php2shell-migration: an AI agent skill to patch and modernize legacy PHP apps

Still maintaining legacy PHP applications? I built php2shell-migration, an open-source AI agent skill that helps developers modernize outdated PHP apps more safely.

🔗 GitHub: https://github.com/Ademking/php2shell-migration

Why I built it

PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. PHP fixed them on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official fix. Lots of apps still run on old PHP and old frameworks, and upgrading them by hand is slow and risky.

What it does

Ask your agent something like "check this project for PHP2Shell" and it will:

• Work out which PHP version actually serves your website, not just the one on your laptop
• Tell you whether that version is affected, out of support, or fine
• Plan the fix: the PHP patch first, then any framework upgrade
• Apply the changes on a separate Git branch and run your tests
• Write a report that separates "fixed and checked" from "not checked yet"

It never deploys to production, never runs exploits, and never reports a test as passed unless it actually ran.

Supported frameworks and apps

Laravel, Symfony, WordPress, Drupal, Magento / Adobe Commerce, Joomla, CodeIgniter, Yii, CakePHP, TYPO3, Moodle, Nextcloud, PrestaShop, MediaWiki and more (23 in total), plus a general procedure for custom PHP projects.

Works with

Claude Code, OpenAI Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode, claude.ai, and other tools that support the open Agent Skills format.

Quick start

python scripts/install.py

Then open your agent in your PHP project and ask:

Use php2shell-migration to check this project for PHP2Shell and make a plan. Don't change anything yet.

I'd love to hear your feedback and suggestions!