Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)

Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) | DigitalOcean

© 2026 DigitalOcean, LLC. Sitemap .

Trust & Security

Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)

By Tim Lisko

Deputy CISO

Updated: October 21, 2026 10 min read

<- Back to blog home

DigitalOcean is aware of two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 , publicly disclosed on October 21, 2026. Either allows an attacker to execute arbitrary code on a server running PHP, potentially resulting in full compromise of the affected system. Proof-of-concept exploit code is publicly available, and there are no complete mitigations except patching. Updating PHP to a patched version is the only safe path to protection.

PHP powers a significant share of the web, including Cloudways by DigitalOcean, and technologies like WordPress, Drupal, Laravel, and custom applications deployed on the DigitalOcean platform. We are notifying all DigitalOcean customers to check both your DigitalOcean-hosted assets and the rest of your stack. Cloudways, our managed product, is automatically patching WordPress instances on your behalf. However, for non-managed services and your other infrastructure, this issue warrants taking action to ensure safety.

Who is affected

These vulnerabilities affect every PHP version from PHP 5 onward. If you run PHP anywhere in your DigitalOcean infrastructure, consider yourself potentially in scope until you&#x2019;ve patched. That includes Droplets, DOKS workloads, App Platform apps or custom containers, and previously deployed Marketplace 1-Click images (including but not limited to WordPress, LAMP, LEMP, and Laravel).

The PHP project has released fixes for the following versions:

PHP branch Patched version

8.5 8.5.12

8.4 8.4.27

8.3 8.3.36

8.2 8.2.35

8.1 or earlier No patch available

Patches are only available for currently supported PHP versions (8.2 and later). If you&#x2019;re running an end-of-life version (8.1 or earlier), no official patch will be available. Plan an immediate upgrade to a supported version.

Affected DigitalOcean products

Product Product status Your action Status line

Marketplace 1-Click images Affected Update existing deployments We&#x2019;ve delisted affected 1-Click images until they&#x2019;re patched, so new deployments don&#x2019;t start out vulnerable. Customer Action : Instances you already deployed don&#x2019;t update themselves. Update PHP on them now. See the Marketplace appendix .

Functions Affected Redeploy after our update (proposed) Functions offers PHP runtimes (8.2, 8.3, 8.4, 8.5). Runtimes have been patched and 8.0 has been deprecated. Customer action : Redeploy to pick up the new levels.

App Platform Affected Redeploy after our update PHP buildpack has been patched. Customer Action : Redeploy applications to pick up the latest buildpack and safe PHP. If you deploy from your own Dockerfile or container image, update the PHP version in that image and redeploy.

Cloudways Affected Handled by DigitalOcean Cloudways is actively patching PHP versions 5.6 and above currently supported across Cloudways platform, leveraging extended LTS partnership support for older PHP instances. We are not forcing customers to migrate to newer PHP versions. Follow along at status.cloudways.com for up-to-date progress. Patching is currently in progress. We have applied PHP&#x2019;s temporary mitigations while patching is underway alongside targeted WAF rules for these CVEs.

SnapShooter Affected Handled by DigitalOcean SnapShooter uses PHP in its service, and it is fully patched as of publication. You don&#x2019;t need to do anything.

Droplets Not affected Check your workloads Droplets don&#x2019;t include PHP by default. Customer Action : If you installed PHP on a Droplet, update it using the steps below .

GPU Droplets, Bare Metal GPUs, AMD Developer Cloud Not affected Check your workloads Same as Droplets: we don&#x2019;t install PHP, but you manage the OS and anything you add to it.

Paperspace Not affected Check your workloads Paperspace machines and notebooks don&#x2019;t include PHP by default. Update any PHP you installed.

Kubernetes (DOKS) Not affected Check your workloads The DOKS control plane and node components don&#x2019;t use PHP. Customer Action : Rebuild any container images that include PHP with a patched version, then redeploy.

MicroVMs Not affected Check your workloads MicroVMs run the container image you supply. If it includes PHP, rebuild it with a patched version and redeploy. Checkpoints taken before the update still contain the old version.

Managed Agents: Harness Runtime Not affected Check your workloads Harness Runtime runs your agents and code in isolated sandboxes. If your custom template or your agent installs PHP, update it and rebuild the template.

Container Registry Not affected Check your workloads Container Registry stores images but doesn&#x2019;t patch them. Images with an unpatched PHP stay vulnerable until you rebuild and push them.

Snapshots, Backups, Custom Images Not affected Check your workloads Restoring a snapshot, backup, or custom image from before you patched brings back the vulnerable PHP. Update PHP right after you restore.

Inference (Serverless Inference, Dedicated Inference, Inference Router, Batch Inference) Not affected No action Doesn&#x2019;t use PHP. No action needed.

Agent Platform (formerly GenAI Platform), Knowledge Bases, Evaluations, Signals Not affected No action Doesn&#x2019;t use PHP. No action needed.

Managed Agents: Action Gateway Not affected No action Doesn&#x2019;t use PHP. No action needed.

1-Click Models Not affected No action 1-Click Model images don&#x2019;t include PHP. No action needed.

Managed Databases (all engines), Vector Databases Not affected No action Doesn&#x2019;t use PHP. No action needed.

Spaces, Volumes, Network File Storage Not affected No action Doesn&#x2019;t use PHP. No action needed.

Load Balancers, Cloud Firewalls, VPC, DNS, Reserved IPs, IPv6, DDoS Protection Not affected No action Doesn&#x2019;t use PHP. Cloud Firewalls can help you limit exposure while you patch.

Monitoring, Uptime, Insights, CSPM, Projects Not affected No action Doesn&#x2019;t use PHP. No action needed.

Launchpad starter kits Not affected No action The current starter kits don&#x2019;t include PHP. No action needed.

What you should do now to defend against...