Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Google Cloud announced today that PHP and Wiz Research disclosed two critical vulnerabilities in the core PHP language runtime, CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated remote code execution and memory disclosure in affected applications. While Google Cloud’s infrastructure is not vulnerable, customers running PHP applications on its platform may be exposed. The company emphasized the severity of these flaws, assigning them a CVSS base severity score of 9.2, indicating a critical risk level that could enable attackers to crash systems, hijack operations, or manipulate and delete data.

The vulnerabilities stem from flaws in PHP’s memory handling and request state management. CVE-2026-109618 involves improper handling of out-of-memory conditions, leaving internal request data in a partially initialized state that may be misinterpreted as valid during cleanup. CVE-2026-109619 allows internal state to persist after its backing memory is freed, potentially exposing later requests to stale, uninitialized data before proper initialization occurs.

PHP has published a security advisory for these vulnerabilities, and Wiz Research detailed the research process and coordinated disclosure. Google Cloud urges customers to update to PHP 8.2 or newer and redeploy services using patched versions immediately. Unsupported PHP versions, including PHP 8.1 and earlier, will not receive fixes, leaving applications on these runtimes exposed to exploitation.

Google Cloud is rolling out updated serverless base images for supported PHP versions across multiple services, including App Engine Standard, App Engine Flexible, Cloud Run, and Cloud Functions. Automatic updates apply to App Engine Standard and services with enabled base image updates, while other environments require manual redeployment or rebuilding with patched PHP versions to mitigate risks.