Google Cloud GCP-2026-070 Warns of Critical PHP RCE Flaws
Tech GuruQuick Answer
Google Cloud published GCP-2026-070 for CVE-2026-109618 and CVE-2026-109619 in customer PHP workloads. Inventory deployed runtimes, redeploy supported fixed PHP versions, verify automatic-update claims against active revisions, restart workers, and retain deployment evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Google Cloud PHP workloads, versions, SAPIs, images, update modes, exposure, and owners; redeploy supported fixed releases; migrate unsupported branches; verify each active revision and worker pool; test representative requests; and retain evidence.
Last verified: 2026-10-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Customer-managed PHP workloads running on Google Cloud |
|---|---|
| Advisory | GCP-2026-070 / GHSA-w8hw-w9fx-j79w / GHSA-6wmf-4rv5-p3rp |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Authoritative release date | 2026-10-21 00:00:00 UTC |
| Authority revision date | 2026-10-21 04:49:22.331848 UTC |
| Affected versions | Google identifies PHP versions from 5.4 through 8.5 as potentially affected in customer workloads; the PHP project identifies supported branches before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as affected. |
| Fixed version | Redeploy with PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 as applicable; unsupported PHP branches require migration to a supported fixed branch. |
| CVSS base score | 9.2 (CVSS v4.0) |
| CVSS severity | Critical |
| Exploitation status | Google and the PHP project do not state that these vulnerabilities are being maliciously exploited in the wild.; no exploitation claim is inferred. |
What Changed
Google Cloud warned that two PHP request-lifecycle flaws can allow remote code execution in customer workloads. Google Cloud itself is not vulnerable; customers must verify runtime and automatic-update behavior for their own deployments.
What To Validate Now
- Inventory. Identify PHP workloads on App Engine, Cloud Run, Cloud Run functions, GKE, Compute Engine, and other Google Cloud services; record runtime, SAPI, version, base image, dependency source, update mode, exposure, and owner.
- Establish applicability. Match each workload to its actual PHP version and update mode. Do not infer that a workload is patched merely because its service can support automatic updates; verify the deployed runtime or image.
- Remediate. Redeploy with the supported fixed PHP release or a vendor image containing the fix. Migrate unsupported branches and use PHP's documented interim mitigations only as temporary risk reduction.
- Validate. Confirm the runtime in every active revision, restart or replace workers, test representative requests and failure handling, scan artifacts where available, and retain deployment and runtime evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Google Cloud infrastructure is not itself affected, but customer workloads can be. Some managed workloads may update automatically; verify the running version rather than assuming coverage. PHP states that updating is the only complete mitigation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
