A careful AI agent prompt for PHP2Shell
Coding and operations agents can do most of the PHP2Shell work (CVE-2026-109618 and CVE-2026-109619): find every PHP runtime, read the versions, and prepare the update. They can also do damage if they
Latest articles
Why your scanner or AI agent can call a fixed PHP server vulnerable
After the PHP2Shell release (CVE-2026-109618 and CVE-2026-109619, php.net advisory of 21 October 2026), many people ran a scanner or asked an AI agent whether their servers are fixed. On some systems,
AI agent skills for PHP2Shell: what each one checks
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of flaws in PHP itself. The PHP project fixed them on 21 October 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (php.net advisory). Within two
Your server says PHP 8.3.6. Is it fixed for PHP2Shell?
You read the PHP2Shell advisory. The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. You log in to your Ubuntu 24.04 server, run php -v, and it says PHP 8.3.6. That is thirty patch releases
