{
  "id": 16407713,
  "title": "php2shell-migration: an AI agent skill to patch and modernize legacy PHP apps",
  "url": "https://urgent.news/2026/10/25/php2shell-migration-an-ai-agent-skill-to-patch-and-modernize-legacy",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-25T01:35:22.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ademkouki/php2shell-migration-an-ai-agent-skill-to-patch-and-modernize-legacy-php-apps-557l"
  },
  "original_language": "en",
  "account": null,
  "summary": "Dev.to reports on the creation of php2shell-migration, an open-source AI agent skill designed to help developers modernize outdated PHP applications and patch critical vulnerabilities. The tool focuses on two significant PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can lead to unauthenticated remote code execution. PHP has since patched these issues in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but PHP 8.1 and older versions will not receive official fixes. Many applications continue to run on older PHP versions and frameworks, making manual upgrades slow and risky. PHP2shell-migration addresses this issue by allowing developers to ask an AI agent to assess their project for the PHP2Shell vulnerabilities, determine the affected PHP version, plan the necessary fixes (including patching the PHP version and upgrading the framework), and execute the changes on a separate Git branch for testing. The tool supports a wide range of popular frameworks and applications, including Laravel, Symfony, WordPress, Drupal, Magento, Joomla, CodeIgniter, Yii, CakePHP, TYPO3, Moodle, Nextcloud, PrestaShop, MediaWiki, and more. It operates within the open Agent Skills format, compatible with several AI coding assistants such as Claude Code, OpenAI Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode, claude.ai, and others. The tool does not deploy changes to production, does not run exploits, and only reports tests as passed if they are actually executed.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}