Check your site for PHP2Shell with Claude Code, Codex or Cursor

Why use an AI agent for this?

The hard part of PHP2Shell isn’t running a command — it’s knowing which PHP serves your site, what the result means for your setup, and which commands fix it. A coding agent that can use your terminal can do all three: run the check where your code lives, read your server configuration, and walk you through the patch step by step.

Our open-source checker gives the agent a reliable, read-only signal to work from. It only reads the PHP version your server already advertises, or runs php -v on a binary you point it at. It never sends attack traffic, and nothing is reported back to us.

Claude Code

Paste this into Claude Code (swap in your domain):

Run npx php2shell-checker@latest https://your-site.com and tell me whether my PHP is vulnerable to PHP2Shell and what to do next.

If you’re connected to the server itself (over SSH or in a Claude Code session on that machine), ask it to check the runtime that actually serves the site:

Find the PHP-FPM or Apache PHP binary that serves this site, run npx php2shell-checker@latest --local --php <that binary>, and explain the result. If it's vulnerable, show me the exact upgrade and restart commands for this OS before running anything.

Want it available in every project? Install the two skills from our repository into your personal skills folder:

git clone --depth 1 https://github.com/shayanabbas/php2shell-checker /tmp/php2shell-checker
mkdir -p ~/.claude/skills
cp -r /tmp/php2shell-checker/skills/* ~/.claude/skills/

Then simply ask: “Use the php2shell-url skill to check https://your-site.com.”

Codex

Install both skills once, then run a check:

$skill-installer install both skills from https://github.com/shayanabbas/php2shell-checker
$php2shell-url check https://your-site.com

On the server, use the server skill instead:

$php2shell-server check the PHP version serving my site

Cursor, Windsurf, Copilot agent mode and others

Any agent that can run terminal commands can use the checker. Paste:

Run `npx php2shell-checker@latest https://your-site.com` in the terminal and tell me if I need to patch PHP. If the result is UNKNOWN, explain how to check the PHP version on the server instead.

Reading the result

Output	Exit code	What it means
OK: PHP 8.3.36	0	The reported version includes the fix. Make sure it’s the web runtime and that PHP was restarted.
VULNERABLE: PHP 8.3.31	1	Upgrade PHP — see the patch guides. On distro packages, check the changelog first.
UNKNOWN: No PHP version advertised	3	The server hides its version. This is not “safe” — run the check on the server with --local.

Useful follow-up prompts

After patching, ask your agent to verify:

Check that PHP-FPM was restarted after the PHP upgrade, then run npx php2shell-checker@latest --local --php <php-fpm binary> again and confirm the result is OK.

And to review for compromise:

Using the checks at https://php2shell-checker.com/was-i-compromised/, review this server's logs and web root for signs of PHP2Shell exploitation since 2026-10-17. Only read files and logs — don't change or delete anything — and summarise what you find.

Stay safe when agents run commands

• Read before you approve. Let the agent propose upgrade and restart commands, and approve them one by one.
• Only check sites you own or are authorised to assess.
• Keep secrets out of the chat. Don’t paste .env files, private keys or database passwords into a prompt.

Prefer the plain command line? See the CLI reference.