Google responds to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Google said its cloud service is not vulnerable to two core PHP vulnerabilities, but customers running PHP on Google Cloud may be. It is rolling out updated serverless base images and urges customers to update to PHP 8.2 or newer and redeploy services using a patched version.
1. Google rolls out patches
Google said it is responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. While Google Cloud itself is not vulnerable, users running PHP on the platform may be.
2. Customer updates urged
Google Cloud is rolling out updated serverless base images for all supported PHP versions across App Engine Standard, App Engine Flexible, Cloud Run, Cloud Run Functions and Cloud Functions for Firebase. It urged customers to immediately update to PHP 8.2 or newer and redeploy services using a patched version. Google said Gemini 4 Argon contributed to finding the vulnerability, exploit development, attack detection and patch validation.
