php2shell-migration: an AI agent skill to patch and modernize legacy PHP apps

Dev.to reports on the creation of php2shell-migration, an open-source AI agent skill designed to help developers modernize outdated PHP applications and patch critical vulnerabilities. The tool focuses on two significant PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can lead to unauthenticated remote code execution.

PHP has since patched these issues in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but PHP 8.1 and older versions will not receive official fixes. Many applications continue to run on older PHP versions and frameworks, making manual upgrades slow and risky. PHP2shell-migration addresses this issue by allowing developers to ask an AI agent to assess their project for the PHP2Shell vulnerabilities, determine the affected PHP version, plan the necessary fixes (including patching the PHP version and upgrading the framework), and execute the changes on a separate Git branch for testing.

The tool supports a wide range of popular frameworks and applications, including Laravel, Symfony, WordPress, Drupal, Magento, Joomla, CodeIgniter, Yii, CakePHP, TYPO3, Moodle, Nextcloud, PrestaShop, MediaWiki, and more. It operates within the open Agent Skills format, compatible with several AI coding assistants such as Claude Code, OpenAI Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode, claude.ai, and others.

The tool does not deploy changes to production, does not run exploits, and only reports tests as passed if they are actually executed.

Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.