Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

The PHP group and Wiz Research disclosed two critical vulnerabilities in the core PHP runtime that expose web applications to unauthenticated remote code execution and memory disclosure, as detailed in Google Cloud Blog's report. Assigned as CVE-2026-109618 and CVE-2026-109619, both flaws carry an official Common Vulnerability Scoring System base score of 9.2. Security teams identified the vulnerabilities with help from Gemini 4 Argon, which contributed to discovery, exploit development, attack detection, and patch verification.

This report covers the mechanics of both runtime flaws, the affected releases, Google Cloud serverless remediations, and required worker restart procedures. It is written for systems engineers, cloud architects, and security teams operating PHP workloads across container clusters, serverless environments, and enterprise edge equipment.

01Core runtime memory flaws and CVSS ratings

CVE-2026-109618 stems from internal out-of-memory handling that can interrupt the PHP engine while internal request data remains only partially initialized. During subsequent request cleanup routines, the interpreter treats this invalid data as valid memory structures. Attackers can trigger this condition by supplying large request bodies designed to force memory exhaustion.

CVE-2026-109619 involves request-owned internal state that survives after its underlying backing memory is freed by the allocator. When a subsequent request arrives at the same worker process, the worker can access that stale, dangling state before normal initialization routines run. Threat actors can exploit these mechanisms to crash worker processes, leak memory, or execute unauthorized arbitrary code.

The flaws affect every PHP release from version 5.4 through version 8.5.11. Upstream maintainers released official security fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, tracked under GitHub security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. No security patches will be backported to PHP 8.1 or earlier legacy branches because those branches have reached end-of-life status.

02Google Cloud serverless platforms and patching schedules

Workloads deployed on App Engine standard environment running PHP 8.2 or newer receive automatic platform updates without requiring developer intervention. However, services deployed on App Engine flexible environment do not receive automatic updates across any PHP version. Administrators must manually update their application dependencies to supported versions and redeploy their flexible containers immediately.

Cloud Run services and Cloud Run functions with automatic base image updates enabled receive the patched runtime automatically. In contrast, any Cloud Run instances deployed without automated base image updates, or those utilizing custom container images, require manual rebuilds and service redeployments. Legacy deployments running PHP 5.5, 7.2, 7.3, 7.4, or 8.1 remain vulnerable across all managed platforms until upgraded to PHP 8.2 or higher.

Teams running Google Kubernetes Engine pods or custom containers on Google Cloud Marketplace solutions must rebuild images using patched packages. Administrators maintaining packaged LAMP stacks or content management systems must apply upstream provider releases or update the embedded runtime directly.

03Web server restarts and volatile memory forensics

Upgrading operating system packages on disk does not terminate running interpreter instances already loaded into memory. Shared libraries like libphp.so and running worker binaries remain active inside process memory until administrators explicitly restart services such as php8.x-fpm, apache2, httpd, frankenphp, or lsws.

Before restarting suspect servers, security teams must capture volatile worker heap memory if anomalous PHPSESSID cookies or active probing are observed. Terminating worker processes or rebooting underlying hosts permanently wipes the volatile heap evidence necessary to investigate intrusions. Mandiant Consulting provided additional guidance on monitoring, patching, and remediation across production environments.

Engineers should avoid waiting for volunteer third-party RPM mirrors, which frequently lag behind coordinated disclosure timelines. Teams should pull directly from official distribution security repositories or source builds, verifying updates using package changelog commands. In addition, organizations must audit edge devices, storage appliances, and gateway infrastructure whose management control planes embed PHP interpreters.

04Cloud Armor managed rules and inspection limits

Google Cloud deployed automated protections across Cloud Armor managed rulesets for internet-facing workloads behind global or regional application load balancers. Customers with active managed rules receive protection automatically via updated threat intelligence feeds without manual configuration changes.

Teams deploying Cloud Armor manually should enable the File Upload and Remote File Inclusion categories in stable version enforce mode. In addition, administrators must configure security policy rules that restrict request bodies exceeding inspection limits. Capping request payload sizes prevents attackers from delivering oversized inputs designed to trigger memory exhaustion inside the backend interpreter.

These Cloud Armor web application firewall rules function strictly as compensating frontline controls to mitigate remote probing. Cloud Armor mitigations cannot eliminate the underlying runtime flaw, and organizations must redeploy patched PHP runtimes to achieve complete vulnerability resolution.

05Monitoring tools and artifact security scanning

Google Cloud and Wiz integrated detection capabilities into native security tools to identify exposed workloads across development and runtime environments. Administrators can utilize the On-Demand Scanning API to evaluate container images stored locally on developer workstations or remotely inside Artifact Registry.

Teams using Artifact Analysis receive automated vulnerability alerts for existing container images as well as newly pushed artifacts. Integration with Security Command Center provides runtime visibility into vulnerable PHP workloads across cloud projects.

Security operations teams should monitor production logs for unusual request sizes, repeated worker crashes, and malformed session identifiers. Organizations operating legacy runtimes must prioritize migrating off unsupported PHP branches to prevent unauthenticated remote code execution.