Google

App Engine Standard

Response status

Supported runtimes patched automatically

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Supported PHP 8.2+ runtimes update automatically.

What users should do

Upgrade PHP 8.1 or earlier to a supported runtime and redeploy.

Official service URL

• https://cloud.google.com/

Source URLs

1. Google Cloud: Response to PHP vulnerabilitieshttps://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence
2. https://docs.cloud.google.com/support/bulletinshttps://docs.cloud.google.com/support/bulletinsService and operation documentation

App Engine Flexible

Response status

Redeployment required

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Redeploy using a supported patched runtime.

What users should do

Update PHP in custom images and rebuild them.

Official service URL

• https://cloud.google.com/

Source URLs

1. Google Cloud: Response to PHP vulnerabilitieshttps://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence
2. https://docs.cloud.google.com/support/bulletinshttps://docs.cloud.google.com/support/bulletinsService and operation documentation

Cloud Run / Cloud Run functions

Response status

Depends on automatic updates

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Eligible PHP 8.2+ base images are patched when automatic updates are enabled.

What users should do

Update and redeploy when automatic updates are off or using custom containers.

Official service URL

• https://cloud.google.com/

Source URLs

1. Google Cloud: Response to PHP vulnerabilitieshttps://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence
2. https://docs.cloud.google.com/support/bulletinshttps://docs.cloud.google.com/support/bulletinsService and operation documentation

Google Kubernetes Engine

Response status

Customer update required

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

PHP containers require updates and redeployment.

What users should do

Rebuild images with patched PHP and redeploy Pods.

Official service URL

• https://cloud.google.com/

Source URLs

1. Google Cloud: Response to PHP vulnerabilitieshttps://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence
2. https://docs.cloud.google.com/support/bulletinshttps://docs.cloud.google.com/support/bulletinsService and operation documentation

Cloud Armor

Response status

Managed-rule mitigations

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Protections apply automatically to active managed rules.

What users should do

Enable stable File Upload and RFI rules in enforce mode, check controls for requests exceeding inspection limits, and update backend PHP to a fixed version.

Official service URL

• https://cloud.google.com/

Source URLs

1. Google Cloud: Response to PHP vulnerabilitieshttps://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence
2. https://docs.cloud.google.com/support/bulletinshttps://docs.cloud.google.com/support/bulletinsService and operation documentation

YouTube Data API / PHP client

Response status

Not listed

Response information checked

2026-10-27

Current re-audit: Official sources searched; no response found · Research date: 2026-10-27

The official PHP usage guide and API revision history were checked. The reviewed official sources do not list a YouTube-specific response to this incident.

Scope: Providing a PHP client does not establish that YouTube itself is affected or patched.

What users should do

Update the PHP runtime used by your own API application according to its hosting or distribution advisory.

Official service URL

• https://cloud.google.com/

Source URLs

1. YouTube Data API: OAuth integration with the PHP clienthttps://developers.google.com/youtube/data/guides/auth/server-side-web-apps?hl=enService and operation documentation
2. https://developers.google.com/youtube/data/revision_historyhttps://developers.google.com/youtube/data/revision_historyService and operation documentation

Apigee Drupal developer portals

Response status

Fixed images available; customer update

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

New Marketplace images and Kickstart Docker images are fixed. Existing VMs and containers are not updated automatically.

Scope: Drupal developer portals only. Apigee core, Hybrid, API hub and integrated portals are excluded.

What users should do

Patch and restart running VM PHP and update the image used by future VMs. Pull and redeploy fixed Docker images; migrate legacy Drupal portals.

Source URLs

1. https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletinshttps://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletinsResponse evidence
2. https://docs.cloud.google.com/support/bulletinshttps://docs.cloud.google.com/support/bulletinsResponse evidence

Google Cloud Marketplace (PHP solutions)

Response status

Customer update required

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

PHP-based CMS/LAMP solutions need individual remediation.

Scope: The Google Cloud infrastructure assessment does not cover deployed third-party PHP.

What users should do

Apply the solution vendor update or update PHP directly.

Source URLs

1. Google Cloud: Response to PHP vulnerabilitieshttps://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence