Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect versions 5.4 through 8.5.11, potentially enabling unauthenticated remote code execution and memory disclosure. PHP has released fixes for supported branches, but PHP 8.1 and earlier require migration. Developers should update PHP, rebuild affected containers, redeploy applications, and enable security monitoring. Cloud Armor can reduce exposure temporarily, but patching remains the essential fix.
PHP and Wiz Research disclosed two critical vulnerabilities in the core PHP runtime on October 21, 2026. CVE.org assigned them CVE-2026-109618 and CVE-2026-109619. Each carries a CVSS base score of 9.2, which falls in the Critical band.
According to the disclosure, the flaws can expose applications to unauthenticated remote code execution and memory disclosure. Attackers therefore need no credentials to reach the vulnerable code paths. For any team that runs PHP on an internet-facing server, that detail raises the urgency considerably.
How wide the exposure runs
The affected range is enormous. It covers every PHP version from 5.4 through 8.5.11. To fix the problem, the PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, it will not patch PHP 8.1 or earlier, because those branches have reached end of life.
Google Cloud’s response
Google Cloud published guidance the same day. Chris Betz, CISO of Google Cloud, and Raluca Ada Popa, Head of Gemini Security at Google DeepMind, wrote the post. Google states that Google Cloud itself is not vulnerable. Even so, customers who run PHP applications on Google Cloud may still face exposure.
The AI angle
The disclosure also carries a notable AI element. Wiz used a mix of models to identify and help remediate the flaws. According to the Google Cloud post, Gemini 4 Argon made a major contribution to finding the vulnerability, developing the exploit, detecting attacks, and validating the patch. Because that claim appears in a vendor blog, readers should treat it as a vendor statement, not an independent finding.
The immediate action
The required action is simple to state. Teams must update PHP to a patched version and redeploy. Those on PHP 8.1 or earlier must first upgrade to a supported branch. The rest of this article explains why, how, and what to verify along the way.
Strategic Context and Why It Matters
A runtime flaw reaches everything above it
PHP powers a huge share of the web. The Google Cloud post describes it as a server-side scripting language behind many websites, content management systems, and web applications. As a result, a flaw in the core runtime does not stay inside one product. It reaches every application, plugin, and framework that runs on the affected engine.
Who faces direct impact
Several groups face different levels of work.
Teams on managed serverless platforms benefit most. Google is rolling out updated base images for App Engine Standard, App Engine Flexible, Cloud Run, Cloud Run functions, and Cloud Functions for Firebase. Some services update automatically, while others need a manual redeploy.
Teams that build their own containers carry the heaviest load. Google states that container images you build yourself are your responsibility. A team that ships a custom image to Cloud Run or App Engine Flexible must therefore rebuild it with a patched PHP version.
Teams on end-of-life PHP face the hardest choice. Upstream will not backport fixes to PHP 8.1 or earlier. Google names PHP 5.5, 7.2, 7.3, 7.4, and 8.1 as examples that remain vulnerable. Patching in place is impossible for these teams, so they must migrate.
Security operations teams gain a defined toolset. Google lists scanning, exposure analysis, threat detection, and curated detection rules. Meanwhile, Wiz offers parallel coverage for its own customers.
How workflows change
Patching a runtime sounds routine. In practice, it triggers a chain of tasks. Engineers must first inventory every PHP workload. Next, they must identify which workloads face the internet. After that, they rebuild images, redeploy services, and verify the results.
Many organizations discover forgotten workloads during this process. Old marketing sites, internal tools, and abandoned microservices often run outdated PHP. Consequently, the inventory step frequently takes longer than the patch itself.
Why AI changes the timeline
The incident also shows how quickly vulnerability discovery can move when AI models join the process. The post credits models with discovery, exploit development, detection, and patch validation. If that account holds, defenders and attackers alike can compress their timelines. Security teams should therefore plan for shorter gaps between disclosure and exploitation attempts. Note that this point is analysis, not a claim from the source. The source reports no in-the-wild exploitation.
Deep-Dive Technical Specifications
CVE-2026-109618: partial initialization during out-of-memory events
This flaw involves out-of-memory handling. When PHP runs out of memory, it can stop while internal request data sits only partially initialized. Request cleanup then treats that invalid data as valid.
Consider what that means in practice. Cleanup code expects well-formed structures, but a half-built structure breaks that expectation. The routine may then act on garbage values. Memory corruption bugs of this type often give attackers a path toward code execution. The source does not detail the exploit path, so this article does not speculate on it.
The out-of-memory trigger matters for defenders. An attacker may need to push a worker into a low-memory condition. Google’s Cloud Armor guidance points the same way, since it warns that threat actors may use large payloads to trigger out-of-memory conditions. Watching for oversized requests can therefore serve as an early signal.
CVE-2026-109619: stale state across requests
This flaw involves stale state. Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may then use that stale state before normal initialization resets it.
The pattern resembles a use-after-free condition that spans requests. The key word is “worker.” Many PHP deployments reuse worker processes across many requests, so one request can leave dangerous residue for the next. That cross-request behavior helps explain why the flaw can expose memory contents. It also explains why an attacker needs no account on the target application.
Shared characteristics
Both flaws share several traits:
- They sit in the core runtime, not in a library or extension.
- They affect request lifecycle handling.
- They allow unauthenticated attack paths, according to the disclosure.
- They carry the same CVSS base severity of 9.2.
- They affect the same range, from PHP 5.4 through 8.5.11.
Fixed versions
| Branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and earlier receive no fix. The advisories carry the identifiers GHSA-w8hw-w9fx-j79w for CVE-2026-109618 and GHSA-6wmf-4rv5-p3rp for CVE-2026-109619. PHP published a security advisory, and Wiz Research published a detailed write-up of the research and the coordinated disclosure process.
What the source does not say
The Google post publishes no proof-of-concept code. It also omits the exact exploit chain. Likewise, it does not list affected configurations, such as specific SAPIs or memory limits. Readers who need those details should consult the PHP advisory and the Wiz research directly.
Performance, Benchmarks, and Evidence
Vulnerability disclosures do not carry benchmark scores. Instead, the relevant evidence consists of severity ratings, affected scope, and the quality of the detection and mitigation tooling. This section reviews each in turn.
Severity evidence
The CVSS base score for each flaw is 9.2. The Google Cloud post explains the rating in plain terms. A Critical ranking generally means threat actors can crash and hijack the affected system, and they can also steal, alter, and wipe its data. However, the post adds a caution: mitigating circumstances can make exploitation harder.
Scores of 9.2 place these flaws in the most severe class of issues. Teams usually set tight patch deadlines for anything in that range, often measured in days, not weeks. That practice varies by organization and compliance regime, though.
Scope evidence
The affected range stretches from PHP 5.4 through 8.5.11. That span covers well over a decade of releases. It suggests the underlying defects entered the codebase long ago. Still, the source does not state when they appeared, so readers should not draw firm conclusions beyond the version range.
Discovery evidence
The Google Cloud post credits Wiz Research and a mix of models. It names Gemini 4 Argon for contributions across four tasks:
- Finding the vulnerability.
- Developing an exploit.
- Detecting attacks.
- Validating the patch.
Notably, the post offers no accuracy figures, no false-positive rates, and no comparison against human researchers. The claim therefore remains qualitative. Independent verification would strengthen it, and the Wiz write-up may provide more detail.
Detection and monitoring tools
Google lists several controls for monitoring and auditing:
- On-Demand Scanning API: It scans images stored locally or in Artifact Registry. Artifact Analysis customers receive notifications about these vulnerabilities on new and existing artifacts.
- Security Command Center: It monitors workloads and identifies externally exposed instances. Teams enable the External Exposure service with the EXTERNALLY_EXPOSED_RCE_VULNERABILITY scanning module. Coverage spans Compute Engine, GKE, and Cloud Run. Findings show the path across load balancers, Cloud Armor policies, and firewall rules.
- Threat detection: Teams enable Container Threat Detection for GKE and Cloud Run Threat Detection.
- Google Security Operations: It added 23 curated detections to the Mandiant Frontline Threats rule pack.
- Emerging Threat Center: Enterprise Plus customers search for “GLOBAL.26.015.” Those who enabled the Threat Hunt Agent in Public Preview can also run a hunt on that identifier.
- Mandiant Threat Defense: This service monitors curated detections and hunts for intrusion evidence tied to the campaign.
Google revised its post twice on October 22. One update changed Security Command Center guidance, and another changed Cloud Armor guidance. Readers should consequently check the live version rather than a cached copy.
Cloud Armor mitigation
Google states that customers with active managed rules need no action, because protection applies automatically. Customers without managed rules can still deploy them now. The guidance recommends enabling the File Upload and RFI categories and enforcing all stable-version ruleset categories. In addition, it recommends a rule for request bodies that exceed inspection limits.
Google stresses one point repeatedly: Cloud Armor serves solely as a compensating control. Upgrading PHP and redeploying remains the only full fix.
Pricing, Licensing, and Availability
Cost of the patch itself
PHP is open source, so the patched releases cost nothing. Teams can download versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 from the PHP project. No license change accompanies the fix.
Costs appear elsewhere. Engineering time represents the largest expense, since teams must inventory, rebuild, test, and redeploy. Teams on end-of-life PHP face migration work that can run far longer than a simple patch.
Serverless auto-patching
Availability of fixes differs by environment:
- App Engine standard environment (PHP 8.2 and newer): Google updates applications automatically, and no action is required.
- App Engine flexible environment (all PHP versions): Updates do not happen automatically. Teams must redeploy to PHP 8.2 or newer.
- Cloud Run and Cloud Run functions (PHP 8.2 and newer): Services and functions with automatic base image updates update on their own. Without that setting, teams must rebuild and redeploy.
Vendor offerings and costs
Several vendor offerings also affect the budget. As part of its zero-day response commitment, Wiz offers WizOS PHP images at zero billable units for all customers for the next 60 days. The images come in standard Alpine-hardened and FIPS-compliant builds. Both are built from source and already patched against both CVEs. After 60 days, normal billing presumably resumes, so teams should confirm the terms with Wiz.
Cloud Armor managed rules depend on the customer’s existing plan. The source does not state costs, so readers should check current pricing. Finally, customers who run a Marketplace solution that includes PHP, such as a CMS or LAMP stack, should apply the provider’s update or update PHP directly.
Google’s runtime support schedules for App Engine Standard, App Engine Flexible, Cloud Run, and Cloud Run functions define serverless lifecycle dates. Teams should consult them before planning a migration.
⚡ Limited Time Free Access
Unleash Your Digital Empire: Get 4 Premium Gifts in 1 Pack!
Grab this exclusive, high-value digital asset package tailored for creators, marketers, and builders. Enter your best email to claim instant access.
What’s Inside Your Ultimate All-In-One Package:
01. 50 AI Digital Product Ideas: A curated list of profitable, AI-driven digital product ideas engineered for fast execution and high margins.
02. Digital Sales Mastery: The strategic architecture behind high-converting sales funnels, persuasive copywriting, and online revenue growth.
03. Mastering Email List: Advanced frameworks for building an engaged audience, maximizing open rates, and generating automated income.
04. THE ULTIMATE FACELESS PLAYBOOK: Complete blueprint to building a powerful, monetizable brand on social media without showing your face.
Included Bonus:
[BONUS] Premium Canva Marketing Vault: High-converting templates to scale your organic traffic.
💥 $197 VALUE — FREE FOR READERS
🛡️ Secure Processing • Your privacy is 100% protected.
Industry Implications and Competitive Analysis
Cloud provider responses
Google Cloud responded with layered guidance. It combined automatic base image updates, a WAF mitigation, scanning tools, and detection rules. Other cloud providers will likely publish similar guidance for their own PHP offerings. Because the source does not cover them, this article makes no claims about specific competitors. Readers on other clouds should check their provider’s security bulletins today.
The pattern still deserves attention. Managed platforms split responsibility. Providers patch their own runtimes and base images, while customers patch everything they build. Google states this division explicitly. Customers who assume the cloud handles everything will therefore leave gaps.
Security vendor positioning
Wiz and Google appear tightly aligned in this response. The post references Wiz Threat Intel Center advisories, WizOS images, Wiz Defend and Sensor, and the Green Agent. Wiz customers gain built-in coverage for agentless and runtime vulnerability detection, exploitation detection, and automatic response policies. Furthermore, the Green Agent translates the PHP2Shell advisory into resource-tailored remediation guidance. It prescribes patch versions, identifies WAF mitigations, and suggests hardened images and runtime blocking.
Readers should note the commercial context. Google employees wrote the post, and it promotes Google and Wiz products. That fact does not make the guidance wrong. Nevertheless, readers should weigh the promotion separately from the technical advice.
The AI-assisted research trend
The most significant long-term implication involves AI in vulnerability research. The post says models helped find the flaws, build the exploit, detect attacks, and validate the patch. If AI tools can handle all four stages, several consequences follow:
- Discovery speeds up. Models can scan large codebases for memory-handling defects that humans miss.
- Exploit development speeds up. Attackers with similar tools can shorten the gap between disclosure and weaponization.
- Patch validation improves. Defenders can test fixes faster and with broader coverage.
- Coordinated disclosure gets harder. Maintainers face more reports, and the window to patch before leaks shrinks.
These points are analysis. The source documents one case, not a trend. Even so, the case shows what defenders must prepare for.
Alternatives for teams that cannot patch quickly
Teams that cannot patch immediately have limited options. They can place a WAF in front of vulnerable applications, restrict network exposure with firewall rules, or move workloads to patched hardened images. They can also retire unneeded applications. Unfortunately, none of these replaces the upstream fix. Google makes that point plainly for Cloud Armor, and the same logic applies to every compensating control.
Teams on end-of-life PHP face a strategic choice. They can accept migration cost now, or they can accept ongoing risk. Because upstream will not release a fix, that risk will not shrink with time. Instead, it will grow with each new disclosure. This incident gives those teams a concrete reason to fund the migration.
Limitations, Caveats, and Skepticism
Gaps in the evidence
No public exploitation claim. The source does not report active exploitation. However, absence of that claim does not prove safety. Teams should assume attackers will study the patches.
Thin exploit details. The source describes the flaws at a high level and does not explain the exact conditions required. The Wiz write-up and PHP advisory likely hold more. Teams should read them before judging their own exposure.
CVSS caveats. The post warns that mitigating circumstances can make exploitation harder. A 9.2 score describes the worst realistic case under the scoring model, and your environment may differ. Nonetheless, teams should not downgrade priority without evidence.
Vendor-sourced AI claims. The credit to Gemini 4 Argon comes from a Google blog. The post gives no benchmarks, error rates, or human baselines. Until independent researchers confirm the claim, treat it as a vendor statement.
Operational risks in production
WAF limits. Cloud Armor rules reduce exposure but do not eliminate it. Rules can miss variants, and inspection limits can leave oversized requests unexamined. Google itself calls these controls compensating, not definitive.
Auto-patch gaps. Automatic updates cover only certain configurations. App Engine flexible environment never patches automatically, and Cloud Run services without automatic base image updates stay vulnerable until a rebuild. Custom images also stay vulnerable until the owner acts. Teams should therefore verify rather than assume.
Evolving guidance. Google revised its post at least twice after publication, and details may keep changing. Checking the Google Cloud security bulletin for current instructions is a sensible habit.
Scope of the source. This article relies on one vendor post. It includes no independent testing, no review of the PHP source changes, and no confirmation from other cloud providers.
Future Outlook and Conclusion
What to watch next
Several milestones deserve attention in the coming weeks. First, watch for further guidance from PHP, Wiz, and Google, since both vendors updated their materials after launch. Second, track responses from other cloud providers, which will show how consistently the industry handles runtime flaws. Third, monitor for public proof-of-concept code, because its appearance would raise exploitation risk sharply. Finally, note the 60-day window for WizOS images, which marks a practical deadline for teams that plan to adopt them.
Action checklist
Developers should take these steps now:
- Inventory every PHP workload, including forgotten ones.
- Identify internet-facing applications first.
- Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- Rebuild and redeploy custom container images.
- Migrate anything on PHP 8.1 or earlier to a supported branch.
- Enable Cloud Armor managed rules as a stopgap.
- Turn on scanning and threat detection, then review the new detections.
- Re-read the vendor guidance for updates.
Bottom line
Two critical flaws affect a vast range of PHP versions. Fixes exist for supported branches, but unsupported branches have none. Teams that patch and redeploy quickly will close the exposure. In contrast, teams that wait will leave unauthenticated attack paths open.