PATCH AGENT · PHP2Shell RESPONSE
PHP2Shell broke the runtime under a large share of the web. This agent watches the advisories, finds opted-in repositories still pinning a vulnerable PHP, and opens a tested pull request. Every step is public.
01 · Request
The browser hits the web server, which hands the request to PHP-FPM over FastCGI. One worker takes it, so every request runs in an isolated worker process.
02 · Execute
The Zend Engine compiles the script to opcodes (cached by OPcache) and runs them, allocating from the per-request heap. When the request ends, that memory should be reset.
03 · PHP2Shell
Certain out-of-memory and fatal-error paths could leave request memory in an uninitialised state. The next request served by the same worker could then read or act on it. That is a memory-safety bug in the runtime, so every app on top inherits it.
04 · Patch
Application code doesn't change. The container image does: php:8.4.26-fpm becomes php:8.4.27-fpm. That one deterministic line is exactly what the agent opens a pull request for.
conceptual model · no exploit details
01 · The incident
W3Techs reports PHP as the most common server-side language among websites whose server-side language it can detect[w3techs-php]. That measures detectable websites, not the whole Internet.
PHP2Shell is a set of vulnerabilities in the PHP runtime itself, not in one plugin or framework. A well-written application still inherits exposure from the runtime underneath it.
PHP release branches
Fixed versions per the PHP2Shell security releases [php-changelog-8] · support status [php-supported]
What version are you on?
Runs entirely in your browser against the published fixed-version table. Nothing is sent anywhere.
02 · The AI inflection
01 · FIND
AI-assisted research shortens the path from source code to a credible bug report, even in runtimes that survived years of scrutiny.
02 · DISCLOSE
Coordinated releases ship fixes, but disclosure also tells everyone where to look.
03 · REPAIR
Thousands of repositories each have to notice, bump, test and merge. That last mile is mechanical, and this agent automates it.
03 · Watch it work
Current job
Every transition
Try the patcher · the production code, running in your browser
Edit freely. This is the same planFile() and validateChange() code the agent runs, executing in your browser.
- FROM php:8.4.26-fpm-alpine+ FROM php:8.4.27-fpm-alpine RUN docker-php-ext-install pdo_mysql opcache COPY . /var/www/html
04 · Architecture
05 · From disclosure to pull request
Advisories are pulled from NVD, GitHub Security Advisories and CISA KEV. Each record keeps its provider, record ID, source URL, retrieval time and a hash of the raw response.
Stage 01
Advisories are pulled from NVD, GitHub Security Advisories and CISA KEV. Each record keeps its provider, record ID, source URL, retrieval time and a hash of the raw response.
events: advisory.ingested
no events received yet
06 · Verify · fund · read · opt in
REAL-only ledger. Every row links to GitHub or NVD. Simulated records can never enter it.
[ "kind" => "pr.merged", "repo" => "owner/repo", "url" => "https://github.com/…/pull/…", "commit" => "<merge sha>", "mode" => "REAL", ]
A public, read-only treasury pays for inference, database and RPC. No yield, no returns, no price claims.
Twenty sections on the authorization model, threat model, prompt-injection defense, failure modes and limitations.
# .patchbot
version: 1
enabled: true
severity: [critical, high]
patches: { containers: true, dependencies: true }
verification: { require_ci: true }Protect your repo →