Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
PHP and Wiz Research disclosed today two critical vulnerabilities in the core PHP language runtime that can expose applications to unauthenticated remote code execution and memory disclosure. Wiz used a mix of models to identify and help remediate these vulnerabilities.
Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.
While Google Cloud itself is not vulnerable, users of PHP running on Google Cloud may be vulnerable. At Google Cloud, we understand the severity of these vulnerabilities, and are sharing guidance to help our customers take immediate action to secure their applications.
Vulnerability background
PHP is a widely-used, server-side scripting language that powers many websites, content management systems, and web applications. On Oct. 21, 2026, CVE.org assigned the vulnerabilities as CVE-2026-109618 and CVE-2026-109619.
The official Common Vulnerability Scoring System (CVSS) base severity score for each of the PHP flaws...
Copyright of this story solely belongs to cloud.google.com. To see the full text click HERE
