On October 21 the PHP project released emergency fixes for two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell) that can allow remote code execution on any server running PHP, the language behind most of the web. The impact was worldwide: sites went offline as operators rushed to patch, hosting providers pushed emergency updates, and security agencies in the US and Europe urged immediate action. WordPress sites are affected like every other PHP application, and the fix is a PHP update: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, usually applied by your hosting provider.
After the advisory, many of you used Novamira to look at your sites with your own AI agent: with full access, an agent can go through the files and the database, not just what the dashboard shows. We turned that into something everyone can use. Novamira 1.12.12 ships a free Site Integrity Check skill, built into the plugin and offered to any connected agent. It walks the agent through checking plugins, themes and core against known vulnerabilities, and looking for unknown administrators, modified or injected files, malicious code in the database, and form recipients that send data elsewhere. The agent reports what it found and how confident it is, and changes nothing without your approval.
Novamira also now tells the agent when the server runs a PHP version older than the first fixed release of its branch, with the advisory details and the recommendation to update PHP through the hosting provider. Linux distributions sometimes backport fixes without changing the version number, so the agent presents this as “may be affected”, not as a verdict.
If updating is not immediate because the site runs an older PHP branch, the new PHP Compatibility Check skill helps with the other half of the problem: it checks whether your plugins, theme and custom code are ready for a newer PHP version, and proposes a fix for each thing that would break, before you switch versions in your hosting panel.
Both skills also work in Read Mode, so on a live site the whole check can run with read abilities only. Novamira 1.12.12 is free from the download page; the skills are built in and appear to your agent as soon as it connects. The site integrity guide covers the whole check in detail.