Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)

DigitalOcean is aware of two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, publicly disclosed on October 21, 2026. Either allows an attacker to execute arbitrary code on a server running PHP, potentially resulting in full compromise of the affected system. Proof-of-concept exploit code is publicly available, and there are no complete mitigations except patching. Updating PHP to a patched version is the only safe path to protection.

PHP powers a significant share of the web, including Cloudways by DigitalOcean, and technologies like WordPress, Drupal, Laravel, and custom applications deployed on the DigitalOcean platform. We are notifying all DigitalOcean customers to check both your DigitalOcean-hosted assets and the rest of your stack. Cloudways, our managed product, is automatically patching WordPress instances on your behalf. However, for non-managed services and your other infrastructure, this issue warrants taking action to ensure safety.

Who is affected

These vulnerabilities affect every PHP version from PHP 5 onward. If you run PHP anywhere in your DigitalOcean infrastructure, consider yourself potentially in scope until you’ve patched. That includes Droplets, DOKS workloads, App Platform apps or custom containers, and previously deployed Marketplace 1-Click images (including but not limited to WordPress, LAMP, LEMP, and Laravel).

The PHP project has released fixes for the following versions:

Patches are only available for currently supported PHP versions (8.2 and later). If you’re running an end-of-life version (8.1 or earlier), no official patch will be available. Plan an immediate upgrade to a supported version.

Affected DigitalOcean products

What you should do now to defend against CVE-2026-109618 and CVE-2026-109619

Patching is the only complete fix, so start by finding every system that runs PHP, then work through the steps below:

1. Inventory every system running PHP. Include bundled installs you may not think of as “PHP servers,” such as WordPress and other CMS instances, admin panels (for example, phpMyAdmin), and legacy apps.
2. Patch immediately. Patches for PHP are available. If you run PHP-based software, such as WordPress or Laravel, you may also need provider-specific patches from those providers.
3. If you’re on PHP 8.1 or earlier, upgrade to PHP 8.2 or later so you can apply the patch. End-of-life versions will not receive official fixes.
4. If you can’t update immediately, refer to the PHP Foundation’s published measures to reduce exposure to specific attack paths. These do not make your installation safe on their own, so make a plan to update as soon as possible.
5. Reduce the blast radius where practical. Restrict public access to PHP applications that don’t need to be internet-facing, and make sure firewall/WAF rules and monitoring are in place.

Action for Droplets

Customer-managed Droplets

Check your current PHP version:

php -v

Ubuntu and Debian:

sudo apt update
sudo apt install --only-upgrade 'php*'

CentOS, Fedora, Rocky Linux, AlmaLinux:

Note: As of publication, this family is still working on releasing patches. Once available, run the following commands:

sudo dnf upgrade 'php*'

Notes:

1. Restart PHP-FPM or your web server after updating so the new version is loaded.
2. If your distribution’s repositories don’t yet offer a patched version, check the distribution’s security notice or upgrade to a supported PHP branch from a trusted repository.
3. It’s always a good idea to update your entire system, but be aware this may introduce breaking changes. Test first where you can.

Actions we’re taking to protect DigitalOcean customers

• Notifying customers: We’re contacting all DigitalOcean customers by email, and proactively reaching out to managed accounts.
• Marketplace: We’ve suspended affected 1-Click images until they are patched.
• Platform updates: We are patching affected runtimes and managed services.
• Protecting the network: To protect our broader community and network integrity, DigitalOcean may temporarily restrict traffic to resources showing signs of compromise. We encourage you to patch immediately so your services stay online and unaffected.

CVE-2026-109618, CVE-2026-109619 Vulnerability FAQs

What exactly happened and does it affect me?

Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026. These vulnerabilities allow an attacker to execute arbitrary code on servers running PHP, potentially resulting in full compromise of the affected system.

Would my resources be an actual target?

Attacks are opportunistic, and while your website may not be a direct first target, attackers will often scan for any available servers that remain vulnerable and carry out an attack.

How do I check to see what version of PHP I’m running?

The exact method can vary, but using standard Linux distributions, run the following command to determine the current PHP version:

php -v

Will you patch this for me?

We can’t patch PHP on your behalf. Under our Shared Responsibility Model: DigitalOcean secures the assets of your cloud instance, such as physical security and the virtualization layer. You secure what’s in your cloud instance, including the operating system and software you install on your Droplet.

How can I confirm that I am fully patched when done?

Check your version against the fixed list (8.5.12, 8.4.27, 8.3.36, 8.2.35). If you installed PHP through your OS package manager, the version number may not change, so check the package changelog for CVE-2026-109618 and CVE-2026-109619 instead. Then restart PHP-FPM or Apache.