OpenAI releases a tool to check whether a website uses a PHP version affected by two critical vulnerabilities
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
OpenAI has made two Codex skills available to anyone that tell whether a site is running a PHP release with the two critical flaws its maintainers have just fixed. The checker works from the site's address or with access to the machine, and it does not attack: it only compares versions. The answers have limits, because an OK does not guarantee the fix and an UNKNOWN does not mean the site is safe.
On Wednesday, October 21, OpenAI released a checker to find out whether a website runs on a PHP version affected by two critical vulnerabilities, which its GitHub repository calls php2shell.
PHP is an open-source programming language that many websites and web applications rely on. OpenAI says that over the past two months it has led the response to these flaws together with PHP's maintainers, researchers and security companies. Calif found one of them with GPT-5.6 Sol, an OpenAI model, as part of the Patch the Planet initiative, and Wiz detected and reported both separately. The fixes were prepared and released by PHP's own maintainers, with help from Wiz, Cloudflare and other companies. OpenAI places the case among the highest-impact security problems of recent times and says that, as far as it knows, AI came across the flaws before attackers did.
The checker is made up of two skills for Codex, OpenAI's coding agent: a set of instructions and a small script the agent can reuse. According to Xataka, which has tried it, Codex is selected inside the ChatGPT desktop app, and installing the skills asks for permission to connect to the internet and save files. The first, phpcheck-url, is meant for cases where only the website's address is known: it looks at the Server and X-Powered-By headers sent back by the server, where some sites state their PHP version, without following redirects or reading the page content. The second, phpcheck-server, is meant for cases with access to the machine: it starts from the installed version and asks the user to confirm that it matches the one actually serving the site. Neither tries to exploit the flaw; they just compare the version with the affected ranges, which run from PHP 5.4 to 8.5, and answer VULNERABLE, OK or UNKNOWN. The script can also be run outside Codex with Node.js, and the code is open source under the Apache 2.0 license.
OpenAI warns that an OK only means the version is later than the affected ones, not that the fix has been verified, and that UNKNOWN, the result when the site does not show its version, does not mean it is protected. Headers can be concealed or altered, and some distributions apply the fix without touching the version number, so with server access it recommends also comparing the installed package with the security notices from PHP or the provider. In Xataka's test on a public website, the result was UNKNOWN.
OpenAI has also brought in several parts of the US government, CISA among them, so that the guidance reaches critical organizations, and the Patch the Planet website points to the official update instructions from PHP's maintainers. The company expects similar discoveries to grow strongly over the coming months.
Why it matters · analysis and opinion
An AI finding serious flaws in such a widespread language moves the problem elsewhere: the hard part is no longer so much discovering them as getting the fixes in time to servers that nobody checks very often. OpenAI expects more findings of this kind, and pairing the disclosure with a tool that anyone can use without being an expert is a way of sharing that load. Its merit lies in quickly answering the first question, whether a site is exposed, even though it only sees what the server lets it see. Updating still depends on whoever maintains each installation, and there organizations with their own technical team start ahead of those that hand everything to a provider. If disclosures of this size become frequent, knowing who is in charge of patching each website will stop being a minor detail.
Official source: OpenAI · Written with the help of AI: how we make the news
What does it mean for your business? · analysis and opinion
This tool matters to any small business, freelancer or small company in Spain or Latin America whose website runs on PHP, whether they maintain it themselves or rely on a hosting provider or an agency. Those without their own website, or with a website built on technology that does not use PHP, are not affected.
In practice, phpcheck-url is useful as a first indication when all you know is the address of the website, but the result needs to be read carefully: UNKNOWN means the page does not show its PHP version, not that it is safe, and an OK relies on what the server declares publicly. With access to the server, phpcheck-server provides a more reliable check. Our advice is to also ask the provider, or whoever manages the website, to confirm in writing which PHP package is installed and whether its security advisories have been applied, because some distributions fix the flaw without changing the main version number.
The main risk is a false sense of security from a result that only compares versions. Permissions also deserve attention: when installing the skills, Codex asks to connect to the internet and to write files to its folder, so the prudent approach is to review each action before accepting it and to use the tool only on your own websites or with the owner's permission.
