php2shell-migration: an AI agent skill to patch and modernize legacy PHP apps

A developer released php2shell-migration, an open-source AI agent skill that helps developers detect and remediate the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution and were patched in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 2026-10-21. The skill guides agents through checking a project, planning an upgrade and patching legacy apps across 23 frameworks including Laravel, Symfony, WordPress, Drupal and Magento, plus a general procedure for custom PHP projects. It is designed never to deploy to production, run exploits, or report a test as passed unless it actually ran, and works with Claude Code, OpenAI Codex, Cursor, GitHub Copilot, Gemini CLI and other tools supporting the open Agent Skills format.

Still maintaining legacy PHP applications? I built php2shell-migration , an open-source AI agent skill that helps developers modernize outdated PHP apps more safely. 🔗 GitHub: https://github.com/Ademking/php2shell-migration https://github.com/Ademking/php2shell-migration PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. PHP fixed them on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official fix. Lots of apps still run on old PHP and old frameworks, and upgrading them by hand is slow and risky. Ask your agent something like "check this project for PHP2Shell" and it will: It never deploys to production, never runs exploits, and never reports a test as passed unless it actually ran. Laravel, Symfony, WordPress, Drupal, Magento / Adobe Commerce, Joomla, CodeIgniter, Yii, CakePHP, TYPO3, Moodle, Nextcloud, PrestaShop, MediaWiki and more 23 in total , plus a general procedure for custom PHP projects. Claude Code, OpenAI Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode, claude.ai, and other tools that support the open Agent Skills format. python scripts/install.py Then open your agent in your PHP project and ask: Use php2shell-migration to check this project for PHP2Shell and make a plan. Don't change anything yet. I'd love to hear your feedback and suggestions