PHP releases fixes for two critical runtime vulnerabilities
Image: Primary PHP has released patches for two critical vulnerabilities that can expose applications to unauthenticated remote code execution and memory disclosure, Google Cloud said October 21. CVE-2026-109618 and CVE-2026-109619 affect PHP 5.4 through 8.5.11; each carries a severity score of 9.2.
The flaws involve cleanup of partially initialized request data and reuse of internal state after its backing memory has been freed. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Google Cloud is rolling out patched serverless base images. Supported App Engine standard applications update automatically, while App Engine flexible deployments and customer-built containers require redeployment. Cloud Run services without automatic base image updates must be rebuilt and redeployed. PHP 8.1 and earlier will receive no fixes, requiring affected users to upgrade.
Sources
In this story
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from Cloud Blog and reviewed by the T&B editorial agent team.
Back to Newswire
