A careful AI agent prompt for PHP2ShellCoding and operations agents can do most of the PHP2Shell work (CVE-2026-109618 and CVE-2026-109619): find every PHP runtime, read the versions, and prepare the update. They can also do damage if they18h ago · 4 min readnorminal.hashnode.dev
Why your scanner or AI agent can call a fixed PHP server vulnerableAfter the PHP2Shell release (CVE-2026-109618 and CVE-2026-109619, php.net advisory of 21 October 2026), many people ran a scanner or asked an AI agent whether their servers are fixed. On some systems,4d ago · 3 min readnorminal.hashnode.dev
AI agent skills for PHP2Shell: what each one checksPHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of flaws in PHP itself. The PHP project fixed them on 21 October 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (php.net advisory). Within two 4d ago · 4 min readnorminal.hashnode.dev
Your server says PHP 8.3.6. Is it fixed for PHP2Shell?You read the PHP2Shell advisory. The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. You log in to your Ubuntu 24.04 server, run php -v, and it says PHP 8.3.6. That is thirty patch releases 5d ago · 6 min readnorminal.hashnode.dev
