# Agent skills: 88 still install PHP versions open to PHP2Shell

> AIR Security says 88 agent skills still point AI agents at PHP builds that the PHP2Shell flaws can break.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Supply chain, Research
- **Published by:** AIR Security
- **Disclosed:** 2026-10-22
- **Affects:** AI agent skills, PHP, phpMyAdmin, WordPress
- **Research by:** Dor Granat
- **Primary source:** https://air.security/blog-posts/skills-use-php2shell
- **Page:** https://theinjection.dev/items/air-skills-php2shell-libraries/

AIR Security found 88 AI agent skills across 65 repositories that still install or depend on PHP versions vulnerable to PHP2Shell, so an agent following them can rebuild a known remote code execution flaw in new projects.

## What happened

AIR Security published the research on October 22, 2026, credited to Dor Granat. AIR scanned 6.5 million AI agent skills and found 88 of them, spread across 65 GitHub repositories holding 3,269 stars between them, that still set up PHP environments vulnerable to PHP2Shell. By AIR's count that is roughly one in every 13 PHP-related skills it identified.

## How it works

Agent skills carry setup instructions, and most have no update mechanism, so an instruction naming a vulnerable PHP runtime or container image keeps shipping long after a fix lands. A developer who asks an agent to build a Laravel application can get a skill that installs an unpatched PHP, which recreates a known flaw in a fresh environment. AIR notes that such a skill passes a malicious-code scan, because nothing in it is malicious: there is no payload, no credential theft and no prompt injection.

## Who is affected

Developers and teams whose agents load third-party skills that install PHP, phpMyAdmin or WordPress are exposed, and the resulting application carries the flaw rather than the agent itself. AIR names phpMyAdmin and WordPress among the software these skills install or depend on, and does not publish the list of 88 skills or 65 repositories.

## What to do

Inventory the skills your agents actually load, then scan their instructions, dependencies, runtime versions and container images against official advisories and fixed releases. Re-scan when a skill or any dependency it references changes, and add guardrails that stop agents from installing or deploying software with known flaws.

## Quick facts

- **Affected:** 88 AI agent skills across 65 GitHub repositories
- **Scanned:** 6.5 million AI agent skills, per AIR Security
- **Share:** Roughly 1 in 13 PHP-related skills AIR identified
- **Underlying flaws:** CVE-2026-109618 and CVE-2026-109619 in PHP
- **Fixed in:** PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
- **Found by:** Dor Granat, AIR Security

## Questions

### Does this mean the AI agent skills themselves are malicious?

None of the 88 skills AIR Security flagged contain malicious code. AIR describes them as insecure rather than malicious: they instruct an agent to install or depend on PHP builds affected by PHP2Shell, so the resulting application inherits a known remote code execution flaw. AIR notes such skills pass malicious-code scanning precisely because they carry no payload, credential theft or prompt injection.

### How do I check whether my agents use one of these skills?

Start by inventorying which skills your agents actually load, since AIR Security does not publish the names of the 88 skills or the 65 repositories. AIR recommends scanning each skill's instructions, dependencies, runtime versions and container images, then checking those versions against official PHP advisories and the fixed releases. Re-scan whenever a skill or any dependency it references changes.

### Which PHP versions fix the PHP2Shell flaws?

The PHP Foundation shipped fixes for CVE-2026-109618 and CVE-2026-109619 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026. The Foundation states the correct CVSS score is 9.2, correcting a leaked figure of 10.0. Patching servers does not help an agent that later installs an older PHP, so skill instructions need checking separately.

## Sources

1. [AIR Research](https://air.security/blog-posts/skills-use-php2shell)
2. [PHP Security Release](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)