# Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 > Source: > Published: 2026-10-21 14:00:00+00:00 PHP and Wiz Research disclosed today two critical vulnerabilities in the core PHP language runtime that can expose applications to unauthenticated remote code execution and memory disclosure. Wiz used a mix of models to identify and help remediate these vulnerabilities. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch. While Google Cloud itself is not vulnerable, users of PHP running on Google Cloud may be vulnerable. At Google Cloud, we understand the severity of these vulnerabilities, and are sharing guidance to help our customers take immediate action to secure their applications. PHP is a widely-used, server-side scripting language that powers many websites, content management systems, and web applications. On Oct. 21, 2026, CVE.org assigned the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. The official Common Vulnerability Scoring System (CVSS) base severity score for each of the PHP flaws has been determined as Critical, a severity of 9.2. Generally, this ranking means that threat actors can crash and hijack the affected system, and can easily steal, alter, and wipe its data — although mitigating circumstances can make it harder to exploit the flaw. **CVE-2026-109618**: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid. **CVE-2026-109619**: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it. **Vulnerable versions**: All versions of PHP from 5.4 through 8.5.11 **Patched in**: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 **Not patched**: The PHP project is not releasing fixes for PHP 8.1 or earlier, which have reached [end of life](https://www.php.net/supported-versions.php). **Fix**: CVE-2026-109618 ([GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)) and CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)): **Announcement**: PHP has published a [security advisory](https://www.php.net/) on these two vulnerabilities. Wiz Research has [published a detailed description](http://wiz.io/blog/php2shell-php-rce) of the research and the coordinated disclosure process. We urge all customers running PHP applications on Google Cloud to immediately update to PHP 8.2 or newer, and redeploy their services using a patched version. This applies specifically to applications deployed on: **App Engine standard environment**: Supported runtimes are patched automatically. If you are on PHP 8.1 or earlier, upgrade to PHP 8.2 or newer and redeploy. **App Engine flexible environment**: Redeploy your PHP runtimes using a supported runtime. If you are using a custom runtime, update your PHP dependencies to a patched version and redeploy your application. **Cloud Run**: If automatic base image updates are not enabled, or you deploy your own container image, rebuild with a patched version of PHP and redeploy. **Google Kubernetes Engine (GKE)**: Update your container images with a patched version of PHP and redeploy your pods. **Google Cloud Marketplace**: If you run a Marketplace solution that includes PHP, such as a content management system or LAMP stack, apply the update from the solution provider or update PHP directly.  Google Cloud is rolling out updated serverless base images for all supported PHP versions on App Engine Standard, App Engine Flexible, Cloud Run, Cloud Run function, and Cloud Functions for Firebase. What this means for you: **App Engine standard environment** (PHP 8.2 and newer): Applications are updated automatically. No action is required. **App Engine flexible environment** (all PHP versions): Applications are not updated automatically. Redeploy your application as soon as possible to PHP 8.2 and newer. **Cloud Run functions** (PHP 8.2 and newer): Functions with automatic base image updates enabled are updated automatically. Functions without automatic base image updates enabled must be redeployed.  **Cloud Run** (PHP 8.2 and newer): Services with automatic base image updates enabled are updated automatically. Services built without automatic base image updates must be rebuilt and redeployed to pick up the patched runtime. Important considerations: **Unsupported runtimes will not be patched**. The upstream PHP project is not backporting these fixes to PHP 8.1 or earlier. Applications on PHP 5.5, PHP 7.2, PHP 7.3, PHP 7.4, or PHP 8.1 remain vulnerable and must be upgraded to PHP 8.2 or newer. See the following runtime support schedules for serverless lifecycle dates: **Container images you build yourself are your responsibility**. If you have deployed your own container image to Cloud Run or App Engine Flexible (such as with a custom runtime), rebuild it with a patched version of PHP and redeploy. Use the [On-Demand Scanning AP](https://docs.cloud.google.com/artifact-analysis/docs/scan-os-on-demand) to manually scan images stored locally on your computer or remotely in Artifact Registry. Customers using [Artifact Analysis](https://docs.cloud.google.com/artifact-analysis/docs/artifact-analysis) will be notified of these vulnerabilities on both new and existing artifacts to identify at-risk workloads.  [Security Command Center](https://cloud.google.com/security/products/security-command-center) customers can turn enable container threat detection for GKE and Cloud Run threat detection to monitor their workloads for intrusions. Patching your applications is an essential step to eliminate the vulnerability at its source and ensure the continued integrity and security of your services. We will continue to monitor the situation closely and provide further updates and guidance as necessary. For the most current information and detailed steps, please refer to the [Google Cloud security bulletin](https://docs.cloud.google.com/support/bulletins#gcp-2026-070).