Iurii Publishes: PHP RCE Response
An Agent Skill for Claude Code, Codex and Cursor. It walks your agent through the two critical PHP remote code execution flaws patched on October 21, 2026: which PHP runtimes are affected, how exposed they are, how to update and how to verify the fix. It’s written for agents, not for people: you don’t read it; you install it.
Works with
Claude CodeCodexCursor
Format
Agent SkillAgent Plugin 1.0.0
License
CC BY 4.0
Key Facts
- Built from the two PHP security advisories of October 21, 2026
- Verified October 21, 2026
- Read-only by default: diagnoses and recommends
- Separates the CLI version from the version that serves requests
- Facts the advisories don’t state are marked unverified
What It Covers
CVE-2026-109618 (remote code execution through out-of-memory corruption) and CVE-2026-109619 (remote code execution through stale global state) are rated CVSS v4.0 9.2. PHP fixed them in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating PHP is the only complete fix; the skill treats every configuration measure as partial and says so.
- Inventory. Finds PHP on hosts, in container images, in CI and in deploy configuration, and separates the CLI version from the one that serves requests.
- Exposure. Classifies each runtime by SAPI (mod_php, PHP-FPM, FrankenPHP, LSAPI) and reads the settings the advisories name.
- Plan. An update route per platform, plus interim mitigations with their cost.
- Verify. Checks the running process, not the package list, and says what a clean log does not prove.
What’s Inside
SKILL.md holds the procedure and the rules. Four reference files carry the detail: advisory facts, diagnostic commands, remediation routes, and sources with the places where sources disagree. plugin.json makes the folder a portable Agent Plugin.
Install
Install it through your agent’s plugin system, or copy the folder directly.
Claude Code
/plugin marketplace add rogulia/skills
/plugin install php2shell-response@rogulia-skillsFrom the shell: claude plugin marketplace add rogulia/skills, then claude plugin install php2shell-response@rogulia-skills.
Codex / ChatGPT
codex plugin marketplace add rogulia/skillsThen install the plugin from the rogulia-skills marketplace in the plugin browser (/plugins in Codex CLI, or the Plugins Directory in the ChatGPT desktop app).
Cursor
Open Customize → From GitHub Repository → rogulia/skills, then install the plugin.
Any Other Agent: Copy the Skill Folder
git clone --depth 1 --filter=blob:none --sparse https://github.com/rogulia/skills.gitcd skills && git sparse-checkout set php2shell-responsecp -r php2shell-response/skills/php2shell-response ~/.agents/skills/~/.agents/skills/ is read by Codex and Cursor. Claude Code uses ~/.claude/skills/. For a single project, use .agents/skills/ or .claude/skills/ inside that repository.
License & Source
The full text is on GitHub: github.com/rogulia/skills. Licensed under CC BY 4.0 — use, adapt and share, including commercially, with attribution.
AvailableNeed a Hand With the Patch?
I can audit your PHP servers and containers, roll out the update and verify it. Tell me about your setup.