Google Cloud Warns of Critical PHP Vulnerabilities Affecting Millions of Websites

Google is urging Cloud customers to update their PHP applications after researchers discovered two critical vulnerabilities that could allow attackers to execute malicious code remotely or access sensitive memory data without authentication.

The security flaws affect PHP versions dating back to 5.4, potentially putting millions of websites and applications at risk.

Critical PHP vulnerabilities affect multiple versions

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could enable unauthenticated remote code execution and memory disclosure.

According to Google Cloud, its infrastructure is not directly vulnerable, but customers running affected PHP applications need to apply security updates.

Researchers from Wiz and the PHP community identified the flaws with assistance from AI models, including Google’s Gemini 4 Argon.

The vulnerabilities affect PHP releases through version 8.5.11. Security fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Google recommends upgrading to PHP 8.2 or newer, installing the latest patched release, and redeploying affected applications. PHP 8.1 and older versions will not receive fixes.

Google shares security update instructions for Cloud customers

Google has outlined the steps customers should take across its cloud services:

• App Engine Standard: Supported PHP runtimes receive automatic patches, while older versions require upgrades and redeployment.
• App Engine Flexible: Customers must redeploy applications using patched PHP runtimes.
• Cloud Run: Services without automatic base image updates require rebuilding and redeployment.
• Google Kubernetes Engine: Customers must update PHP container images and redeploy affected pods.
• Google Cloud Marketplace: Users should install vendor-provided updates or manually upgrade PHP.

Google is also distributing patched base images across App Engine, Cloud Run, and Cloud Functions for Firebase.

Custom PHP containers require manual updates

Applications using supported PHP runtimes with automatic base image updates enabled can receive security fixes without manual intervention.

However, organizations running custom container images must rebuild and redeploy their applications to address the vulnerabilities.

Google warns that unsupported PHP versions will remain vulnerable until customers upgrade to supported releases, regardless of whether they run their applications on Google Cloud.

Separately, a recent Google Cloud outage affected Revolut, HSBC, Lloyds, and other major banks.

Google has also strengthened browser security with Gemini-powered scam detection and ClickFix protection in Chrome, while testing an option to disable Safe Browsing protection for 24 hours.