Google Cloud is urging developers and organizations to update their PHP installations immediately after researchers disclosed two critical vulnerabilities that could allow attackers to execute code remotely without authentication or expose sensitive information stored in server memory.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026, by PHP and cybersecurity company Wiz Research. Both received a critical severity rating of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS).

The flaws affect PHP itself rather than a specific website or application built with the language. That makes them particularly concerning for organizations running PHP-powered websites, content management systems, and web applications, including WordPress, Drupal, and Joomla.

In its security advisory published today, Google Cloud said its own cloud infrastructure is not vulnerable to these issues. However, customers running PHP applications on Google Cloud may still be exposed and should take immediate steps to secure their workloads.

What are the two PHP vulnerabilities?

According to Google Cloud and Wiz Research, both vulnerabilities stem from memory-safety problems in how PHP handles fatal errors, particularly when the runtime runs out of memory while processing a request.

Under certain circumstances, PHP can leave behind internal state that refers to memory that has already been freed or was never fully initialized. A subsequent request handled by the same worker can then interact with that stale state, potentially creating an opportunity for memory corruption, information disclosure, or remote code execution.

CVE-2026-109618 involves PHP’s handling of internal request data during out-of-memory conditions. The flaw can leave internal data in an inconsistent state, allowing subsequent cleanup operations to process invalid information. Researchers demonstrated that it could expose PHP worker memory and contribute to remote code execution.

CVE-2026-109619 involves stale request-related state surviving after its backing memory has been freed. Depending on the execution path, this can allow later requests to use invalid data and potentially corrupt memory or shared PHP runtime state.

The consequences go beyond crashing a website. Successful exploitation could allow an unauthenticated attacker to execute commands on an affected server or read sensitive information from PHP process memory. Such information may include passwords, authentication tokens, API keys, and certificates.

Wiz Research demonstrated remote code execution against WordPress, Drupal, and Joomla deployments. Importantly, the researchers emphasized that the vulnerabilities reside in PHP’s core runtime, meaning an application’s own code does not have to contain a separate security flaw for an affected installation to be at risk.

Which PHP versions are affected?

Google Cloud says the vulnerable code affects PHP versions from 5.4 through 8.5.11. The PHP project has released fixes in the following versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Organizations should upgrade to an appropriate patched release rather than assume that using a relatively recent PHP version is sufficient.

There is an additional concern for older installations. PHP 8.1 and earlier have reached end of life and are not receiving fixes for these vulnerabilities. Google Cloud therefore advises users running PHP 8.1 or older to upgrade to PHP 8.2 or newer, using a patched release.

This is particularly important for organizations that continue to operate older applications or legacy hosting environments. Updating a website’s content management system alone will not resolve a vulnerability in the underlying PHP runtime if that runtime remains unpatched.

Google Cloud outlines what customers should do

Google Cloud is advising customers to update their PHP applications to a patched version and redeploy them. The exact steps depend on the service hosting the application and whether its runtime updates automatically.

For App Engine standard, supported PHP runtimes on PHP 8.2 and newer are being updated automatically. Customers using PHP 8.1 or earlier must upgrade to a supported version and redeploy their applications.

For App Engine flexible, applications are not automatically updated in the same way. Customers should redeploy using a supported, patched runtime. Those using custom runtimes must update PHP themselves before redeploying.

For Cloud Run, customers with automatic base-image updates enabled can receive updated images through Google’s rollout. However, services built with their own container images or without automatic updates enabled must be rebuilt with a patched PHP version and redeployed.

For Google Kubernetes Engine (GKE), administrators should update their container images to include a patched PHP runtime and redeploy the affected pods.

Customers running PHP-based solutions from Google Cloud Marketplace should apply updates supplied by the solution provider or update the PHP installation directly, as appropriate.

Google Cloud is rolling out updated serverless base images across supported PHP runtimes for App Engine, Cloud Run, Cloud Run functions, and Cloud Functions for Firebase. However, automatic updates should not be treated as a blanket guarantee that every deployment is already protected. Custom images, unsupported runtimes, and services without automatic base-image updates may still require manual intervention.

Why the disclosure raises broader security concerns

Wiz Research says the underlying vulnerabilities had existed in the PHP codebase for more than a decade. The team discovered the issues in August 2026 and worked with the PHP security team and other organizations before the public disclosure and release of patches.

The research also highlights the growing role of artificial intelligence in vulnerability discovery and exploit development. Wiz used its own tools alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol during the investigation. According to Google Cloud and Wiz, Gemini 4 Argon made a significant contribution to finding the vulnerabilities, developing exploits, detecting attack behavior, and validating the fixes.

Wiz demonstrated that combining the vulnerabilities could enable remote code execution without authentication against affected WordPress, Drupal, and Joomla installations. The company also demonstrated that sensitive process memory could be exposed without first achieving code execution.

The security implications are significant because PHP remains a foundational technology for the web. A vulnerability in the language runtime can affect many different applications and hosting environments simultaneously, even when those applications have otherwise been maintained securely.

Wiz has also warned that AI-assisted analysis can reduce the amount of specialist effort needed to turn complex memory-safety bugs into practical exploits. That makes rapid patching and coordinated defensive measures particularly important when vulnerabilities become public.

How administrators can check for exposure

Google Cloud recommends scanning container images and reviewing deployed workloads to identify vulnerable PHP installations. Customers can use On-Demand Scanning to inspect images and Artifact Analysis to receive vulnerability notifications for affected artifacts. Security Command Center customers can also use its container threat-detection capabilities for GKE and Cloud Run workloads.

Wiz has published additional technical details and remediation guidance for its PHP2Shell findings, including indicators that defenders can investigate while systems are being patched. These may include unusual multipart HTTP requests, repeated HTTP 500 errors following memory-limit failures, unexpected PHP session cookies, and unexplained PHP worker restarts.

Such indicators can help guide an investigation, but they are not a substitute for updating the runtime. Google Cloud’s central recommendation is straightforward: upgrade to a patched PHP version and redeploy affected applications as soon as possible.

For organizations operating PHP-powered websites, the priority is to identify which runtime each application actually uses, determine whether its deployment receives automatic updates, and verify that the patched version is running. Older or custom deployments deserve particular attention because they may not receive Google’s automated fixes.