Two new critical flaws have been disclosed in the PHP language runtime, and Google Cloud is urging anyone who runs PHP applications on its platform to move to a patched version immediately. The vulnerabilities allow unauthenticated attackers to execute code or read memory, which can lead to full compromise of affected services.
What Changed in the PHP Runtime
The advisory identifies two distinct issues:
- CVE‑2026‑109618: When PHP runs out of memory during request processing, cleanup may treat partially‑initialized request data as valid, opening a path to remote code execution.
- CVE‑2026‑109619: Internal request state can persist after its backing memory is freed, allowing a later request handled by the same worker to reuse stale data before proper initialization.
Both flaws affect every PHP release from 5.4 up to 8.5.11. The PHP project released patches in the following versions:
8.5.12
8.4.27
8.3.36
8.2.35Earlier releases, including 8.1 and all prior versions, will not receive fixes because they have reached end‑of‑life.
Impact on Cloud‑Native Workloads
AI engineers, platform engineers, DevOps/SRE teams, and security engineers all rely on stable runtimes for the services they build and operate. A remote code execution vector in the language core bypasses application‑level defenses and can be triggered without authentication, meaning any exposed PHP endpoint becomes a potential entry point for attackers. Memory disclosure further increases the risk of credential or secret leakage from the process address space.
Because Google Cloud itself is not vulnerable, the risk is confined to customer‑managed PHP environments—App Engine flexible environments, Compute Engine VMs, Kubernetes containers, or Cloud Run services that bundle a vulnerable PHP interpreter. Any automated CI/CD pipeline that pulls an unpatched base image will propagate the flaw to production.
Operational Steps and Architectural Considerations
Practitioners should take the following actions:
- Identify runtime versions: Query deployed containers, VM images, or App Engine configurations for the PHP version. Any version earlier than the patched releases must be flagged.
- Upgrade to a patched release: Replace the runtime with
php:8.2.35or newer. For containerized workloads, update the DockerfileFROMline and rebuild images. - Redeploy services: Apply the new images or VM images and verify that traffic resumes without error.
- Validate the fix: Run a simple sanity test that exercises request handling under memory pressure to confirm the out‑of‑memory path no longer crashes.
- Review Cloud Armor policies: Although the source does not detail specific rules, consider adding or tightening any existing Cloud Armor policies that filter malformed PHP requests, as a defensive layer while the upgrade propagates.
- Enable monitoring and alerts: Use Cloud Monitoring to watch for sudden spikes in request failures or abnormal memory usage that could indicate an attempted exploit on unpatched instances.
- Plan for end‑of‑life versions: Since PHP 8.1 and earlier will not receive patches, evaluate migration paths to supported releases to avoid future exposure.
Related CloudNinjas coverage: Google Cloud.
What This Means For Practitioners
In short, the presence of CVE‑2026‑109618 and CVE‑2026‑109619 turns any unpatched PHP runtime into a high‑risk asset. Immediate remediation consists of confirming the current version, upgrading to one of the patched releases, and redeploying the workload. After the upgrade, verify that monitoring, alerting, and any perimeter controls such as Cloud Armor are aligned with the new runtime. Ongoing vigilance is required to keep PHP dependencies within supported, patched branches, especially as older branches have been declared end‑of‑life.