php2shell (CVE-2026-109618 / CVE-2026-109619) landed with PHP's October 21 security releases, and GitHub filled up with it within days — by GitHub's own search, at least three exploit-PoC repos created this week are already over 1,300 stars each. OpenAI's contribution to the pile is the opposite of a PoC: openai/php2shell-checker , a defensive tool that tells you whether a site is running a vulnerable PHP — by reading its version banner.

It's 99 lines of Node. It sends no exploit probes. And when I pointed it at 65 real websites, it returned the same answer 65 times: UNKNOWN . The checker is correct about everything it can see. The problem is what websites stopped showing it a decade ago.

What the checker actually does

The real logic lives in skills/phpcheck-url/scripts/phpcheck.js (the top-level phpcheck.js is a 2-line shim).…