Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed, posing risks of unauthenticated remote code execution and memory disclosure. These flaws, with a CVSS score of 9.2, affect PHP versions 5.4 through 8.5.11 according to Wiz Research and PHP. The vulnerabilities stem from issues with out-of-memory handling and stale internal request state. Google Cloud is advising its users to immediately update their PHP applications to version 8.2 or newer and redeploy them. Specific guidance is provided for App Engine, Cloud Run, and Google Kubernetes Engine users. While Google Cloud itself is not vulnerable, customer applications running PHP on its platform may be affected. The PHP project has released patches for newer versions, but older, end-of-life versions will not be fixed. Google Cloud is rolling out automatic patches for certain serverless platforms. Users with custom container images must rebuild and redeploy them with patched PHP versions. Monitoring tools like On-Demand Scanning AP and Security Command Center can help identify and detect vulnerable workloads. Updating PHP is crucial to secure applications and maintain service integrity.