Google Cloud and Wiz Research have disclosed two critical vulnerabilities in the core PHP language runtime, identified as CVE-2026-109618 and CVE-2026-109619. These flaws can expose applications to unauthenticated remote code execution and memory disclosure. The vulnerabilities were uncovered using a mix of models, with Gemini 4 Argon playing a key role in their identification, exploit development, attack detection, and patch validation.
The vulnerabilities affect all versions of PHP from 5.4 through 8.5.11. CVE-2026-109618 involves out-of-memory handling that can interrupt PHP while internal request data is only partially initialized, leading to invalid data being treated as valid. CVE-2026-109619 involves request-owned internal state that can survive after its backing memory has been freed, potentially allowing a later request to use stale state.
Google Cloud has urged all customers running PHP applications to immediately update to PHP 8.2 or newer and redeploy their services. The company is rolling out updated serverless base images for all supported PHP versions on various platforms, including App Engine, Cloud Run, and Cloud Functions for Firebase. However, applications using PHP 8.1 or earlier remain vulnerable, as the PHP project is not releasing fixes for these end-of-life versions.
To mitigate the risks, Google Cloud recommends using the On-Demand Scanning API to manually scan images and enabling container threat detection for Google Kubernetes Engine and Cloud Run. The company will continue to monitor the situation and provide further updates as necessary.