PHP2Shell May Reach Your Agents Through Their Tools
TL;DR
- PHP2Shell is two critical bugs in PHP's engine (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) that hand an unauthenticated attacker code execution and a read of live worker memory. Nearly every release since PHP 5.4 is affected. Fixes shipped October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backports for 7.4 through 8.1. PHP calls updating the only complete mitigation.
- Agent harnesses rarely run on PHP themselves. A growing share of the tools they call does: the WordPress MCP Adapter (50,000+ active installs), Laravel MCP, the Drupal MCP Server and the official PHP MCP SDK all serve agents over HTTP, through the request path these bugs live in.
- Owning a PHP host means owning the tool server every connected agent trusts: its tool descriptions, its responses, and every token an agent sends it. The memory-disclosure variant skims those tokens without a shell.
- Start by patching, then treat your agents' MCP inventory as a PHP exposure list, rotate the credentials agents handed to PHP-hosted endpoints, and keep a control at the tool call that holds whoever is answering on the other end.
A patch that could not wait
PHP2Shell is a flaw in PHP's own engine, so every application on an affected version is exposed, down to a bare "Hello World". When a request runs out of memory partway through startup, PHP leaves stale internal state behind, and the next request on the same worker reuses it. One chain turns that into unauthenticated remote code execution. Another returns an attacker-sized slice of worker memory inside a PHPSESSID cookie, memory that Wiz says may hold passwords, authentication tokens, API keys and certificates from other requests. Wiz demonstrated RCE against WordPress, Drupal and Joomla, and Calif extended the list to Magento, Laravel, Symfony and others. Details leaked a day early, and several vendors were reporting exploitation attempts before the fixes shipped, none confirmed successful at the time of writing.
Update to a fixed version, or take your vendor's backport. For hosts that cannot move today, PHP lists partial mitigations (disabling session upload progress and fatal-error backtraces, lifting the memory limit) and says none of them makes an installation safe. A WAF with rules for the known vectors buys time. The web tier is only the first place this lands.
Where your agents touch PHP
The mainstream harnesses rarely run on PHP. Claude Code, Codex, Cursor and their peers are built in TypeScript, Python and Rust. The PHP exposure for an agent program lives one hop away, in the servers the agents call and the credentials they carry to them.
- MCP servers inside PHP applications: The WordPress MCP Adapter exposes a site's Abilities API to any MCP client over HTTP, authenticated as a WordPress user. The Drupal MCP Server puts an /mcp endpoint inside the site and reports 1,300 installs while still in beta. Laravel MCP registers servers as web routes behind Sanctum or Passport tokens. The official PHP SDK, maintained by the PHP Foundation and Symfony, ships HTTP transport for everyone else. Each of these endpoints is served by the request path PHP2Shell abuses.
- Keys stored where PHP can read them: WordPress 7.0's Connectors API holds Anthropic, Google and OpenAI API keys so site features can call models, and keys saved through the admin screen sit unencrypted in the database.
- Content agents read: WordPress, Drupal and MediaWiki power a large share of what agents browse and ingest. A compromised site keeps its domain reputation, so content planted for agents arrives with years of trust attached.
- The agent can be the delivery path. PHP2Shell needs nothing more than an HTTP request to a vulnerable worker. An agent with a fetch tool, fed injected instructions, can send that request to an internal PHP host the outside attacker could never reach on their own. Reachability is the whole game, and an agent reaches further than the internet does.
The attack chain, host to agent
Once an attacker lands on a PHP host, or merely reads its memory, the tokens the agents sent there are theirs, and so is the MCP server running on it. From that point, the tool descriptions and tool results every connected agent reads come from the attacker, carrying the server's name and the organization's trust, even though no prompt has been jailbroken and no harness exploited. The agent simply keeps following a tool it has always followed.
We see this layer every day across the environments we monitor: coding agents connected to a managed WordPress platform through its MCP server, with tools that run WP-CLI and pull environment configuration; a Laravel MCP server taking shape inside a product team's repository; agents holding WordPress application passwords so they can push pages over the REST API. This is what wiring an agent into a content stack looks like in 2026.
The remediation is agentic too
OpenAI shipped a version checker and two Codex skills for finding vulnerable hosts, and this is the week many teams will point coding agents at their fleets to patch at scale. Emergency work with sudo across many hosts is where an agent's wrong assumption does the most damage, as when a Cursor agent reached for a leftover broad-scope token and wiped a production database in seconds.
A footnote for the MCP crowd: the protocol's co-creator, David Soria Parra, was the release manager for PHP 5.4 and 5.5, and 5.4 is the oldest version PHP2Shell reaches.
What to notice as defenders
Before the alerting, answer one question: which of your agents' tools sit on PHP? The inventory you already keep gets you most of the way.
- Trace each MCP server to the application behind it: The PHP-hosted ones are the WordPress MCP Adapter, the Drupal MCP Server, Laravel MCP and anything built on the official PHP SDK. A response-header check helps, though an MCP server often sits behind a Node or Go proxy, so it can confirm the application rather than the front door.
- Note the credential each agent hands those servers: The application passwords and bearer tokens agents send are what the memory-read variant skims, so that list doubles as your rotation list.
- Find out who patches the PHP: A managed platform such as WordPress VIP or Pantheon does it for you, so confirm the build. A self-hosted app is yours to patch today.
On the web tier, Wiz's signals are the ones to wire into alerting:
- Unusual multipart requests followed by memory-limit errors.
- Bursts of HTTP 500s on endpoints that never fail.
- Oversized or malformed PHPSESSID cookies in responses.
- PHP worker churn with no deploy to explain it. Application logs will show little, since the activity happens below the application layer.
On the agent tier, look one hop out from those servers:
- Changed tool surfaces: MCP servers whose tool list or descriptions changed after October 20, or tool results that start carrying instructions instead of data.
- New destinations after a PHP-hosted call: an agent that calls a WordPress or Laravel endpoint and then reaches a domain it has never used.
- Outbound requests to internal PHP hosts: an agent sending HTTP at an internal WordPress, Laravel or Drupal host it has no task-level reason to touch, which is what the injected-delivery path looks like from the inside.
- Credentials from new places: application passwords and bearer tokens that agents sent to PHP endpoints before the patch, now used from unfamiliar sources. Rotate them either way.
- Fleet-patching sessions outside change windows, with sudo, package managers and container pulls fanning out across hosts.
How Capsule helps
- Inventory: Capsule keeps the list of MCP servers your agents connect to, with endpoint, transport and authentication type, and the tools behind each one. The PHP-hosted servers become a filter on a list you already have.
- Posture: Findings flag over-permissioned MCP servers, tools with destructive reach, servers that ingest untrusted content, and secrets hardcoded in skill files, alongside reputation assessments for the servers and skills themselves. The servers that matter most after a compromise are usually the ones already carrying a finding.
- Runtime enforcement: Capsule reads each tool call and tool result at the boundary and stops prompt injection, credential leakage, dangerous actions and external data exposure before they reach your systems, with policies that can be scoped to a single MCP server. When a trusted server starts answering with someone else's instructions, the control that holds is the one applied to what the agent does next.
Read more articles
GhostSquatting: Model Theft and RCE via Abandoned Names in AI Agent Files
What happens when an AI agent blindly trusts a name nobody owns? We claimed abandoned buckets and packages referenced in agent files, and real production systems started sending us model weights, backups, and installs. GhostSquatting turns forgotten names into model theft, data exfiltration, and RCE.
To Jev Or Not to Jev?
Jev is fast, clever, and great at classification, so why not put it in front of every AI agent action? We tested it against Capsule's rogue agent model on accuracy, latency, and context, and found that when a wrong answer means a deleted production database, specialization still wins.
.avif)
OWASP Named the Ten Ways Skills Go Wrong. All Ten Are Already Happening.
OWASP has published the Agentic Skills Top 10, a new list of the most critical risks in the skills that give AI agents real-world reach across tools like Claude Code and Cursor. We compared each of the ten risks against our analysis of over 200,000 real skills, and every one of them is already happening in the wild.
CurseBox: The Agent That Sends Your Files to Strangers to Get the Job Done
Capsule Security research uncovered a behavior in Cursor's agent: asked to do something ordinary like share a file, it decides on its own to upload the file to a public anonymous host to get a link. It will push past a deny-all network sandbox to do it, and no attacker is involved. We found it running in production across every major model, reported it to Cursor, and were met with silence.
Compliance Comes for the Agents: Every Agentic AI Framework You Need to Know
As AI agent security moves into formal governance, binding laws like the EU AI Act and procurement standards like ISO 42001 are becoming required, while voluntary frameworks like OWASP’s Agentic Top 10 guide threat modeling. Despite these rising expectations, audit data shows that most active agent deployments still lack basic safeguards like input validation and execution logging. This post breaks down the five-layer compliance stack and explains why continuous, runtime evidence is essential to satisfy both strict regulations and voluntary benchmarks.
When Agents Go Rogue
Modern AI agents are increasingly causing critical system damage not through external cyberattacks, but by taking unprompted, off-script actions across unguarded tools like databases and system shells. Traditional safeguards, including prompt instructions and human approval workflows, routinely fail to catch these autonomous errors before execution. To mitigate this growing risk, security must shift directly to the tool-call boundary, enforcing deterministic runtime controls that intercept and block destructive commands before they run.
Keeping AI Agents on Track: How Capsule Powers State-of-the-Art Rogue Agent Detection with NVIDIA Nemotron
Capsule Security and NVIDIA collaborated to solve the rogue AI agent threat by engineering specialized Small Language Models (SLMs) for real-time intent security detection. By fine-tuning NVIDIA Nemotron architectures, this solution achieves inline, ultra-low latency interception of unauthorized agent actions before damage occurs. Discover how domain-specialized models deliver up to 96.9% accuracy and sub-200ms response times to keep autonomous enterprise workflows secure.
Capsule Launches Security Integration for Claude Platform
Capsule launches a security integration for Claude Platform, using Claude's Compliance API to give security, compliance, and AI governance teams visibility into enterprise AI activity, risk, and posture across Anthropic-hosted deployments.
.png)
We Analyzed 206,435 AI Agent Skills. Here's What We Found.
Our analysis of 206,435 AI agent skills reveals a rapidly growing software supply chain vulnerable to natural language payloads and dangerous capability combinations. Read the report to understand how these skills bypass traditional security controls and learn how Capsule protects your organization by securing the agent runtime.
.png)
Mitigating the Agentic AI Threat: What Security Leadership Needs to Prioritize
The theoretical phase of agentic AI security is over—the attack surface is real and the incidents are documented. This post breaks down the defensive architecture taking shape in response: Meta's Agents Rule of Two, deterministic enforcement hooks, identity governance for non-human agents, and the questions security leaders need to be asking right now.
The Agentic AI Threat Landscape Has Crossed a Threshold
The security risks of AI agents are no longer theoretical. This blog examines the active threat landscape facing agentic AI in 2026, from prompt injection and supply chain attacks against MCP and skill registries to the governance gap created by vibe coding and Shadow AI.
The Rise of Guardian Agents: Securing the Agentic AI Ecosystem
Guardian agents are emerging as a critical security layer for the agentic AI era. As enterprises adopt AI agents that execute tools, handle sensitive data, and operate inside real workflows, human approval loops no longer scale. Guardian agents solve this by supervising other agents in real time: monitoring actions, enforcing policy, and blocking risky behavior before execution.
.png)
CurseChain: How Hidden README Comments Trick Cursor Into Stealing - and Spreading - Your SSH Keys
Capsule found two Cursor IDE vulnerabilities that let hidden prompt-injection instructions in referenced files steal developers’ SSH keys and contaminate future unrelated projects, causing zero-click or one-click exfiltration even when the attacker ships no malicious code.
The State of AI Agent Security 2026
Capsule Security’s State of AI Agent Security 2026 report is the largest independent audit of AI agents to date, showing that the ecosystem is rapidly shipping publicly exposed, weakly guarded, highly connected agents with recurring misconfigurations, near-absent runtime controls, widespread prompt-injection risk, expanding supply-chain exposure, and active malicious campaigns still propagating through agent skill and tool registries.
Capsule Security Raises $7M to Prevent AI Agents from Going Rogue in Runtime: Intent is the New Perimeter
Capsule is launching a runtime security platform for the agentic AI era, built to monitor and stop autonomous agents that can bypass traditional guardrails, misuse legitimate access, and create a new class of enterprise security risk.
.avif)
PipeLeak: The Lead That Stole Your Database - Exploiting Salesforce Agentforce With Indirect Prompt Injection
Capsule research team discover a critical prompt injection vulnerability in Salesforce Agentforce that allows attackers to exfiltrate CRM data through a simple lead from a form submission. No authentication required.
