A careful AI agent prompt for PHP2Shell

Coding and operations agents can do most of the PHP2Shell work (CVE-2026-109618 and CVE-2026-109619): find every PHP runtime, read the versions, and prepare the update. They can also do damage if they restart the wrong service or trust the wrong version number.

The PHP Foundation describes its own use of AI for this release like this: "AI helps the team validate reports and group reports sharing the same root cause, but a person makes every call and works on every patch" (PHP Foundation, 21 October 2026). The same rule works on your servers: let the agent read and propose, and keep the changes for yourself to approve.

Disclosure: we run php2shell.fyi, a passive checker for PHP2Shell.

The prompt

Replace https://your-site.example/ with your own site. Give the agent access only to systems you own or run.

You have access to the server or repository behind https://your-site.example/. Check it for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and help me fix it.

1. Inventory every PHP runtime: CLI, PHP-FPM pools, Apache mod_php, php-cgi, LiteSpeed lsphp, FrankenPHP, cPanel/Plesk/Remi builds under /opt, containers and images, CI jobs. In a repository, read Dockerfiles, compose files, CI configs and composer.json (require.php, config.platform.php).
2. For each one, record the version (php -v, php-fpmX.Y -v) and the package build (dpkg -l, rpm -qa or apk info -v, filtered to php).
3. Compare with the fixed releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later in the same branch. PHP 8.1 and older get no upstream release. A distribution build can carry the fix under an old number: compare the full package version with the vendor's advisory.
4. Propose the upgrade: exact commands, services to restart, expected downtime. Ask me before you run anything that installs, removes, restarts or edits, and before you create any file in the web root (no phpinfo files).
5. After my approval: take a backup or snapshot, update, restart every PHP worker (and lsphp in LiteSpeed detached mode), rebuild images, then verify the version, the package, that every PHP process started after the update (ps -eo pid,lstart,cmd) and X-Powered-By (curl -sIL).
6. Report a table: runtime, path, version, package, status (fixed, not fixed, unknown) and what is left to do.

Never send exploit probes to any site. Do not paste secrets or environment values (php -i and ps can show them) into your report. If you cannot verify a version, report it as unknown.

The same steps are also a skill file for agents that load skills, such as Claude Code: SKILL.md. It is text only. Read it before you install it.

Why each line is there

• Step 1 lists runtimes, not sites. The command-line php is often not the PHP that serves the site. Panels such as cPanel and Plesk install their own PHP builds next to the system ones.
• Step 3 names the backport trap. Ubuntu 24.04 has the fix in 8.3.6-0ubuntu0.24.04.13 (USN-8948-1), so php -v still says 8.3.6. An agent that compares 8.3.6 with 8.3.36 would "fix" a fixed server.
• Step 4 is the approval gate. The agent stops before any install, restart or edit. It also must not leave a phpinfo() file online: that page shows paths, settings and environment values.
• Step 5 checks the restart. An installed package does not change PHP processes that are already running.
• The last lines keep it defensive. No exploit probes against any site, and no secrets in the report.

Until you can update

If one runtime cannot be updated yet, the PHP project lists measures that reduce specific attack paths, such as session.upload_progress.enabled=0 set in php.ini or the FPM pool, not with ini_set(). On 23 October 2026, php.net also suggested keeping that setting off until the next regular bugfix release, even on the fixed releases (informational advisory, CVE-2026-115560). The full list, with a source for each measure, is on php2shell.fyi/mitigations.