{"slug": "claudecode-skill-to-easily-protect-your-website-from-the-php2shell-bug", "title": "ClaudeCode skill to easily protect your website from the PHP2Shell bug", "summary": "A Claude Code skill called PHP2Shell-SKILL scans PHP projects and local machines for the PHP2Shell remote-code-execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, and offers to bump affected PHP versions to the patched releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The skill, installed via a curl script and run with the /php2shell command, checks Dockerfiles, docker-compose and GitLab CI files, GitHub Actions workflows, .php-version and .tool-versions files, Composer's config.platform.php and local php/php-fpm installs, exiting with code 1 when something is vulnerable so the check can run in CI. A mitigate mode writes a conf.d drop-in disabling session.upload_progress, the path Wiz Research documented as exploited in the wild, which the author describes as a stopgap because upgrading PHP is the real fix.", "body_md": "**Is your PHP app affected by PHP2Shell? Find out in one command, and let Claude fix it.**\n\nPHP2Shell ([CVE-2026-109618](https://www.wiz.io/vulnerability-database/cve/cve-2026-109618) / [CVE-2026-109619](https://www.wiz.io/vulnerability-database/cve/cve-2026-109619)) is a pair of critical RCE bugs in PHP itself. Every PHP app is affected, whatever its framework.\n**Fixed in 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12.**\n\n```\ncurl -fsSL https://raw.githubusercontent.com/DavidHuji/PHP2Shell-SKILL/main/install.sh | bash\n```\n\nThen, in Claude Code, from your project folder:\n\n```\n/php2shell\n```\n\nThat's it. Claude scans your project, shows what's vulnerable, and offers to bump the versions for you.\n\n| Where | Example | \n|---|---|\n| Dockerfiles | `FROM php:8.3.10-fpm` | \n| docker-compose / GitLab CI | `image: php:8.2.20-apache` | \n| GitHub Actions | `php-version: '8.4.5'` | \n| Version files | `.php-version` ,`.tool-versions` | \n| Composer | `config.platform.php` | \n| Your machine | local `php` /`php-fpm` , running Docker containers | \n\n```\nProject files in .\n  ✘ docker/Dockerfile: PHP 8.3.10 is vulnerable → bump to 8.3.36\n  ! docker-compose.yml: floating PHP 8.4 tag → rebuild with --pull so it picks up 8.4.27+\n  ✔ .github/workflows/ci.yml: PHP 8.4.27 is patched\n```\n\nThe script works on its own too:\n\n```\nbash ~/.claude/skills/php2shell/php2shell.sh check            # scan project + machine (read-only)\nbash ~/.claude/skills/php2shell/php2shell.sh mitigate         # server stopgap, dry run\nsudo bash ~/.claude/skills/php2shell/php2shell.sh mitigate --apply\nbash ~/.claude/skills/php2shell/php2shell.sh hunt             # look for signs of exploitation\n```\n\n`check` exits with code `1` when something is vulnerable, so you can drop it into CI.\n\n**Install for the whole team:** add `| bash -s -- --project` to the install command. It installs the skill into `./.claude/skills/`, and you commit it with the rest of the repo.\n\n`mitigate` writes a small `conf.d` drop-in that turns off `session.upload_progress` (the path seen exploited in the wild). Restart PHP-FPM / Apache afterwards. This is a stopgap. Upgrading PHP is the real fix.\n\n- **[Wiz Research](https://www.wiz.io/blog/php2shell-php-rce)** discovered and documented PHP2Shell. See also the Wiz vulnerability database entries for[CVE-2026-109618](https://www.wiz.io/vulnerability-database/cve/cve-2026-109618) and[CVE-2026-109619](https://www.wiz.io/vulnerability-database/cve/cve-2026-109619) .\n- **[netresearch/security-audit-skill](https://github.com/netresearch/security-audit-skill)** : the PHP security-audit skill for Claude Code that inspired this project.\n- **[Sumon Selim's PHP2Shell defense write-up](https://www.sumonselim.com/php2shell-defense-patch-or-mitigate-with-a-claude-code-skill/)** : the mitigation and hunting workflow.\n- The [PHP security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) and the GitHub advisories[GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and[GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) .\n\nMIT. Provided as-is, with no warranty. Review every change before it goes to production.", "url": "https://wpnews.pro/news/claudecode-skill-to-easily-protect-your-website-from-the-php2shell-bug", "canonical_source": "https://github.com/DavidHuji/PHP2Shell-SKILL", "published_at": "2026-10-22 22:22:35+00:00", "updated_at": "2026-10-22 22:41:01.695345+00:00", "lang": "en", "topics": ["ai-tools", "ai-agents", "developer-tools", "ai-safety"], "entities": ["Claude Code", "PHP2Shell", "CVE-2026-109618", "CVE-2026-109619", "Wiz Research", "PHP", "GitHub Actions", "Composer"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/claudecode-skill-to-easily-protect-your-website-from-the-php2shell-bug", "markdown": "https://wpnews.pro/news/claudecode-skill-to-easily-protect-your-website-from-the-php2shell-bug.md", "text": "https://wpnews.pro/news/claudecode-skill-to-easily-protect-your-website-from-the-php2shell-bug.txt", "jsonld": "https://wpnews.pro/news/claudecode-skill-to-easily-protect-your-website-from-the-php2shell-bug.jsonld"}}