By Tim Lisko
Deputy CISO
DigitalOcean is aware of two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, publicly disclosed on October 21, 2026. Either allows an attacker to execute arbitrary code on a server running PHP, potentially resulting in full compromise of the affected system. Proof-of-concept exploit code is publicly available, and there are no complete mitigations except patching. Updating PHP to a patched version is the only safe path to protection.
PHP powers a significant share of the web, including Cloudways by DigitalOcean, and technologies like WordPress, Drupal, Laravel, and custom applications deployed on the DigitalOcean platform. We are notifying all DigitalOcean customers to check both your DigitalOcean-hosted assets and the rest of your stack. Cloudways, our managed product, is automatically patching WordPress instances on your behalf. However, for non-managed services and your other infrastructure, this issue warrants taking action to ensure safety.
These vulnerabilities affect every PHP version from PHP 5 onward. If you run PHP anywhere in your DigitalOcean infrastructure, consider yourself potentially in scope until you’ve patched. That includes Droplets, DOKS workloads, App Platform apps or custom containers, and previously deployed Marketplace 1-Click images (including but not limited to WordPress, LAMP, LEMP, and Laravel).
The PHP project has released fixes for the following versions:
PHP branch | Patched version |
---|---|
8.5 | 8.5.12 |
8.4 | 8.4.27 |
8.3 | 8.3.36 |
8.2 | 8.2.35 |
8.1 or earlier | No patch available |
Patches are only available for currently supported PHP versions (8.2 and later). If you’re running an end-of-life version (8.1 or earlier), no official patch will be available. Plan an immediate upgrade to a supported version.
Product | Product status | Your action | Status line |
---|---|---|---|
Marketplace 1-Click images | Affected | Update existing deployments | We’ve delisted affected 1-Click images until they’re patched, so new deployments don’t start out vulnerable. Customer Action: Instances you already deployed don’t update themselves. Update PHP on them now. See the Marketplace appendix. |
Functions | Affected | Redeploy after our update (proposed) | Functions offers PHP runtimes (8.2, 8.3, 8.4, 8.5). Runtimes have been patched and 8.0 has been deprecated. Customer action: Redeploy to pick up the new levels. |
App Platform | Affected | Redeploy after our update | PHP buildpack has been patched. Customer Action: Redeploy applications to pick up the latest buildpack and safe PHP. If you deploy from your own Dockerfile or container image, update the PHP version in that image and redeploy. |
Cloudways | Affected | Handled by DigitalOcean | Cloudways is actively patching PHP versions 5.6 and above currently supported across Cloudways platform, leveraging extended LTS partnership support for older PHP instances. We are not forcing customers to migrate to newer PHP versions. Follow along at status.cloudways.com for up-to-date progress. Patching is currently in progress. We have applied PHP’s temporary mitigations while patching is underway alongside targeted WAF rules for these CVEs. |
SnapShooter | Affected | Handled by DigitalOcean | SnapShooter uses PHP in its service, and it is fully patched as of publication. You don’t need to do anything. |
Droplets | Not affected | Check your workloads | Droplets don’t include PHP by default. Customer Action: If you installed PHP on a Droplet, update it using the steps below. |
GPU Droplets, Bare Metal GPUs, AMD Developer Cloud | Not affected | Check your workloads | Same as Droplets: we don’t install PHP, but you manage the OS and anything you add to it. |
Paperspace | Not affected | Check your workloads | Paperspace machines and notebooks don’t include PHP by default. Update any PHP you installed. |
Kubernetes (DOKS) | Not affected | Check your workloads | The DOKS control plane and node components don’t use PHP. Customer Action: Rebuild any container images that include PHP with a patched version, then redeploy. |
MicroVMs | Not affected | Check your workloads | MicroVMs run the container image you supply. If it includes PHP, rebuild it with a patched version and redeploy. Checkpoints taken before the update still contain the old version. |
Managed Agents: Harness Runtime | Not affected | Check your workloads | Harness Runtime runs your agents and code in isolated sandboxes. If your custom template or your agent installs PHP, update it and rebuild the template. |
Container Registry | Not affected | Check your workloads | Container Registry stores images but doesn’t patch them. Images with an unpatched PHP stay vulnerable until you rebuild and push them. |
Snapshots, Backups, Custom Images | Not affected | Check your workloads | Restoring a snapshot, backup, or custom image from before you patched brings back the vulnerable PHP. Update PHP right after you restore. |
Inference (Serverless Inference, Dedicated Inference, Inference Router, Batch Inference) | Not affected | No action | Doesn’t use PHP. No action needed. |
Agent Platform (formerly GenAI Platform), Knowledge Bases, Evaluations, Signals | Not affected | No action | Doesn’t use PHP. No action needed. |
Managed Agents: Action Gateway | Not affected | No action | Doesn’t use PHP. No action needed. |
1-Click Models | Not affected | No action | 1-Click Model images don’t include PHP. No action needed. |
Managed Databases (all engines), Vector Databases | Not affected | No action | Doesn’t use PHP. No action needed. |
Spaces, Volumes, Network File Storage | Not affected | No action | Doesn’t use PHP. No action needed. |
Load Balancers, Cloud Firewalls, VPC, DNS, Reserved IPs, IPv6, DDoS Protection | Not affected | No action | Doesn’t use PHP. Cloud Firewalls can help you limit exposure while you patch. |
Monitoring, Uptime, Insights, CSPM, Projects | Not affected | No action | Doesn’t use PHP. No action needed. |
Launchpad starter kits | Not affected | No action | The current starter kits don’t include PHP. No action needed. |
Patching is the only complete fix, so start by finding every system that runs PHP, then work through the steps below:
Check your current PHP version:
php -v
Ubuntu and Debian:
sudo apt update
sudo apt install --only-upgrade 'php*'
CentOS, Fedora, Rocky Linux, AlmaLinux:
Note: As of publication, this family is still working on releasing patches. Once available, run the following commands:
sudo dnf upgrade 'php*'
Notes:
The table below lists security notices for each DigitalOcean-provided distribution.
Distribution | Security notice |
---|---|
Ubuntu | php2shell (CVE-2026-109618 and CVE-2026-109619) - PHP critical vulnerability fixes available |
Debian | N/A |
CentOS | N/A |
AlmaLinux | php2shell (CVE-2026-109618, CVE-2026-109619): Patched PHP packages available in testing |
Rocky Linux | N/A |
Fedora | N/A |
Update the PHP version in your base image or Dockerfile to a patched release, rebuild, and redeploy.
Updating the application alone may not update PHP. Check with your hosting setup or the software provider for patched PHP and any application-level updates.
As part of our shared responsibility model, we are taking the following actions:
Our Support team is available to answer questions about remediation. If you’d rather not manage PHP patching yourself, our Cloudways managed hosting options handle platform-level updates for you.
If you found this blog because you suspect a resource from DigitalOcean may be compromised, please file an abuse complaint. Please be sure to include an IP address, time stamp, and description/logs of what is happening.
If you have previously deployed a Marketplace 1-Click App from the following list, we encourage you to update it as soon as possible. Check the PHP version resident and understand if the PHP version in use is consistent with the versions receiving updates.
What exactly happened and does it affect me?
Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026. These vulnerabilities allow an attacker to execute arbitrary code on servers running PHP, potentially resulting in full compromise of the affected system.
If any server you run uses PHP, assume yes until you’ve checked. That includes WordPress, Magento, Drupal, Laravel, control panels, and forgotten internal tools.
Would my resources be an actual target?
Attacks are opportunistic, and while your website may not be a direct first target, attackers will often scan for any available servers that remain vulnerable and carry out an attack.
Compromised servers are commonly used for crypto mining, spam or phishing hosting, botnets, DDoS, stolen credentials and data, and a foothold for ransomware.
How do I check to see what version of PHP I’m running?
The exact method can vary, but using standard Linux distributions, run the following command to determine the current PHP version:
php -v
Which versions will be able to be updated?
Not all versions of PHP can be patched. There is no patch available for 8.1 or earlier.
The patched versions of PHP are:
I updated my Droplet, do I need to reboot?
Ideally yes, however simply restarting PHP-FPM or Apache is enough to cycle out still vulnerable processes. This is a commonly missed step.
If I don’t have the appropriate PHP version, are there any other workarounds or temporary fixes?
You should prioritize updating your PHP to a compatible version for the patch. However, the PHP Foundation shares measures to reduce exposure to specific attack paths. This does not make your installation of PHP safe, and you should update as soon as possible.
Will you patch this for me?
We can’t patch PHP on your behalf. Under our Shared Responsibility Model:
DigitalOcean secures the assets of your cloud instance, such as physical security and the virtualization layer. We are patching PHP in our Platform-as-a-Service and Software-as-a-Service products, such as App Platform, Cloudways, and Functions, where the runtime is our responsibility.
You secure what’s in your cloud instance, including the operating system and software you install on your Droplet. PHP runs inside your instance, so updating it is your responsibility.
How can I confirm that I am fully patched when done?
Check your version against the fixed list (8.5.12, 8.4.27, 8.3.36, 8.2.35). If you installed PHP through your OS package manager, the version number may not change, so check the package changelog for CVE-2026-109618 and CVE-2026-109619 instead. Then restart PHP-FPM or Apache.
How do I know if my website has been negatively impacted or exploited?
Patching closes the hole, but it doesn’t remove the impact of an attacker who got in before you updated. First, prioritize the update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distro’s patched package), restart PHP-FPM or Apache, and then check for the signs below.
One thing to keep in mind is that an attempt isn’t a compromise. Many will fail, especially on patched servers.