The article introduces php2shell-migration, an open-source AI agent skill designed to patch and modernize legacy PHP applications safely.

Fixes are applied on a separate Git branch with tests run, and a report distinguishes fixed/checked items from those not yet checked; it does not deploy to production nor report false test success.

The content includes links to the GitHub repository and a Dev.to article for deeper reading.

Supported frameworks and apps include Laravel, Symfony, WordPress, Drupal, Magento/Adobe Commerce, Joomla, CodeIgniter, Yii, CakePHP, TYPO3, Moodle, Nextcloud, PrestaShop, MediaWiki, among others (23 in total).

The tool analyzes the actual PHP version serving a website (not just the developer’s laptop), assesses whether it is affected, out of support, or fine, and plans fixes accordingly.

Quick-start steps are provided: run python scripts/install.py to install, then use the agent in a PHP project to initiate a check-and-plan workflow without immediate changes.

It explains the motivation: two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) enabling unauthenticated remote code execution, with fixes in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as of 2026-10-21; older versions remain unfixed.

It works with AI agent tools that support the open Agent Skills format, such as Claude Code, OpenAI Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode, and claude.ai.

The article invites feedback and suggestions from readers.