Is your PHP app affected by PHP2Shell? Find out in one command, and let Claude fix it.
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a pair of critical RCE bugs in PHP itself. Every PHP app is affected, whatever its framework. Fixed in 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12.
curl -fsSL https://raw.githubusercontent.com/DavidHuji/PHP2Shell-SKILL/main/install.sh | bash
Then, in Claude Code, from your project folder:
/php2shell
That's it. Claude scans your project, shows what's vulnerable, and offers to bump the versions for you.
| Where | Example |
|---|---|
| Dockerfiles | FROM php:8.3.10-fpm |
| docker-compose / GitLab CI | image: php:8.2.20-apache |
| GitHub Actions | php-version: '8.4.5' |
| Version files | .php-version ,.tool-versions |
| Composer | config.platform.php |
| Your machine | local php /php-fpm , running Docker containers |
Project files in .
✘ docker/Dockerfile: PHP 8.3.10 is vulnerable → bump to 8.3.36
! docker-compose.yml: floating PHP 8.4 tag → rebuild with --pull so it picks up 8.4.27+
✔ .github/workflows/ci.yml: PHP 8.4.27 is patched
The script works on its own too:
bash ~/.claude/skills/php2shell/php2shell.sh check # scan project + machine (read-only)
bash ~/.claude/skills/php2shell/php2shell.sh mitigate # server stopgap, dry run
sudo bash ~/.claude/skills/php2shell/php2shell.sh mitigate --apply
bash ~/.claude/skills/php2shell/php2shell.sh hunt # look for signs of exploitation
check exits with code 1 when something is vulnerable, so you can drop it into CI.
Install for the whole team: add | bash -s -- --project to the install command. It installs the skill into ./.claude/skills/, and you commit it with the rest of the repo.
mitigate writes a small conf.d drop-in that turns off session.upload_progress (the path seen exploited in the wild). Restart PHP-FPM / Apache afterwards. This is a stopgap. Upgrading PHP is the real fix.
- Wiz Research discovered and documented PHP2Shell. See also the Wiz vulnerability database entries forCVE-2026-109618 andCVE-2026-109619 .
- netresearch/security-audit-skill : the PHP security-audit skill for Claude Code that inspired this project.
- Sumon Selim's PHP2Shell defense write-up : the mitigation and hunting workflow.
- The PHP security advisory and the GitHub advisoriesGHSA-w8hw-w9fx-j79w andGHSA-6wmf-4rv5-p3rp .
MIT. Provided as-is, with no warranty. Review every change before it goes to production.