Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619)

DigitalOcean is aware of two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, publicly disclosed on October 21, 2026. Either allows an attacker to execute arbitrary code on a server running PHP, potentially resulting in full compromise of the affected system. Proof-of-concept exploit code is publicly available, and there are no complete mitigations except patching. Updating PHP to a patched version is the only safe path to protection.

PHP powers a significant share of the web, including Cloudways by DigitalOcean, and technologies like WordPress, Drupal, Laravel, and custom applications deployed on the DigitalOcean platform. We are notifying all DigitalOcean customers to check both your DigitalOcean-hosted assets and the rest of your stack. Cloudways, our managed product, is automatically patching WordPress instances on your behalf. However, for non-managed services and your other infrastructure, this issue warrants taking action to ensure safety.

Who is affected

These vulnerabilities affect every PHP version from PHP 5 onward. If you run PHP anywhere in your DigitalOcean infrastructure, consider yourself potentially in scope until you’ve patched. That includes Droplets, DOKS workloads, App Platform apps or custom containers, and previously deployed Marketplace 1-Click images (including but not limited to WordPress, LAMP, LEMP, and Laravel).

The PHP project has released fixes for the following versions:

Patches are only available for currently supported PHP versions (8.2 and later). If you’re running an end-of-life version (8.1 or earlier), no official patch will be available. Plan an immediate upgrade to a supported version.

Affected DigitalOcean products

What you should do now to defend against CVE-2026-109618 and CVE-2026-109619

Patching is the only complete fix, so start by finding every system that runs PHP, then work through the steps below:

1. Inventory every system running PHP. Include bundled installs you may not think of as “PHP servers,” such as WordPress and other CMS instances, admin panels (for example, phpMyAdmin), and legacy apps.
2. Patch immediately. Patches for PHP are available. If you run PHP-based software, such as WordPress or Laravel, you may also need provider-specific patches from those providers.
3. If you’re on PHP 8.1 or earlier, upgrade to PHP 8.2 or later so you can apply the patch. End-of-life versions will not receive official fixes.
4. If you can’t update immediately, refer to the PHP Foundation’s published measures to reduce exposure to specific attack paths. These do not make your installation safe on their own, so make a plan to update as soon as possible.
5. Reduce the blast radius where practical. Restrict public access to PHP applications that don’t need to be internet-facing, and make sure firewall/WAF rules and monitoring are in place. If your site is behind Cloudflare, they have released emergency WAF rules to put in place.

Action for Droplets

Customer-managed Droplets

Check your current PHP version:

php -v

Ubuntu and Debian:

sudo apt update
sudo apt install --only-upgrade 'php*'

CentOS, Fedora, Rocky Linux, AlmaLinux:

Note: As of publication, this family is still working on releasing patches. Once available, run the following commands:

sudo dnf upgrade 'php*'

Notes:

1. Restart PHP-FPM or your web server after updating so the new version is loaded.
2. If your distribution’s repositories don’t yet offer a patched version, check the distribution’s security notice (table below) or upgrade to a supported PHP branch from a trusted repository.
3. It’s always a good idea to update your entire system, but be aware this may introduce breaking changes. Test first where you can.

The table below lists security notices for each DigitalOcean-provided distribution.

Containerized workloads (DOKS and App Platform custom containers)

Update the PHP version in your base image or Dockerfile to a patched release, rebuild, and redeploy.

WordPress, Drupal, Laravel, and other PHP software

Updating the application alone may not update PHP. Check with your hosting setup or the software provider for patched PHP and any application-level updates.

Actions we’re taking to protect DigitalOcean customers

As part of our shared responsibility model, we are taking the following actions:

• Notifying customers: We’re contacting all DigitalOcean customers by email, and proactively reaching out to managed accounts.
• Marketplace: We’ve suspended affected 1-Click images until they are patched.
• Platform updates: We are patching affected runtimes and managed services. See Affected DigitalOcean products for product details.
• Protecting the network: To protect our broader community and network integrity, DigitalOcean may temporarily restrict traffic to resources showing signs of compromise. We encourage you to patch immediately so your services stay online and unaffected.

Need help?

Our Support team is available to answer questions about remediation. If you’d rather not manage PHP patching yourself, our Cloudways managed hosting options handle platform-level updates for you.

Contact Support

Seeing vulnerability abuse from DigitalOcean?

If you found this blog because you suspect a resource from DigitalOcean may be compromised, please file an abuse complaint. Please be sure to include an IP address, time stamp, and description/logs of what is happening.

Marketplace appendix

If you have previously deployed a Marketplace 1-Click App from the following list, we encourage you to update it as soon as possible. Check the PHP version resident and understand if the PHP version in use is consistent with the versions receiving updates.

DigitalOcean Marketplace vendor 1-Click Apps

• WordPress
• LAMPLEMP
• Craft CMS
• PhpMyAdmin
• Laravel + MySQL
• MySQL bundles phpMyAdmin
• Codex Universal, which includes PHP 8.4 among its many language runtimes.
• Coolify

Third-party Marketplace vendor 1-Click Apps

• aaPanel
• aaPanel LNMP
• AdminBolt
• Akaunting
• ApisCP
• Appwrite
• AzuraCast
• Bagisto
• Caligrafy
• Chamilo
• Chevereto
• Chevereto-Free
• CloudPanel 2 - Ubuntu 24.04
• cPanel & WHM® for AlmaLinux 9
• cPanel & WHM® for Ubuntu
• CyberPanel
• CyberPanel Joomla
• FASTPANEL
• FreePBX®
• HumHub
• IceWarp
• Ispmanager 6
• Keitaro
• Laranode Panel
• Laravel
• LaunchWP[.]io
• Live Helper Chat
• LMS Friendly Installation
• Magento 2 Open Source
• moodle
• NethServer
• Nextcloud
• NextGenSwitch
• NovoSGA
• Open Source Social Network
• OpenCart
• OpenLiteSpeed ClassicPress
• OpenLiteSpeed Django
• OpenLiteSpeed Drupal
• OpenLiteSpeed Joomla
• OpenLiteSpeed NodeJS
• OpenLiteSpeed Rails
• OpenLiteSpeed WordPress
• OpenPanel
• Panelica Hosting Panel
• Passbolt CE
• Plesk
• Plesk (AlmaLinux)
• PrestaShop
• QloApps
• Restyaboard
• Restyaboard (CentOS)
• RunCloud-20.04
• RunCloud-24.04 (NGINX, MariaDB)
• RunCloud-24.04 (NGINX, MySQL)
• RunCloud-24.04 (OLS, MariaDB)
• RunCloud-24.04 (OLS, MySQL)
• ServerWand
• SWPanel
• VitalPBX
• WHMCS
• WordPress-WooCommerce
• WP Squared
• wpcontroller
• Zabbix server
• Zabbix Server 6.4
• ZesleCP

CVE-2026-109618, CVE-2026-109619 Vulnerability FAQs

What exactly happened and does it affect me?

Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026. These vulnerabilities allow an attacker to execute arbitrary code on servers running PHP, potentially resulting in full compromise of the affected system.

If any server you run uses PHP, assume yes until you’ve checked. That includes WordPress, Magento, Drupal, Laravel, control panels, and forgotten internal tools.

Would my resources be an actual target?

Attacks are opportunistic, and while your website may not be a direct first target, attackers will often scan for any available servers that remain vulnerable and carry out an attack.

Compromised servers are commonly used for crypto mining, spam or phishing hosting, botnets, DDoS, stolen credentials and data, and a foothold for ransomware.

How do I check to see what version of PHP I’m running?

The exact method can vary, but using standard Linux distributions, run the following command to determine the current PHP version:

php -v

Which versions will be able to be updated?

Not all versions of PHP can be patched. There is no patch available for 8.1 or earlier.

The patched versions of PHP are:

• 8.5.12
• 8.4.27
• 8.3.36
• 8.2.35

I updated my Droplet, do I need to reboot?

Ideally yes, however simply restarting PHP-FPM or Apache is enough to cycle out still vulnerable processes. This is a commonly missed step.

If I don’t have the appropriate PHP version, are there any other workarounds or temporary fixes?

You should prioritize updating your PHP to a compatible version for the patch. However, the PHP Foundation shares measures to reduce exposure to specific attack paths. This does not make your installation of PHP safe, and you should update as soon as possible.

Will you patch this for me?

We can’t patch PHP on your behalf. Under our Shared Responsibility Model:

DigitalOcean secures the assets of your cloud instance, such as physical security and the virtualization layer. We are patching PHP in our Platform-as-a-Service and Software-as-a-Service products, such as App Platform, Cloudways, and Functions, where the runtime is our responsibility.

You secure what’s in your cloud instance, including the operating system and software you install on your Droplet. PHP runs inside your instance, so updating it is your responsibility.

How can I confirm that I am fully patched when done?

Check your version against the fixed list (8.5.12, 8.4.27, 8.3.36, 8.2.35). If you installed PHP through your OS package manager, the version number may not change, so check the package changelog for CVE-2026-109618 and CVE-2026-109619 instead. Then restart PHP-FPM or Apache.

How do I know if my website has been negatively impacted or exploited?

Patching closes the hole, but it doesn’t remove the impact of an attacker who got in before you updated. First, prioritize the update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distro’s patched package), restart PHP-FPM or Apache, and then check for the signs below.

One thing to keep in mind is that an attempt isn’t a compromise. Many will fail, especially on patched servers.