PHP patched two critical vulnerabilities posing remote-code-execution and memory-disclosure risks; affected versions span 5.4–8.5.11.

PHP and Wiz Research disclosed CVE-2026-109618 and CVE-2026-109619, two core-runtime vulnerabilities associated with unauthenticated remote code execution and memory disclosure. Each received a Common Vulnerability Scoring System base score of 9.2, classified as Critical; Google says its cloud platform itself is not vulnerable, but customer PHP applications running on it may be.

The first flaw involves out-of-memory handling interrupting partially initialized internal request data, which cleanup can subsequently treat as valid. The second allows request-owned state to survive after its backing memory is freed, exposing a later request handled by the same worker to stale state.

Affected versions span PHP 5.4 through 8.5.11, with fixes in 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP is not releasing fixes for end-of-life 8.1 or earlier. Google urges customers to update and redeploy on a patched supported version, noting automatic patching for supported App Engine standard runtimes and redeployment requirements for flexible environments; it also credits Gemini 4 Argon with contributions to discovery, exploit development, detection, and patch validation.

A Telegram report attributes to AWS the discovery of exploitation in its MadPot system before public disclosure and a statement that exploitation was widespread, while noting uncertainty about how attackers obtained the information. Dutch authorities advised taking vulnerable systems offline until patched, and South Korea’s internet-security agency likewise urged updates and migration from unsupported PHP versions.