PHP2Shell statement record · Host
Status in the company's own words: patched partly. Statement dated Updated: October 21, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.digitalocean.com, dated Updated: October 21, 2026. Source type: official page.Droplets don't include PHP by default.
Droplets don't include PHP by default.
(customers who installed PHP must update it); App Platform PHP buildpack patched: Redeploy applications to pick up the latest buildpack and safe PHP.
; 1-Click/Marketplace: Instances you already deployed don't update themselves. Update PHP on them now.
; Restart PHP-FPM or your web server after updating so the new version is loaded.
; If you're running an end-of-life version (8.1 or earlier), no official patch will be available.
quoted from https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now (author Tim Lisko, Deputy CISO). Functions runtimes patched (PHP 8.0 deprecated); SnapShooter fully patched; Cloudways patching 5.6 and above; Managed Databases not affected. Mixed: managed products patched or require redeploy, unmanaged compute is the customer's responsibility.
no status named
Yes—some DigitalOcean products were affected, and patches have been deployed, but customer-managed PHP workloads are not automatically fixed. DigitalOcean’s official advisory explicitly covers both CVE-2026-109618 and CVE-2026-109619. Status as of October 23, 2026: | Product | Patch status / required action | |---|---| | App Platform | PHP buildpack patched. Redeploy applications to receive the fix; custom containers require
no status named
Yes, DigitalOcean is aware of and affected by PHP2Shell, and has communicated patch availability. Here is a detailed breakdown: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): DigitalOcean's Status What is PHP2Shell? PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP that can allow unauthenticated remote code execution. Specifically: CVE-2026-109618 – RCE via OOM corruption: out-of-memory handling can interrupt PHP while
no status named
Yes. DigitalOcean is affected wherever customers run PHP, including Droplets, DOKS workloads, App Platform applications, custom containers, and existing Marketplace 1-Click images. DigitalOcean says PHP versions from 5 onward are potentially affected. Patch status: App Platform: The PHP buildpack has been patched, but applications must be redeployed. Apps using a custom Dockerfile or container image require the customer to
differs
Yes, DigitalOcean's ecosystem and certain hosted products are affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the status of the patches depends on the specific DigitalOcean product being used . DigitalOcean addressed the incident and outlined specific product statuses in its official advisory: Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) | DigitalOcean. Product Patch Status on DigitalOcean
no status named
DigitalOcean itself is not the vulnerable entity, but user droplets, virtual private servers (VPS), and apps running unpatched PHP instances on DigitalOcean infrastructure are directly affected by CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Because DigitalOcean provides cloud infrastructure rather than managing user-level application runtimes, you (the user) are responsible for updating PHP on your own droplets or servers to a patched
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for DigitalOcean reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
DigitalOcean's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about DigitalOcean and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy