OpenAI Shares a PHP Version Checker and Codex Skills
OpenAI has published a PHP Version Checker repository with Codex skills for identifying PHP versions that may need security updates. The checker reads version information exposed by a website or local PHP installation and compares it with embedded cutoffs. It is a triage aid, not proof that a system is patched or secure.
OpenAI has published a PHP Version Checker repository with Codex skills intended to help operators identify PHP versions that may need security updates (PHP Version Checker repository). The repository is part of OpenAI's Patch the Planet work on critical PHP vulnerabilities, which OpenAI says involved PHP maintainers, security researchers, security providers, and infrastructure partners including Wiz and Cloudflare (OpenAI's Patch the Planet announcement).
The README lists phpcheck-url for operators who only have a URL and phpcheck-server for those with server access. It describes the checker as reading version information exposed by a website or local PHP installation without sending exploit requests (PHP Version Checker repository).
What the checker can tell an operator
The tool compares version information it can see with embedded cutoffs for PHP branches. OK means a stable patch version above the cutoff for a listed branch; VULNERABLE means the version is at or below that branch's cutoff. UNKNOWN can mean no PHP version or response was found, a version or branch was unrecognized, or the build was a newer prerelease. The repository says its cutoffs are dated October 20, 2026 and assume subsequent stable patches in each listed branch contain the fix (PHP Version Checker repository).
The URL mode uses the Server and X-Powered-By response headers to identify PHP versions; it does not follow redirects or inspect response bodies. A server may hide or alter those headers, and distribution maintainers can backport security fixes without changing the upstream version string. For server checks, the Codex skill advises verifying that the local CLI version matches the PHP-FPM or Apache installation serving the site. These limits mean the checker does not independently verify that a security fix is installed. OpenAI says operators should use PHP’s and their providers’ guidance to determine which updates apply (OpenAI's Patch the Planet announcement, PHP Version Checker repository, phpcheck-server skill).
A version check, not a security audit
The release is useful as a lightweight way to decide whether a PHP version needs closer review, especially when an operator is unsure what a website exposes. It should not be treated as a complete vulnerability scan, proof that a system is secure, or a substitute for applying and verifying updates through the PHP release guidance and the hosting provider. The repository recommends checking its embedded cutoffs against official PHP security releases as fixed versions are published (PHP Version Checker repository).
Sources
Frequently Asked Questions
What did OpenAI release?
OpenAI published the PHP Version Checker repository, which includes Codex skills for checking PHP versions that may need security updates. The repository describes the tool as a version-checking aid, not a patching tool.
How does the PHP Version Checker work?
The repository says the checker reads PHP version information exposed in HTTP response headers for a website or reported by a local PHP installation, then compares it with embedded cutoffs. The URL check does not send exploit requests.
Does an UNKNOWN result mean a site is safe?
No. The repository says UNKNOWN can mean that no PHP version or response was found, a version or branch was unrecognized, or the build was a newer prerelease. UNKNOWN does not mean a site is patched, and the checker does not independently verify whether a security fix is installed.
Get an email when Codex changes its plans, prices or limits
We check every change against Codex's own pages before we send. You also get the weekly AI Catchup; one click unsubscribes.