PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of flaws in PHP itself. The PHP project fixed them on 21 October 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 ( php.net advisory ).

Within two days, several teams published skills for coding and operations agents (Claude Code, Codex, Devin and others) that look for affected PHP and help update it. We read the skill files of the ones below. This post lists what each one inspects, how it decides whether a build has the fix, and whether it waits for your approval before it changes anything.

Disclosure: we run php2shell.fyi , a passive checker for PHP2Shell. None of the tools below is ours.

The question that matters most

Some Linux distributions ship the fix under the old version number. Ubuntu 24.04 has the fix in php8.3 8.3.6-0ubuntu0.24.04.13 ( USN-8948-1 ). RHEL 9 has it in php-8.0.30-8.el9_8.1 ( RHSA-2026:87151 ).…