Free tool · command line · MIT
The php2shell check CLI: the same outside check, in your terminal and your CI
The php2shell check CLI is an open-source command-line tool (MIT) that asks one question: do the October 2026 PHP and Node.js flaws apply to my site? It reads only what your site shows anyone, makes at most 8 requests, and shows the evidence for every finding.
php2shell check CLI is a free command-line check for php2shell (CVE-2026-109618 and CVE-2026-109619, the October 2026 PHP remote code execution flaws) and the Node.js October 2026 security releases. It is one Python file, standard library only, for Python 3.9 or newer, under the MIT licence, with a GitHub Action that can fail a build. It is derived from Skald's public site check.
MIT licence · one Python file · standard library only · Python 3.9+
$ curl -sSL https://raw.githubusercontent.com/spcaeo/php2shell-check/main/php2shell_check.py | python3 - example.com
Replace example.com with your site. Nothing to install: Python 3.9 or newer runs it.
[01] run it
Three ways to run the php2shell check CLI
The same check every way. Pick the one that suits you. pick one
$ curl -sSL https://raw.githubusercontent.com/spcaeo/php2shell-check/main/php2shell_check.py | python3 - example.com$ python3 php2shell_check.py example.com$ pipx run --spec git+https://github.com/spcaeo/php2shell-check php2shell-check example.comAdd --json for the answer as JSON, or --write-markdown FILE for a report to share.
[02] what you will see
Every finding comes with its evidence
The exact header line, tag or cookie name it read, the address, and a curl command that shows the same thing. Versions come only from what the server sent.
UPDATE NEEDED
The server sent a PHP or Node.js version older than the fixed release of its branch, or a branch with no official fix.
CHECK
PHP or Node.js runs your site, but the server hides its version. Only php -v or node -v on the server can say.
LOGIN OPEN
/wp-login.php ends in WordPress's login form, open to anyone.
COULD NOT CHECK
Something could not be read: a bot challenge, an error, the request limit. Nothing is guessed.
Also TIP (a version shown, XML-RPC on, missing security headers, a certificate ending within 14 days), INFO, and GOOD or FIXED.
[03] in your CI
Check every day and after each deploy, with the GitHub Action
The Action runs the same check and writes a job summary of the findings. It can fail the step.
- Inputs: url (required), fail-on (default update_needed), json-output, python-version (default 3.12).
- Outputs: exit-code, summary and json-file.
- Exit codes: 0 clean, 1 findings at or above --fail-on, 2 could not check.
name: php2shell-check
on:
schedule:
- cron: "17 6 * * *"
deployment_status:
workflow_dispatch:
permissions:
contents: read
jobs:
check:
if: github.event_name != 'deployment_status' || github.event.deployment_status.state == 'success'
runs-on: ubuntu-latest
steps:
- uses: spcaeo/php2shell-check@v1
with:
url: https://www.example.com/
fail-on: update_needed
json-output: php2shell-check.jsonReplace the url with your site. A site that could not be checked fails the step; add continue-on-error: true if you would rather it did not.
[04] safe to run anywhere
It reads what anyone can see, and nothing more
People run it in CI with internal DNS, so it keeps the same address rules as the web check.
Public sites only
http and https on ports 80 and 443. Never an IP address in any form, never a name that only works inside a network.
Pinned
It resolves the name, refuses it whole if any address is private, and connects to the very address it checked.
No secrets asked
No cookie, no credentials. It never asks for .env, .git or a backup, and never lists users.
[05] from outside, and from your log
The CLI shows what anyone can see. Your log shows who looked.
The check reads your site from outside. Skald reads your server log every day: who probed, for what, what your server answered, and which advisories apply to your stack.
What it cannot see
- Inside your server. It does not test for the flaw.
- A hidden version. The flaw works either way: only php -v on the server can say.
- A PHP app on a path or host the home page does not link to.
- Your server's own headers, when a CDN hides them.
keep reading
More on php2shell check CLI
questions
php2shell check CLI FAQ
Straight answers, including what Skald does not do.
What is php2shell?
The name Cloudflare gives CVE-2026-109618 and CVE-2026-109619, the PHP flaws fixed on 21 October 2026 that let anyone on the internet run code on a server without signing in. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older get no official fix. php2shell: what happened, what to do.
Does it attack my site?
No. It never sends an attack, a form or a password, and never asks for a secret file such as .env or .git. It makes GET and HEAD requests only, at most 8, and lists every one in the result.
Why does it say could not check?
Something answered instead of your site, such as a bot challenge or protection service like Cloudflare or Sucuri, or an error. It never guesses. It shows what it saw and the commands to run instead: from a machine that is let through, or php -v on the server.
Can I run it in CI?
Yes. Use --fail-on to exit 1 at or above a level, or the GitHub Action spcaeo/php2shell-check@v1, which writes a job summary. Exit code 2 means the site could not be checked.
Will it check a site on my own network?
Not by default: it refuses IP addresses and names that only work inside a network, and pins the address it checked. --allow-private lifts that for your own internal site.
Is Skald itself MIT too?
No. The CLI is MIT. Skald is source-available under the Elastic License 2.0, free to self-host.
$ tail -f access.log | skald
See what AI does with your site. Free for 30 days.
No card. We set up hosted Skald for you within one working day, or you self-host it free. Every line of your log, sorted and added up.