How to check your site for the PHP2Shell flaw with an AI agent

Run php -v on the server that serves your site. If the version is older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12, update PHP to the fixed release for your branch, then run your tests and redeploy. PHP 8.1 and older get no new release, so plan a move to a supported branch.

PHP2Shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. They can let an attacker run code on a server without logging in. PHP shipped emergency updates on October 21, 2026. They were the centre of a week of security news in late October 2026, sometimes called "Black October", which also brought a LiteLLM supply-chain attack and GitLab patches.

This guide shows the steps by hand, then the same steps with an AI agent. It does not replace your host's or your distribution's own advice.

The steps

1. Check the PHP version. Run it on the machine that serves the site, not only on your laptop.

php -v

The command line and the web server can use different PHP builds. To see the one the web server uses, check your host's panel, or look at the PHP-FPM version:

php-fpm -v

On some systems the program is named with its version, such as php-fpm8.3.

1. Compare it with the fixed releases. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Every older version on those branches is affected. On Linux, your distribution may ship the fix without changing the version number, so also read its security notice for the php package.

1. Check how the web server runs PHP. Reports say every PHP setup that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Note which one you use, because it decides what you restart after the update.

apachectl -M 2>/dev/null | grep -i php
systemctl list-units --type=service | grep -i php

1. Update PHP. Use the way PHP was installed.

• Debian or Ubuntu: sudo apt update && sudo apt upgrade
• Fedora, RHEL or similar: sudo dnf upgrade 'php*'
• Docker: pull the updated official php image, rebuild and redeploy.
• Shared hosting: use your host's control panel, for example cPanel or Plesk, or ask your host when the fixed PHP is live.

Then restart PHP-FPM or the web server, and run step 1 again.

1. Do not rely on a setting alone. Turning off session.upload_progress.enabled is only a partial mitigation for one of the two flaws (CVE-2026-109619), and does not fully block it. Update PHP.

1. Check your PHP packages. In each project folder, list what you use and check it against known advisories:

composer show
composer audit

composer audit checks your Composer packages, such as Laravel or Magento modules. It does not check PHP itself. Update what it lists with composer update <package>.

1. Run your tests. For example php artisan test in Laravel, or vendor/bin/phpunit. On WordPress and WooCommerce, at least open the shop, add to cart and check out on a staging copy.

1. Redeploy. Ship the updated build the way you always do, and check the live site's PHP version once more.

1. Check the logs. Read the web server's access and error logs, and the PHP-FPM log, for errors and for requests you do not expect from before you updated. If something looks wrong, ask your host or a security professional.

sudo tail -n 200 /var/log/nginx/error.log
sudo tail -n 200 /var/log/apache2/error.log

Doing it with Mel

Mel's agent runs the same commands you would run, in your terminal, and you approve them. It does not scan for flaws on its own. It reads what the commands say and tells you.

Open a pane on the server (Mel can run SSH sessions in a pane, and the agent's tools then run on that machine), or in your project folder. Press ctrl+enter (cmd+enter on macOS) and write:

"Check which PHP version this server runs, for the command line and for PHP-FPM. Compare it with 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Then run composer audit in this project. Tell me what needs an update and the exact commands, and wait for my yes before you change anything."

Approvals. A command that could change something, such as apt install or composer update, and every file edit, stops on an approval card first. You can allow it, or deny it. Commands Mel can prove only read, such as php -v, run without a card. If you want a card for those too, turn on Ask before read-only commands too in Settings ▸ Agent mode. A command that cannot be undone always asks.

Several sites. For an agency with many stores, open one pane per repo, each in its own worktree, and start one agent in each. Review each one's changes before you merge.

Sources

• CNBC: PHP vulnerabilities and AI in cybersecurity
• Wikipedia: Black October (information security))
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
• Help Net Security: PHP2Shell PHP vulnerabilities patched

FAQ

What is PHP2Shell? The name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. They can let an attacker run code on a server without logging in. PHP fixed them on October 21, 2026.

Which PHP versions are fixed? 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no new release.

Does composer audit check for PHP2Shell? No. composer audit checks your Composer packages. PHP2Shell is in PHP itself, so check php -v and update PHP.

I am on shared hosting. What can I do? Check the PHP version in your host's control panel and pick a fixed one if it is offered. If it is not, ask your host when the update is live.

Can an AI agent do this for me? It can run the commands, read the results and propose the updates. In Mel, you approve each change before it runs. You still decide, and you still check the result.

• How to approve or block commands an AI agent runs
• How to run several AI agents at once
• How to review an AI agent's code changes
• What are AI agent approvals?

Facts checked on Oct 25, 2026.