Google Cloud is urging customers who run PHP applications to update and redeploy after PHP and Wiz Research disclosed two critical flaws in the language runtime. The company says the flaws could expose applications to unauthenticated remote code execution and memory disclosure. Google Cloud says its own systems are not vulnerable, but customers’ PHP applications may be.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. CVE.org assigned the identifiers on October 21, 2026. Each has a critical CVSS severity score of 9.2, according to Google Cloud.
The first flaw involves PHP cleaning up request data after an out-of-memory interruption, when some internal data may be incomplete. The second involves internal state left behind after its memory has been freed, which a later request handled by the same worker may use.
Patches are available for PHP 8.2 and newer
Google Cloud lists PHP versions 5.4 through 8.5.11 as vulnerable. Fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project is not releasing fixes for PHP 8.1 or earlier because those versions have reached end of life. Google Cloud advises customers to move to PHP 8.2 or newer and deploy a patched version.
What customers need to do depends on how they run PHP. Supported App Engine standard runtimes are patched automatically. App Engine flexible applications need to be redeployed. Cloud Run services without automatic base image updates, as well as customer-built container images, need to be rebuilt with patched PHP and redeployed. Google Kubernetes Engine users need to update their container images and redeploy their pods. Customers using a Marketplace solution that includes PHP need an update from its provider or must update PHP directly.
Google Cloud says it is rolling out updated serverless base images for supported PHP versions on App Engine standard, App Engine flexible, Cloud Run, Cloud Run functions and Cloud Functions for Firebase. Cloud Run functions with automatic base image updates enabled receive the update automatically; those without it must be redeployed. Unsupported runtimes will not receive these patches.
