Still maintaining legacy PHP applications? I built php2shell-migration, an open-source AI agent skill that helps developers modernize outdated PHP apps more safely.
🔗 GitHub: https://github.com/Ademking/php2shell-migration
PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. PHP fixed them on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official fix. Lots of apps still run on old PHP and old frameworks, and upgrading them by hand is slow and risky.
Ask your agent something like "check this project for PHP2Shell" and it will:
It never deploys to production, never runs exploits, and never reports a test as passed unless it actually ran.
Laravel, Symfony, WordPress, Drupal, Magento / Adobe Commerce, Joomla, CodeIgniter, Yii, CakePHP, TYPO3, Moodle, Nextcloud, PrestaShop, MediaWiki and more (23 in total), plus a general procedure for custom PHP projects.
Claude Code, OpenAI Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode, claude.ai, and other tools that support the open Agent Skills format.
python scripts/install.py
Then open your agent in your PHP project and ask:
Use php2shell-migration to check this project for PHP2Shell and make a plan. Don't change anything yet.
I'd love to hear your feedback and suggestions!