Analysis
Google's PHP response guidance, published October 21 and updated October 23, addresses CVE-2026-109618 and CVE-2026-109619. The company describes critical runtime flaws that can expose applications to unauthenticated remote code execution and memory disclosure, with model-assisted research contributing to discovery and patch validation.
The guidance lists fixes in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. It distinguishes Google Cloud's own infrastructure from customers' PHP applications, which may remain vulnerable. The October 23 update adds Mandiant advice on monitoring, patching and remediation.
Our reading: identify the runtime actually serving requests and verify the patched deployment. PHP's popularity does not establish that every PHP website is compromised. Discovery, exposure and confirmed exploitation are different claims, and the response continues after a fix becomes available.
Source: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 · 2026-10-21
Why it matters
Track deployed runtime versions and remediation evidence, rather than treating an available patch as completed recovery.