Your Skills Still Use Vulnerable PHP2Shell Libraries

A lot has already been said about PHP2Shell. Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, reportedly carry CVSS scores of 9.2 and can expose affected environments to remote code execution and sensitive memory disclosure. Fixes are available for supported PHP releases.
Patching your servers is the obvious first step. But what about the skills your AI agents use?
A skill can instruct an agent to install dependencies, pull libraries, or run code using vulnerable software. Even if your infrastructure is patched, your agents may keep ^{reintroducing vulnerable components through outdated skills.}

The question isn't just whether you've patched your infrastructure. It's whether the skills your agents rely on are steering them toward vulnerable software in the first place - and whether you're continuously checking.

What We Found

We scanned 6.5 million AI skills and found 88 skills across 65 repositories that still set up PHP environments vulnerable to PHP2Shell, with 3,269 GitHub stars combined.
These skills can instruct AI agents to deploy vulnerable PHP servers or install software that relies on affected PHP versions - including products like phpMyAdmin and WordPress.

That's roughly 1 in 13 PHP-related skills we identified.

The bigger problem? Skills often have no built-in update mechanism. Once installed, outdated instructions can stick around indefinitely, continuing to introduce vulnerable software long after a fix is available.
Your infrastructure might be patched. Your agents could still be rebuilding the vulnerability, one skill at a time.

PHP2Shell makes the problem concrete

PHP2Shell highlights the importance of patching affected PHP runtimes. But patching your servers is only part of the equation.

Consider this workflow:

1. A developer asks an AI agent to build a Laravel application.
2. The agent loads a skill with outdated setup instructions.
3. The skill directs the agent to use a vulnerable PHP runtime or container image.
4. The agent follows the instructions, reproducing a known vulnerability in a new environment.

The skill might pass a malicious-code scan. There may be no suspicious payload, credential theft, or prompt injection.

The resulting application can still be vulnerable.

Your agents should be secured, continuously

Skill security requires answering three questions:

• Is it malicious? Does it steal secrets or manipulate the agent?
• Is it insecure? Does it introduce vulnerable dependencies, runtimes, or configurations?
• Is it still safe? Have its dependencies or external references changed since it was approved?

A one-time scan can't answer all three forever. Skills and their dependencies can change, and yesterday's safe configuration can become today's liability.‍

What security teams should do

• Inventory the skills agents actually use.
• Scan their instructions, dependencies, runtime versions, and container images.
• Verify software against official security advisories and fixed releases.
• Continuously re-scan when skills or their dependencies change.
• Enforce guardrails before agents install or deploy vulnerable software.

Secure the supply chain behind your agents

AI agents are becoming a new interface for building and operating software. Skills are how they acquire repeatable expertise.
You can't secure that ecosystem by checking whether a skill looks malicious. You need to understand what it installs, what it configures, and whether those components remain safe.
That's what we're building AIR to solve: ^{a safe source for AI artifacts} - skills, MCPs, plugins, and more - so enterprises can secure the supply chain behind their agents by default.

Your agents are only as secure as the software they bring with them.