PHP2Shell statement record · Host
DigitalOcean's PHP2Shell statement is recorded as patched partly, with statement date printed as Updated: October 21, 2026; read the published statement.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Publish or update your statement. The statement submission is free.
See what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about you: the $490 PHP2Shell Record Check.
We capture the dated answers, trace wrong or missing statements to their sources and deliver a statement page in the format the engines quote.
Agencies: white-label PHP2Shell Record Check, $490 per client report.
Read the statement on www.digitalocean.com, dated Updated: October 21, 2026. Source type: official page.Droplets don’t include PHP by default.
Droplets don’t include PHP by default.
DigitalOcean describes separate actions by service. The PHP App Platform buildpack has been patched, while customers must redeploy or update their own container images. Customer-installed PHP on Droplets remains the customer's responsibility. Cloudways is the separately managed product.
no status named
Yes—some DigitalOcean products were affected, and patches have been deployed, but customer-managed PHP workloads are not automatically fixed. DigitalOcean’s official advisory explicitly covers both CVE-2026-109618 and CVE-2026-109619. Status as of October 23, 2026: | Product | Patch status / required action | |---|---| | App Platform | PHP buildpack patched. Redeploy applications to receive the fix; custom containers require
no status named
Yes, DigitalOcean is aware of and affected by PHP2Shell, and has communicated patch availability. Here is a detailed breakdown: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): DigitalOcean's Status What is PHP2Shell? PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP that can allow unauthenticated remote code execution. Specifically: CVE-2026-109618 – RCE via OOM corruption: out-of-memory handling can interrupt PHP while
no status named
Yes. DigitalOcean is affected wherever customers run PHP, including Droplets, DOKS workloads, App Platform applications, custom containers, and existing Marketplace 1-Click images. DigitalOcean says PHP versions from 5 onward are potentially affected. Patch status: App Platform: The PHP buildpack has been patched, but applications must be redeployed. Apps using a custom Dockerfile or container image require the customer to
differs
Yes, DigitalOcean's ecosystem and certain hosted products are affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the status of the patches depends on the specific DigitalOcean product being used . DigitalOcean addressed the incident and outlined specific product statuses in its official advisory: Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) | DigitalOcean. Product Patch Status on DigitalOcean
no status named
DigitalOcean itself is not the vulnerable entity, but user droplets, virtual private servers (VPS), and apps running unpatched PHP instances on DigitalOcean infrastructure are directly affected by CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Because DigitalOcean provides cloud infrastructure rather than managing user-level application runtimes, you (the user) are responsible for updating PHP on your own droplets or servers to a patched
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for DigitalOcean reads PHP2Shell statement listed, Verified 24 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
DigitalOcean's PHP2Shell statement is recorded as patched partly, with statement date printed as Updated: October 21, 2026; source: https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now.
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy