WordPress/Digital Ocean PHP Vulnerability Help

I received this email and need help resolving. Our website using WordPress and is hosted by Digital Ocean. Subject: URGENT: Critical PHP Vulnerabilities - Action Required We're reaching out regarding two critical remote code execution (RCE) vulnerabilities in PHP. What's Going On We're reaching out regarding two critical remote code execution (RCE) vulnerabilities in PHP, tracked as XX, publicly disclosed on October 21, 2026. These vulnerabilities allow an attacker to execute arbitrary code on servers running PHP, potentially resulting in full compromise of the affected system. Because PHP powers a significant share of the web, including WordPress, Drupal, Laravel, and custom applications, we are notifying all DigitalOcean customers to ensure your awareness on both DigitalOcean deployed assets and as a general awareness notification. Who Is Affected These vulnerabilities affect every PHP version from PHP 5 onward. If you run PHP anywhere in your DigitalOcean infrastructure - on Droplets, in DOKS workloads, in App Platform apps or custom containers, or via Marketplace 1-Click images (WordPress, LAMP, LEMP, Laravel, etc.) - you should consider yourself potentially in scope until patched. The DigitalOcean Marketplace team is currently in the process of suspending affected images until they are patched. If you have previously deployed a marketplace image with PHP, please login and update immediately. The patched versions of PHP are: • 8.5.12 • 8.4.27 • 8.3.36 • 8.2.35 Importantly, patches are only available for currently supported PHP versions (8.2 and later). If you are running an end-of-life PHP version (8.1 or earlier), no official patch will be available and you should plan an immediate upgrade to a supported version. What You Should Do Now 1. Inventory every system running PHP across your infrastructure, including bundled installs you may not think of as "PHP servers" (WordPress and other CMS instances, admin panels, legacy apps). 2. Patch immediately. Patches for PHP are available. If you run software such as Wordpress, Laravel, or other tools built with PHP, you may need software-specific patches directly from those providers. Updating PHP to a patched version is the only safe choice; there are no complete mitigations and proof-of-concept exploit code is publicly available. 3. If you are on PHP 8.1 or earlier, upgrade to PHP 8.2+ so you can apply the patch. EOL versions will not receive patches. 4. If you cannot update immediately, the PHP Foundation has provided measures you can take to reduce exposure to specific attack paths. This does not make your installation of PHP safe, and you should have a plan to update as soon as possible. 5. Reduce exposure in the interim where practical: restrict public access to PHP applications that don't need to be internet-facing, and ensure firewalls/WAF rules and monitoring are in place. Please take immediate action to help secure your environment. Our support team is available if you have any questions. To protect our broader community and network integrity, DigitalOcean may temporarily restrict traffic to resources showing signs of compromise. We encourage you to patch immediately to ensure your services remain online and unaffected.