Developers stuck maintaining ancient PHP codebases now have a new automated ally. Ademking has released php2shell-migration, an open-source AI agent skill designed to patch and modernize legacy PHP applications safely. The tool specifically targets the PHP2Shell vulnerabilities, offering a structured approach to upgrading outdated frameworks and core PHP versions without the usual manual chaos.

The PHP2Shell Threat

The catalyst for this tool is the emergence of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These flaws allow for unauthenticated remote code execution, a nightmare scenario for any web application. While PHP fixed these issues on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, the reality for many developers is darker. Applications running on PHP 8.1 and older receive no official fix, leaving them exposed and requiring risky manual upgrades.

Agent-Driven Modernization

php2shell-migration changes the workflow by integrating directly with AI agents. When prompted with "check this project for PHP2Shell," the agent analyzes the environment to determine the actual PHP version serving the website, rather than relying on local development configs. It then assesses whether the version is affected, out of support, or secure. The agent plans the remediation path, prioritizing the PHP patch before addressing framework upgrades, and applies changes on a separate Git branch to preserve stability.

Safety First, No Blind Deploys

The tool emphasizes safety over speed, a critical distinction for production environments. It never deploys to production automatically, never runs exploits, and rigorously verifies test results before marking them as passed. The final output is a detailed report that clearly separates "fixed and checked" items from those "not checked yet," giving developers full visibility into the migration status. This approach mitigates the risk of breaking legacy apps during the upgrade process.

Broad Framework Compatibility

The skill supports 23 different frameworks and applications, including industry heavyweights like Laravel, Symfony, WordPress, Drupal, and Magento. It also covers Joomla, CodeIgniter, Yii, CakePHP, TYPO3, Moodle, Nextcloud, PrestaShop, and MediaWiki. For custom PHP projects that don't fit into these buckets, the tool provides a general procedure. It is compatible with major AI coding tools such as Claude Code, OpenAI Codex, Cursor, GitHub Copilot, and Gemini CLI, leveraging the open Agent Skills format.

Key Takeaways

  • php2shell-migration addresses critical CVEs (2026-109618/9) in legacy PHP apps.
  • The agent automates version detection, patch planning, and Git branch isolation.
  • Supports 23 frameworks including Laravel, WordPress, and Magento.
  • Compatible with Claude Code, Codex, Cursor, and other Agent Skills tools.
  • Safety features prevent auto-deploys and ensure test integrity.

The Bottom Line

For teams drowning in technical debt, php2shell-migration offers a pragmatic bridge between manual maintenance and automated modernization, though it requires disciplined oversight to prevent silent regressions.