Check the PHP version a website advertises in its HTTP headers and report whether it is patched against PHP2Shell (October 2026 PHP security releases). Use when the user gives a URL or hostname and asks if it is vulnerable, patched or up to date.
Installs into .claude/skills of the current project.
Are you the author of Url?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/masteread-url)
---
name: url
description: Check the PHP version a website advertises in its HTTP headers and report whether it is patched against PHP2Shell (October 2026 PHP security releases). Use when the user gives a URL or hostname and asks if it is vulnerable, patched or up to date.
argument-hint: "<url-or-hostname>"
allowed-tools: Bash(node --version) Bash(node ${CLAUDE_SKILL_DIR}/scripts/phpcheck.js *)
---
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, the two critical
remote code execution vulnerabilities fixed in PHP 8.5.12, 8.4.27, 8.3.36 and
8.2.35 on October 21, 2026 (https://www.php.net/archive/2026.php#2026-10-21-5).
PHP 8.1 and older received no upstream release.
First run `node --version`. The checker connects to servers you do not control,
and the Node.js October 21, 2026 security releases fixed a Brotli decoder
remote code execution and TLS hostname bypasses
(https://nodejs.org/en/blog/vulnerability/october-2026-security-releases).
If Node is older than 22.23.4 on 22.x, 24.22.1 on 24.x or 26.12.1 on 26.x, or
on an end-of-life line, tell the user to update Node and ask before
continuing.
Then run the bundled checker against the target. Use HTTPS for a bare hostname:
```sh
node ${CLAUDE_SKILL_DIR}/scripts/phpcheck.js "https://example.com" --json
```
Target: $ARGUMENTS
If no target was given, ask the user for one. Check only sites the user owns
or is authorized to assess.
The checker sends one `HEAD` request (or a `GET` if `HEAD` returns 405 or 501)
and reads the `Server` and `X-Powered-By` headers. It does not follow
redirects. If the site redirects, such as from `http://` to `https://` or to
`www.`, offer to check the final URL.
Run the command exactly as shown, as a single command. Do not chain `echo`,
pipes or other commands onto it: the JSON output already includes
`exit_code`, and a modified command is no longer pre-approved.
If the checker prints a Node.js warning on stderr, pass it on to the user.
Exit codes 1 and 3 mean vulnerable and unknown. They are results, not
execution failures. Exit code 2 means invalid arguments.
Report the PHP version, the patch status, and the update needed:
- `vulnerable`: the version is at or below the cutoff for its branch. Recommend
updating to a newer patch release of that branch or a supported branch.
- `ok`: the version is newer than the cutoff. Headers can be changed, so a
server-side check (`/phpcheck:server`) is stronger evidence.
- `unknown`: the version is hidden, the branch is not listed, or it is a
prerelease. `unknown` does not mean patched. Suggest `/phpcheck:server` if
the user has server access.
Vendor backports (Debian, Ubuntu, RHEL and others) may fix an older upstream
version, so a `vulnerable` result on a distribution build should be confirmed
against that vendor's advisory.
Do not run exploit probes or send any other requests to the target.
