AI agents and PHP2Shell

Coding and operations agents, such as Claude Code, Codex or Devin, can find every PHP runtime and prepare the update. This page gives a careful prompt, our skill file, and what the published agent skills check. Let the agent read and propose. Keep every change for your approval.

Last reviewed 23 October 2026. Rules of 22 October 2026.

A prompt for any agent

Replace the address with your own site. Give the agent access only to servers and repositories that you own or run.

You have access to the server or repository behind https://your-site.example/. Check it for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and help me fix it.

1. Inventory every PHP runtime: CLI, PHP-FPM pools, Apache mod_php, php-cgi, LiteSpeed lsphp, FrankenPHP, cPanel/Plesk/Remi builds under /opt, containers and images, CI jobs. In a repository, read Dockerfiles, compose files, CI configs and composer.json (require.php, config.platform.php).
2. For each one, record the version (php -v, php-fpmX.Y -v) and the package build (dpkg -l, rpm -qa or apk info -v, filtered to php).
3. Compare with the fixed releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later in the same branch. PHP 8.1 and older get no upstream release. A distribution build can carry the fix under an old number: compare the full package version with the vendor's advisory.
4. Propose the upgrade: exact commands, services to restart, expected downtime. Ask me before you run anything that installs, removes, restarts or edits, and before you create any file in the web root (no phpinfo files).
5. After my approval: take a backup or snapshot, update, restart every PHP worker (and lsphp in LiteSpeed detached mode), rebuild images, then verify the version, the package, that every PHP process started after the update (ps -eo pid,lstart,cmd) and X-Powered-By (curl -sIL).
6. Report a table: runtime, path, version, package, status (fixed, not fixed, unknown) and what is left to do.

Never send exploit probes to any site. Do not paste secrets or environment values (php -i and ps can show them) into your report. If you cannot verify a version, report it as unknown.

• Step 3 names the backport trap. Ubuntu 24.04 has the fix in 8.3.6-0ubuntu0.24.04.13 (USN-8948-1), so php -v still says 8.3.6. An agent that compares 8.3.6 with 8.3.36 would try to fix a fixed server.
• Step 4 is the approval gate: nothing is installed, restarted or edited before you agree. No phpinfo() file goes online.
• Step 5 checks the restart. PHP processes that started before the update still run the old code.

Our skill file

Agents that load skills, such as Claude Code, can use the same steps as a skill: SKILL.md. It is text only, with no scripts. It reads first, asks before any change and never sends exploit probes. Read it before you install it. For Claude Code, as a personal skill:

mkdir -p ~/.claude/skills/php2shell-fix
curl -fsSL https://php2shell.fyi/skills/php2shell-fix/SKILL.md -o ~/.claude/skills/php2shell-fix/SKILL.md

The same skill and prompt are in the detailed PDF report, filled in for the site you checked.

Agent skills from other publishers

Some distributions ship the fix under the old upstream number, so the main question is whether a skill compares the full package version. We read each skill file on 23 October 2026. We did not audit their code. Read a skill before you run it.

In their own words:

• OpenAI phpcheck-server: "Compare the full package revision against vendor guidance covering both CVEs. An older upstream version alone does not prove vulnerability." And: "Do not run exploit probes."
• OpenAI phpcheck-url: "HTTP headers cannot tell whether the version contains a backported fix."
• Cognition fix-php-vuln: "Never compare php -v with upstream numbers to decide this." Discovery ends with: "Stop. Show the table and ask which repos to patch."
• Chainguard php2shell: "Every change needs the user's explicit approval first". Chainguard ships the fix in php-8.4 8.4.26-r4, so php -v shows 8.4.26.
• php2shell-response: "A distribution package may carry the fix under an older version number: check the vendor changelog or advisory, never compare version strings alone."

Tools that compare only the upstream number

On Ubuntu, RHEL and Chainguard these tools can report a fixed build as vulnerable. Read their answer as a question, then check the package:

• The ProjectDiscovery Nuclei template for CVE-2026-109618. Its version fallback marks a patch number below the fixed one as vulnerable, and every version below 8.2 as end of life.
• The Assetnote scanner. With no crash signal, it falls back to the X-Powered-By number. Our active scan runs it and shows its answer as an indicator.
• Some community skills compare versions with sort -V on the upstream number.

The CVE record also lists only 8.2 to 8.5 as affected, so a tool that reads it literally can miss PHP 8.1 and older (details).

Before an agent changes a server

• Give it read access first, and ask for a table: runtime, path, version, package, status.
• Check that it reads the PHP that serves the site (PHP-FPM, the Apache module, LiteSpeed), not only the command-line php.
• Ask for the restart step, and the check after it: ps -eo pid,lstart,cmd | grep -i '[p]hp' shows when each PHP process started.
• Do not let it fetch or run public proof-of-concept code. Most PHP2Shell "PoC" repositories are attack tools, and their code is not reviewed.
• Keep secrets out of its report: php -i and ps can show environment values.

Sources

• php.net advisory, 21 October 2026, and the full source list.
• The PHP Foundation on AI in this release: "AI helps the team validate reports and group reports sharing the same root cause, but a person makes every call and works on every patch" (PHP Foundation, 21 October 2026).
• The skill files linked in the table, read on 23 October 2026.

Check your site

Find out which PHP version your site reports to visitors. Check my site.