Find hosts advertising a vulnerable PHP version with an AI-assisted scanner
Two coworkers and AI built Php2ShellCheck, an asynchronous header inspection tool that fingerprints PHP and compares it with the PHP2Shell fixed releases.
Source
ShredOnArrival on Hacker News · 2026-10-22 · Project link
Written in our own words. Credit to the original author. Link checked 2026-10-23.
What they did
Two coworkers and AI built Php2ShellCheck, an asynchronous header inspection tool that fingerprints PHP and compares it with the PHP2Shell fixed releases.
Result (as claimed)
It quickly finds hosts in your environment that advertise a vulnerable version, though the author notes it is not foolproof.
Tools they used
Cost: Pricing depends on the tools you pick; check each official pricing page.
Set it up
Pick a contained repo or task
Start on a branch or side project where mistakes are cheap.
Install and configure
Set up Python. Read what it can run on your machine and limit permissions where possible.
Run it on a real task
Give it a well-scoped issue and let it work. Review the diff like any pull request.
Add guardrails
Keep tests and CI in the loop, and never let an agent push to main or touch production secrets unattended.
Copy the full setup prompt
Paste into your agent and it will walk you through the setup, asking before anything that sends, posts or spends.
You are helping me set up this AI use case end to end in Claude Code. Goal: Find hosts advertising a vulnerable PHP version with an AI-assisted scanner What the original author did: Two coworkers and AI built Php2ShellCheck, an asynchronous header inspection tool that fingerprints PHP and compares it with the PHP2Shell fixed releases. Reported result (as claimed by the author): It quickly finds hosts in your environment that advertise a vulnerable version, though the author notes it is not foolproof. Source: https://news.ycombinator.com/item?id=50195180 Tools they used: Python Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Codex. Goal: Find hosts advertising a vulnerable PHP version with an AI-assisted scanner What the original author did: Two coworkers and AI built Php2ShellCheck, an asynchronous header inspection tool that fingerprints PHP and compares it with the PHP2Shell fixed releases. Reported result (as claimed by the author): It quickly finds hosts in your environment that advertise a vulnerable version, though the author notes it is not foolproof. Source: https://news.ycombinator.com/item?id=50195180 Tools they used: Python Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Grok Bot. Goal: Find hosts advertising a vulnerable PHP version with an AI-assisted scanner What the original author did: Two coworkers and AI built Php2ShellCheck, an asynchronous header inspection tool that fingerprints PHP and compares it with the PHP2Shell fixed releases. Reported result (as claimed by the author): It quickly finds hosts in your environment that advertise a vulnerable version, though the author notes it is not foolproof. Source: https://news.ycombinator.com/item?id=50195180 Tools they used: Python Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
The Daily 5
Get five new use cases tomorrow morning
Free. Real sources. Unsubscribe any time.
Guides for this use case
Related use cases
Build a coding-agent harness that rewrites itself from its failures
Based on a 2026 Harness Learning paper, a developer built a coding-agent harness that studies its own failed runs and rewrites itself. He kept the model (Claude Sonnet 5.5) and tasks fixed and only let the harness change.
Self-host an agent that builds mini apps from chat and edits its own UI
mobius from mobius-os is a self-hosted personal AI system: you chat with a coding agent through Claude Code or Codex and it builds mini apps on your server and modifies its own UI.
Speed up computer use agents by skipping a screenshot after every action
A developer built arc-cua, an open-source computer use layer driven by fast decision models instead of a screenshot plus an LLM call after every click. It supports the Jev and OpenAI decisions APIs.
Make LLM agents team up in Pokemon Showdown battles
A researcher built a 2v2 Pokemon Showdown environment where two LLM agents must coordinate through team chat. You can watch battles with the chat shown, and the code is on GitHub.