{"schema_version":"onlylabs.public_signal.v1","title":"DigitalOcean (GradientAI) Writing: Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","description":"DigitalOcean (GradientAI) writing signal with public source context, captured evidence pages, related signals, and category-scoped analysis context.","url":"https://onlylabs.fyi/signals/a92200d9-4f8f-40b0-aa32-1839adba50d0","json_url":"https://onlylabs.fyi/signals/a92200d9-4f8f-40b0-aa32-1839adba50d0/signal.json","generated_at":"2026-10-24T20:19:58.661Z","evidence_latest_fetched_at":"2026-10-22T00:02:39.001815+00:00","signal_first_seen_at":"2026-10-22T00:00:51.355421+00:00","org":{"slug":"digitalocean","name":"DigitalOcean (GradientAI)","category":"neocloud","category_label":"Neocloud","dossier_url":"https://onlylabs.fyi/labs/digitalocean","dossier_json_url":"https://onlylabs.fyi/labs/digitalocean/dossier.json"},"related_urls":{"signal":"https://onlylabs.fyi/signals/a92200d9-4f8f-40b0-aa32-1839adba50d0","signal_json":"https://onlylabs.fyi/signals/a92200d9-4f8f-40b0-aa32-1839adba50d0/signal.json","source":"https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now","lab_dossier":"https://onlylabs.fyi/labs/digitalocean","lab_dossier_json":"https://onlylabs.fyi/labs/digitalocean/dossier.json","analysis":"https://onlylabs.fyi/analysis/digitalocean","analysis_json":"https://onlylabs.fyi/analysis/digitalocean/analysis.json","analysis_evidence_json":"https://onlylabs.fyi/analysis/digitalocean/evidence.json","category":"https://onlylabs.fyi/neoclouds","category_json":"https://onlylabs.fyi/neoclouds.json","category_feed":"https://onlylabs.fyi/neoclouds/feed.xml","category_signals_json":"https://onlylabs.fyi/signals.json?category=neocloud","topic":"https://onlylabs.fyi/topics/talking","topic_signals_json":"https://onlylabs.fyi/topics/talking/signals.json?category=neocloud","topic_feed":"https://onlylabs.fyi/topics/talking/feed.xml?category=neocloud","data_business":null},"answer_pack":{"answer":"DigitalOcean (GradientAI) published Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619). This talking signal gives public context for research themes, product direction, policy, or launch framing. High-signal details: Not an AI-lab event. · Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) | DigitalOcean © 2026 DigitalOcean, LLC. Sitemap . Trust & Security Critical PHP RCE.... onlylabs links this event to 1 captured evidence page and 6 related writing signals.","signal_desk":"talking","source_context":{"source_url":"https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now","source_host":"digitalocean.com","occurred_at":"2026-10-21T21:46:53.195+00:00","first_seen_at":"2026-10-22T00:00:51.355421+00:00","date_source":"rss.item_date","context":null},"context_markers":[{"label":"Lab","value":"DigitalOcean (GradientAI)","source":"signal"},{"label":"Signal desk","value":"talking","source":"signal"},{"label":"Source host","value":"digitalocean.com","source":"source"},{"label":"Notability","value":"Not an AI-lab event.","source":"signal"},{"label":"Watch term","value":"Eval methodology","source":"evidence"},{"label":"Watch term","value":"Infrastructure","source":"evidence"},{"label":"Watch term","value":"Safety and alignment","source":"evidence"},{"label":"Watch term","value":"Agents and tool use","source":"evidence"}],"evidence_coverage":{"target_pages":1,"captured_pages":1,"readable_pages":1,"capture_methods":["plain"],"missing_page_urls":[],"failed_page_urls":[],"blocked_page_urls":[],"page_urls":["https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now"],"related_signals":6,"has_source_url":true,"latest_page_fetched_at":"2026-10-22T00:02:39.001815+00:00"},"data_business":{"matches":false,"lanes":[],"matched_terms":[],"score":null,"reason":null},"agent_handoff":{"signal_json":"https://onlylabs.fyi/signals/a92200d9-4f8f-40b0-aa32-1839adba50d0/signal.json","dossier_json":"https://onlylabs.fyi/labs/digitalocean/dossier.json","analysis_json":"https://onlylabs.fyi/analysis/digitalocean/analysis.json","analysis_evidence_json":"https://onlylabs.fyi/analysis/digitalocean/evidence.json","topic_signals_json":"https://onlylabs.fyi/topics/talking/signals.json?category=neocloud","topic_feed":"https://onlylabs.fyi/topics/talking/feed.xml?category=neocloud","category_signals_json":"https://onlylabs.fyi/signals.json?category=neocloud","data_radar_json":null,"opportunities_json":null},"analysis_playbook":{"objective":"Turn public writing and discussion into a readable map of research themes, product framing, policy posture, launch narratives, and market attention.","evidence_focus":["post title","source URL","captured page text","HN traction","linked model or paper references","publication date"],"extraction_questions":["Which themes are labs choosing to explain publicly?","Which posts are attracting outside discussion?","Which writing reframes a recent release, model, hiring wave, or policy stance?","Which posts mention data, evals, infrastructure, safety, or deployment workflows?"],"signal_questions":["What public theme, launch framing, or research direction does this writing signal expose?","Which themes are labs choosing to explain publicly?","Which posts are attracting outside discussion?","Do the 6 related writing signals show a repeated pattern?"],"output_fields":["org","theme","public_framing","traction","evidence_url"],"data_business_relevance":"Data-business lane extraction is scoped to frontier labs; for this category, keep conclusions tied to category-specific strategy, source evidence, and follow-up questions.","required_sources":[{"label":"signal_json","url":"https://onlylabs.fyi/signals/a92200d9-4f8f-40b0-aa32-1839adba50d0/signal.json","required":true},{"label":"source","url":"https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now","required":true},{"label":"dossier_json","url":"https://onlylabs.fyi/labs/digitalocean/dossier.json","required":true},{"label":"analysis_evidence_json","url":"https://onlylabs.fyi/analysis/digitalocean/evidence.json","required":true},{"label":"topic_signals_json","url":"https://onlylabs.fyi/topics/talking/signals.json?category=neocloud","required":false},{"label":"data_radar_json","url":null,"required":false}],"expected_output":["one-paragraph source-grounded interpretation","category-specific implication","confidence and missing evidence","recommended next source to inspect"],"prompt_seed":"Using only the linked onlylabs JSON, captured source context, and cited evidence, analyze DigitalOcean (GradientAI)'s writing signal \"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)\" for neocloud strategy."},"semantic_triples":[{"subject":"DigitalOcean (GradientAI)","predicate":"published","object":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","text":"DigitalOcean (GradientAI) published Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"is classified as","object":"writing signal","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) is classified as writing signal."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"belongs to","object":"talking desk","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) belongs to talking desk."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has evidence coverage","object":"1 captured evidence page","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has evidence coverage 1 captured evidence page."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has captured page count","object":"1","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has captured page count 1."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has readable page count","object":"1","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has readable page count 1."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has related signal count","object":"6","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has related signal count 6."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has analysis playbook objective","object":"Turn public writing and discussion into a readable map of research themes, product framing, policy posture, launch narratives, and market attention.","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has analysis playbook objective Turn public writing and discussion into a readable map of research themes, product framing, policy posture, launch narratives, and market attention.."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has source host","object":"digitalocean.com","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has source host digitalocean.com."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has lab","object":"DigitalOcean (GradientAI)","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has lab DigitalOcean (GradientAI)."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has signal desk","object":"talking","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has signal desk talking."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has source host","object":"digitalocean.com","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has source host digitalocean.com."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has notability","object":"Not an AI-lab event.","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has notability Not an AI-lab event.."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has watch term","object":"Eval methodology","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has watch term Eval methodology."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has watch term","object":"Infrastructure","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has watch term Infrastructure."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has watch term","object":"Safety and alignment","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has watch term Safety and alignment."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has watch term","object":"Agents and tool use","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has watch term Agents and tool use."}]},"intelligence":{"signal_desk":"talking","answer":"DigitalOcean (GradientAI) published Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619). This talking signal gives public context for research themes, product direction, policy, or launch framing. High-signal details: Not an AI-lab event. · Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) | DigitalOcean © 2026 DigitalOcean, LLC. Sitemap . Trust & Security Critical PHP RCE.... onlylabs links this event to 1 captured evidence page and 6 related writing signals.","semantic_triples":[{"subject":"DigitalOcean (GradientAI)","predicate":"published","object":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","text":"DigitalOcean (GradientAI) published Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"is classified as","object":"writing signal","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) is classified as writing signal."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"belongs to","object":"talking desk","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) belongs to talking desk."},{"subject":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","predicate":"has evidence coverage","object":"1 captured evidence page","text":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) has evidence coverage 1 captured evidence page."}]},"signal":{"id":"a92200d9-4f8f-40b0-aa32-1839adba50d0","url":"https://onlylabs.fyi/signals/a92200d9-4f8f-40b0-aa32-1839adba50d0","json_url":"https://onlylabs.fyi/signals/a92200d9-4f8f-40b0-aa32-1839adba50d0/signal.json","source_url":"https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now","title":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","summary":"DigitalOcean (GradientAI) published a writing signal. onlylabs watches public writing for research themes, product direction, and model-launch context.","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"digitalocean","name":"DigitalOcean (GradientAI)","category":"neocloud"},"occurred_at":"2026-10-21T21:46:53.195+00:00","first_seen_at":"2026-10-22T00:00:51.355421+00:00","date_source":"rss.item_date","evidence_coverage":{"target_pages":1,"captured_pages":1,"readable_pages":1,"capture_methods":["plain"],"missing_page_urls":[],"failed_page_urls":[],"blocked_page_urls":[],"page_urls":["https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now"]},"facets":{},"traction":{"github_stars":null,"hn_points":null,"hn_comments":null,"hn_story_id":null,"hf_downloads":null,"hf_likes":null},"data_radar":null},"primary_evidence_page":{"is_primary":true,"source_match":true,"url":"https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now","final_url":"https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now","title":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)","http_status":200,"content_type":"text/html; charset=utf-8","capture_method":"plain","fetched_at":"2026-10-22T00:02:39.001815+00:00","bytes":267215,"raw_path":"b1de6e2baff7fc0ac35581e1d0a13153e390600ed3af2a8b3da9265cacef53c2.html","content_hash":"f8610a8849a256f2879d05d5937d448fe7138fe02018d82883fc41281ba1710c","excerpt_chars":1200,"truncated":true,"excerpt":"Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) | DigitalOcean © 2026 DigitalOcean, LLC. Sitemap . Trust & Security Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) By Tim Lisko Deputy CISO Updated: October 21, 2026 10 min read <- Back to blog home DigitalOcean is aware of two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 , publicly disclosed on October 21, 2026. Either allows an attacker to execute arbitrary code on a server running PHP, potentially resulting in full compromise of the affected system. Proof-of-concept exploit code is publicly available, and there are no complete mitigations except patching. Updating PHP to a patched version is the only safe path to protection. PHP powers a significant share of the web, including Cloudways by DigitalOcean, and technologies like WordPress, Drupal, Laravel, and custom applications deployed on the DigitalOcean platform. We are notifying all DigitalOcean customers to check both your DigitalOcean-hosted assets and the rest of your stack. Cloudways, our managed product, is automatically patching WordPress instances..."},"evidence_pages":[],"related_signals":[{"id":"cc0cf4be-0562-4ee8-8146-887b611b4a90","url":"https://onlylabs.fyi/signals/cc0cf4be-0562-4ee8-8146-887b611b4a90","source_url":"https://www.digitalocean.com/blog/digitalocean-signals-observability-ai-agents-inference","title":"DigitalOcean Signals: Observability for AI Agents and Inference","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"digitalocean","name":"DigitalOcean (GradientAI)","category":"neocloud"},"occurred_at":"2026-10-23T18:57:12.071+00:00","first_seen_at":"2026-10-23T20:00:50.025765+00:00","date_source":"rss.item_date"},{"id":"c8641109-6f86-425b-b4d0-50b890150dc5","url":"https://onlylabs.fyi/signals/c8641109-6f86-425b-b4d0-50b890150dc5","source_url":"https://www.digitalocean.com/blog/now-available-prompt-caching","title":"Prompt Caching is GA on DigitalOcean Serverless Inference: Up to 90% Off the Context Your Agents Resend","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"digitalocean","name":"DigitalOcean (GradientAI)","category":"neocloud"},"occurred_at":"2026-10-23T16:48:34.155+00:00","first_seen_at":"2026-10-23T20:00:50.025765+00:00","date_source":"rss.item_date"},{"id":"8719371c-b987-4824-8e34-0a8df632e6a7","url":"https://onlylabs.fyi/signals/8719371c-b987-4824-8e34-0a8df632e6a7","source_url":"https://www.digitalocean.com/blog/securing-agentic-software-development","title":"Product Security in the Post-AI Era","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"digitalocean","name":"DigitalOcean (GradientAI)","category":"neocloud"},"occurred_at":"2026-10-21T14:57:50.164+00:00","first_seen_at":"2026-10-21T16:00:49.529892+00:00","date_source":"rss.item_date"},{"id":"332fed48-cec1-4aed-9cf5-f9e3b00e39c8","url":"https://onlylabs.fyi/signals/332fed48-cec1-4aed-9cf5-f9e3b00e39c8","source_url":"https://www.digitalocean.com/blog/microvm-architecture","title":"Building a computer that can pause and resume in milliseconds: Inside the MicroVM architecture behind Managed Agents","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"digitalocean","name":"DigitalOcean (GradientAI)","category":"neocloud"},"occurred_at":"2026-10-15T16:29:58.415+00:00","first_seen_at":"2026-10-15T20:00:50.115462+00:00","date_source":"rss.item_date"},{"id":"46b8245c-8568-466b-a07b-e7845d5668f0","url":"https://onlylabs.fyi/signals/46b8245c-8568-466b-a07b-e7845d5668f0","source_url":"https://www.digitalocean.com/blog/action-gateway-managed-agents","title":"Inside Action Gateway in Managed Agents","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"digitalocean","name":"DigitalOcean (GradientAI)","category":"neocloud"},"occurred_at":"2026-10-13T17:26:28.517+00:00","first_seen_at":"2026-10-13T20:00:49.326086+00:00","date_source":"rss.item_date"},{"id":"80b26312-560a-4241-b581-8f7e858d7acc","url":"https://onlylabs.fyi/signals/80b26312-560a-4241-b581-8f7e858d7acc","source_url":"https://www.digitalocean.com/blog/inference-router-enhancements","title":"DigitalOcean Inference Router Enhancements: Performance Tuned Routing, No Rules to Write","context":null,"kind":{"key":"post_published","label":"Writing"},"org":{"slug":"digitalocean","name":"DigitalOcean (GradientAI)","category":"neocloud"},"occurred_at":"2026-10-12T00:00:00.000Z","first_seen_at":"2026-10-13T20:00:49.326086+00:00","date_source":"page.visible_date"}]}