PHP Remote Code Execution Vulnerability Hits All Versions Between 5.4 and 8.5

What Happened

Two remote code execution bugs in PHP put client workloads at risk, and the fix lands on you. If a client runs a vulnerable version on Google Cloud, an attacker can execute code remotely without authentication. Google Cloud says customers should take immediate action to protect their workloads by redeploying them with updated dependencies. The PHP remote code execution vulnerability affects all PHP versions between 5.4 and 8.5, according to Google Cloud. Google Cloud itself is not vulnerable, but users of the language running on Google Cloud may be.

Google Cloud says some workloads may be automatically patched if they are on Google App Engine Standard or one of Cloud Run, Cloud Run functions with automatic updates enabled. For everyone else, this is a manual patch and redeploy job. Cisco says the PHP Foundation announced the release on October 21. The vulnerabilities are being referenced as PHP2shell.

Timeline

1. October 21: The PHP Foundation announced a Critical PHP Security release addressing CVE-2026-109618 and CVE-2026-109619, according to Cisco.
2. October 21: Google Cloud published bulletin GCP-2026-070 about the vulnerabilities.
3. October 24: Google Cloud published bulletin GCP-2026-072, which names the bugs PHP2Shell and says no fixed release exists for PHP 8.1 or earlier.
4. October 28: Google Cloud updated GCP-2026-070, saying all supported versions of PHP 8.2 and later on Cloud Run, Cloud Run functions, and Google App Engine Standard are patched.
5. October 28: Fortinet revised its advisory.
6. November 5: Fortinet revised its advisory again.

Who Is Affected

Any client running a vulnerable PHP version is exposed. Google Cloud says all PHP versions between 5.4 and 8.5 are affected. That covers applications on Cloud Run, Cloud Run functions, and Google App Engine Standard. Google Cloud says Apigee impact is limited to Drupal-based Apigee developer portals, which customers deploy and operate. Other Apigee products do not use PHP and are not affected.

Google Cloud says no fixed release exists for PHP 8.1 or earlier. If a client is still on PHP 8.1 or older, there is no patch to apply. The only path is a version upgrade or migration. As a standing practice, check shared hosting, custom applications, and legacy line-of-business tools first, because those are often the last to get a runtime update.

Technical Details

Two CVEs are in scope. CVE-2026-109618 is remote code execution via out-of-memory corruption. CVE-2026-109619 is remote code execution via stale global state. Google Cloud says in bulletin GCP-2026-072: "Two vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619 (\"PHP2Shell\"), allow an unauthenticated attacker to execute code remotely on a server running a vulnerable PHP version." Cisco says the vulnerabilities are being referenced as PHP2shell.

Fortinet's PSIRT advisory gives a CVSSv3 score of 5.3 and describes CVE-2026-109618 this way: "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory."

For CVE-2026-109619, Fortinet says: "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized."

Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to Google Cloud. Cisco says the security release addresses both critical vulnerabilities. The attack vector is remote and unauthenticated.

Why This PHP Remote Code Execution Vulnerability Matters

A remote code execution bug on a client server means an attacker can run their own code. No credentials are needed, and no user action is required. That can lead to data theft, ransomware, or a full server rebuild. The cost to an MSP is not just the patch. It is the emergency hours, the client calls, and the risk of lateral movement into the rest of the client network.

The fix itself is straightforward: update PHP and redeploy. The hard part is knowing where PHP runs. Many MSPs do not have a complete inventory of language runtimes across client websites, web applications, and third-party products. When a critical patch lands, that gap turns a routine update into a scramble. As a standing practice, keep a runtime inventory and a patching schedule that covers open-source language dependencies, not just operating systems.

What MSPs Should Do

Take these steps now. Check your client environments for any PHP version between 5.4 and 8.5.

1. Identify every client workload running PHP versions between 5.4 and 8.5.
2. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
3. Redeploy workloads with updated dependencies, as Google Cloud tells customers to do.
4. Check if workloads on Google App Engine Standard, Cloud Run, or Cloud Run functions have automatic updates enabled. Google Cloud says some may be automatically patched.
5. For PHP 8.1 or earlier, no fixed release exists. Plan a version upgrade or migration for those clients.
6. As a standing practice, keep an inventory of language runtimes and end-of-life dates across all client environments.
7. Before you patch, make sure you have a clean backup and a tested restore path. A failed update can cause an outage.

How EnterProtect Helps

EnterProtect backup keeps clean restorable copies of client workloads. If a patch goes wrong or an attacker causes damage, you can restore from a known good state. EnterProtect recovery gets a client running again after an incident, so an outage does not turn into a multi-day rebuild. EnterProtect vulnerability scanning finds exposed versions across your client base as a standing practice.

These tools do not replace patching. They reduce the blast radius when patching is delayed, when a client refuses an update, or when a threat moves faster than your maintenance window. For MSPs, that means fewer emergency calls and a clearer path back to normal.

Frequently Asked Questions

What Is CVE-2026-109618?

CVE-2026-109618 is a remote code execution vulnerability in PHP core. Google Cloud describes it as RCE via out-of-memory corruption. Fortinet's PSIRT says PHP uses longjmp() for out-of-memory errors, and some contexts may leave request memory in an uninitialized state. An unauthenticated attacker can execute code remotely on a server running a vulnerable PHP version.

Which PHP Versions Are Affected by CVE-2026-109618 and CVE-2026-109619?

Google Cloud says all PHP versions between 5.4 and 8.5 are affected. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. No fixed release exists for PHP 8.1 or earlier.

Is Google Cloud Itself Vulnerable to These PHP Bugs?

Google Cloud says Google Cloud itself is not vulnerable. However, users of the PHP language running on Google Cloud may be vulnerable. That includes workloads on Cloud Run, Cloud Run functions, and Google App Engine Standard.

How Do I Fix a Vulnerable PHP Installation?

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Then redeploy your workloads with updated dependencies, as Google Cloud tells customers to do. Some workloads on Google App Engine Standard or Cloud Run or Cloud Run functions with automatic updates enabled may be patched automatically. For PHP 8.1 or earlier, there is no fixed release, so you need to upgrade to a supported version.

Are These PHP Vulnerabilities Being Exploited in the Wild?

The sources do not say these specific vulnerabilities are being exploited. Google Cloud and Cisco describe them as critical and tell customers to take immediate action. Treat them as urgent even without confirmed exploitation.

What Should MSPs Tell Clients About the PHP2Shell Vulnerabilities?

Tell clients that two critical PHP bugs require a version update and a redeploy. The vulnerabilities are being referenced as PHP2shell, according to Cisco. If a client runs PHP 8.1 or earlier, explain that no patch exists and a migration is needed. Set expectations for a maintenance window because redeploying workloads can cause brief downtime.

Sources

• PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619) (Fortinet Psirt)
• Vulnerabilities in PHP Affecting Cisco Products: October 2026 (Cisco Psirt)
• GCP-2026-070 (Google Cloud Security Corrected)
• GCP-2026-072 (Google Cloud Security Corrected)