutoffs. It helps operators identify versions that may be vulnerable, while treating missing or unclear version data as unknown rather than safe.","github":"https://github.com/openai/php2shell-checker","url":"https://osrepos.com/repo/openai-php2shell-checker","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/openai-php2shell-checker","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/openai-php2shell-checker.md","json":"https://osrepos.com/repo/openai-php2shell-checker.json","topics":["javascript","cli","security","security-tools","php-version-checker","php-security"],"keywords":["javascript","cli","security","security-tools","php-version-checker","php-security"],"stars":null,"summary":"A JavaScript CLI that checks a website’s exposed PHP version or a local PHP binary against embedded php2shell cutoffs. It helps operators identify versions that may be vulnerable, while treating missing or unclear version data as unknown rather than safe.","content":"## Overview\n\n`php2shell-checker` is a JavaScript command-line tool for checking whether a website or local PHP binary reports a version at or below an embedded cutoff for a listed PHP branch. It is aimed at site operators and developers who need a quick version-based signal about possible php2shell exposure.\n\nFor websites, it checks the `X-Powered-By` and `Server` response headers, using `HEAD` and falling back to `GET` for specific unsupported-method responses. It does not inspect page bodies or follow redirects, so it cannot assess targets that do not expose a usable PHP version.\n\n## Key Features\n- Check a website URL or the local CLI PHP binary.\n- Classify results as `OK`, `VULNERABLE`, or `UNKNOWN`, with distinct exit codes.\n- Emit machine-readable JSON with `--json`.\n- Use HTTP response headers to identify the reported PHP version.\n- Fall back from `HEAD` to `GET` when the server returns 405 or 501.\n- Test the CLI with local HTTP servers and a fake PHP executable, without requiring an external website or PHP installation.\n\n## Use Cases\n- A site operator can check whether their web server exposes a PHP version at or below the tool’s cutoff.\n- A developer can check the PHP version installed in a local environment before deployment.\n- An operations team can use JSON output and exit codes in a script to flag vulnerable or unresolved checks.\n- A security reviewer can use the result as an initial version check, then verify the relevant release against official PHP security information.\n\n## Our Take\nThis is a narrowly scoped, actively changing version checker that can be useful for triage, but its one-contributor development and lack of releases call for caution when relying on its embedded cutoffs.\n\n**Good fit if:**\n- You need a quick CLI check of a reported PHP version from a URL or local binary.\n- You can treat `UNKNOWN` as unresolved and independently verify findings against official PHP security releases.\n- You are comfortable evaluating a very new project whose work is concentrated in one contributor.\n\n**Look elsewhere if:**\n- You need confirmation that a security fix is present, rather than a comparison against an embedded version cutoff.\n- Your target hides PHP headers, redirects to another location, or requires response-body inspection.\n- Your adoption process requires established releases or a broader contributor base.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **New**: less than six months old |\n| Last commit | 2026-10-21 (1 day ago) |\n| Commits, last 90 days | 7 |\n| Releases, last 12 months | 0 |\n| Contributors | 1 |\n| Issues closed, last 90 days | 1 |\n| Pull requests merged, last 90 days | 4 (typically merged in 0 days) |\n| Project age | 1 days |\n\nChecked on 2026-10-22 with the GitHub API.\n\n## Project Facts\n\n- Language: JavaScript\n- License: Apache-2.0\n- Stars: 791\n- Forks: 80\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- JavaScript (main language on GitHub)\n\n## Getting Started\nRun a check against a website:\n\n```sh\nnode phpcheck.js \"https://example.com\"\n```\n\nFor local PHP, use `node phpcheck.js --local`. See the [README](https://github.com/openai/php2shell-checker) for skill installation, output details, and tests.\n\n## License in Plain Words\n\n**Apache-2.0** (permissive).\n\n- Commercial use: yes\n- Modify and redistribute: yes\n- You must keep: the license, the NOTICE file and a note of your changes\n- Share your changes: no\n- Includes an explicit patent grant from the contributors\n\nA summary, not legal advice: the LICENSE file is what applies.\n\n## Considerations\nThe project is very new, with recent commits and merged pull requests but no releases in the past year; all measured contributor activity is concentrated in one person. Only one issue was closed in the recent measurement period, so there is little issue-handling history to assess. The checker does not independently verify fixes, and its `OK` result assumes subsequent stable patches in a listed branch contain the fix. Hidden or altered headers, distribution backports, unrecognized branches, and prerelease versions can produce misleading or unknown results. The repository also states that external code contributions are not accepted, though bug reports and non-code feedback are welcome through GitHub issues.","metrics":{"detailViews":6,"githubClicks":2},"dates":{"published":null,"modified":"2026-10-22T20:50:27.000Z"}}