What Happened: EnterProtect PHP Vulnerability
This EnterProtect PHP vulnerability advisory covers two critical remote code execution flaws in PHP that put Google Cloud workloads at risk. If a client runs PHP on Cloud Run, Cloud Run functions, or Google App Engine Standard, you are looking at potential server compromise, data exposure, and an expensive recovery. The fix is to redeploy affected workloads with updated dependencies and a patched PHP version.
Google Cloud published security bulletin GCP-2026-070 on 2026-10-21 to disclose CVE-2026-109618 and CVE-2026-109619. The vulnerabilities affect all PHP versions between 5.4 and 8.5. Google Cloud itself is not vulnerable, but users of the language running on Google Cloud may be. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
On 2026-10-24, Google Cloud published GCP-2026-072 to address the impact on Apigee. The two vulnerabilities, together called PHP2Shell, allow an unauthenticated attacker to execute code remotely on a server running a vulnerable PHP version. The Apigee impact is limited to Drupal-based Apigee developer portals; other Apigee products don't use PHP and aren't affected.
Timeline
Google Cloud published and updated the following bulletins.
- 2026-10-21: Google Cloud published GCP-2026-070, disclosing two critical remote code execution vulnerabilities in PHP and listing all PHP versions between 5.4 and 8.5 as affected.
- 2026-10-24: Google Cloud published GCP-2026-072, stating that the impact on Apigee is limited to Drupal-based Apigee developer portals.
- 2026-10-28: Google Cloud updated GCP-2026-070 to state that for Cloud Run, Cloud Run functions, and Google App Engine Standard, all supported versions of PHP 8.2 and later are patched.
Who Is Affected
Any client environment running a vulnerable PHP version on Google Cloud is in scope. The affected group includes:
Google Cloud itself is not vulnerable. The hardest case for MSPs is a client on PHP 8.1 or earlier, because no fixed release exists for those versions. Those workloads need an upgrade path, not just a patch.
- All PHP versions between 5.4 and 8.5
- Users of PHP running on Google Cloud
- Workloads on Cloud Run
- Cloud Run functions
- Google App Engine Standard
- Drupal-based Apigee developer portals
Technical Details
CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell, are critical vulnerabilities in PHP core. They allow an unauthenticated attacker to execute code remotely on a server running a vulnerable PHP version.
Affected language versions: all PHP versions between 5.4 and 8.5. Fixed framework versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. No fixed release exists for PHP 8.1 or earlier.
Google Cloud itself is not vulnerable. For Cloud Run, Cloud Run functions, and Google App Engine Standard, all supported versions of PHP 8.2 and later are patched as of the 2026-10-28 update. Some workloads may be automatically patched and updated to the latest PHP if they are on Google App Engine Standard or one of Cloud Run, Cloud Run functions with automatic updates enabled.
The impact on Apigee is limited to Drupal-based Apigee developer portals, which customers deploy and operate. Other Apigee products don't use PHP and aren't affected.
What MSPs Should Do
Your first move is to identify every PHP workload you manage on Google Cloud. Then redeploy with updated dependencies and verify the PHP version.
- Inventory all client workloads on Cloud Run, Cloud Run functions, Google App Engine Standard, and any other Google Cloud service running PHP.
- Check the PHP version in each workload. Any version between 5.4 and 8.5 is affected unless it is patched.
- Redeploy workloads with updated dependencies using PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- For Cloud Run, Cloud Run functions, and Google App Engine Standard with automatic updates enabled, confirm the platform updated to the latest PHP. If not, redeploy manually.
- Review Drupal-based Apigee developer portals. Follow the Apigee security bulletin for instructions and more details.
- Use Artifact Analysis notifications to identify at-risk artifacts on new and existing workloads, if your clients use it.
- For clients running PHP 8.1 or earlier, plan an upgrade to a supported PHP version. No fixed release exists for those versions.
- As a standing practice, verify that clean backups exist before you start redeploying production workloads.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of client workloads. If a PHP environment is compromised, recovery gets a client running again from a known-good image instead of a rebuild from a compromised system.
EnterProtect vulnerability scanning finds exposed versions across client environments. That helps you locate workloads that need patching and track your progress as you redeploy. This is standing security hygiene, and it matters even more during a critical PHP vulnerability event.
Frequently Asked Questions
What Are CVE-2026-109618 and CVE-2026-109619?
They are two critical remote code execution vulnerabilities in PHP core, together called PHP2Shell. An unauthenticated attacker can exploit them to execute code remotely on a server running a vulnerable PHP version. Google Cloud published GCP-2026-070 and GCP-2026-072 to document them.
Which PHP Versions Are Affected?
All PHP versions between 5.4 and 8.5 are affected. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. There is no fixed release for PHP 8.1 or earlier.
Is Google Cloud Itself Vulnerable?
No. Google Cloud itself is not vulnerable. Users of PHP running on Google Cloud may be vulnerable, so the risk is in the workloads you deploy, not the platform.
What Should I Do If a Client Runs PHP 8.1 or Earlier?
There is no fixed release for PHP 8.1 or earlier, so the vulnerable version cannot simply be patched. Plan an upgrade to a supported PHP version and redeploy the workload with updated dependencies. Until then, treat the workload as high risk and limit exposure.
Were Cloud Run, Cloud Run Functions, and App Engine Standard Workloads Automatically Patched?
Some workloads may be automatically patched and updated to the latest PHP if they are on Google App Engine Standard or one of Cloud Run, Cloud Run functions with automatic updates enabled. As of the 2026-10-28 update, all supported versions of PHP 8.2 and later on those services are patched. Confirm the deployed version before assuming a workload is safe.
Does This Affect Apigee?
The impact on Apigee is limited to Drupal-based Apigee developer portals, which customers deploy and operate. Other Apigee products don't use PHP and aren't affected. See the Apigee security bulletin for instructions.
Sources
- GCP-2026-070 (Google Cloud Security Corrected)
- GCP-2026-072 (Google Cloud Security Corrected)