# PHP releases fixes for two critical runtime vulnerabilities

_Published Wednesday, October 21, 2026 at 10:23 AM EDT · Security, Infrastructure · Latest · Tier 2 — Notable_

![PHP releases fixes for two critical runtime vulnerabilities — Primary](https://storage.googleapis.com/gweb-cloudblog-publish/images/17_-_Security__Identity_NrORvDT.max-2600x2600.jpg)

PHP has released patches for two critical vulnerabilities that can expose applications to unauthenticated remote code execution and memory disclosure, Google Cloud said October 21. CVE-2026-109618 and CVE-2026-109619 affect PHP 5.4 through 8.5.11; each carries a severity score of 9.2.

The flaws involve cleanup of partially initialized request data and reuse of internal state after its backing memory has been freed. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Google Cloud is rolling out patched serverless base images. Supported App Engine standard applications update automatically, while App Engine flexible deployments and customer-built containers require redeployment. Cloud Run services without automatic base image updates must be rebuilt and redeployed. PHP 8.1 and earlier will receive no fixes, requiring affected users to upgrade.

## Sources

- [Cloud Blog](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619/)

---
Canonical: https://techandbusiness.org/newswire/LQt-dzpDwfuMd_n55OCYK_
Published: 2026-10-21T14:23:22.210Z
Story chronology: 2026-10-21T14:00:00.000Z
Retrieved: 2026-10-25T06:20:25.199Z
Publisher: Tech & Business (techandbusiness.org)