Cybersecurity

PHP2Shell on Google Cloud: Who Has to Redeploy?

App Engine Standard can receive PHP fixes automatically. App Engine Flexible and customer-owned images still need deployment work.

22 October 20262 min read4 min listen

Listen to the audio analysis

Create your own

Written for builders and creators.

A PHP security update can be available on Google Cloud while your application still runs the vulnerable PHP inside an older container.

Editor's note

Why this matters now

Google Cloud is rolling out PHP2Shell fixes, but some applications need a new deployment before they can use them. Its response to the 2 critical PHP flaws explains which services receive automatic runtime updates and which leave that step to the application’s owner.

Supported App Engine Standard runtimes update automatically. App Engine Flexible requires a redeployment. If your team builds its own container image, updating PHP inside that image and deploying the replacement remains your responsibility. A patched base image sitting in a registry does little for an application still running the old one.

The source

What it says

Distilled from the original. The notes above and below are the editor's own.

Which Deployments Receive the Fix Automatically?

The patched upstream releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Google’s instructions differ according to how the application gets its PHP runtime.

Deployment	How the Patched Runtime Reaches the Application
App Engine Standard on supported PHP runtimes	Google updates the runtime automatically.
App Engine Standard on unsupported PHP runtimes	The application owner moves to a supported patched runtime and redeploys.
App Engine Flexible	The application owner redeploys with a supported patched runtime. Custom images also need PHP updated inside them.
Cloud Run or Cloud Run functions using a supported Google base image with automatic updates enabled	Google supplies the patched runtime through automatic base image updates.
Cloud Run without automatic base image updates	The application owner rebuilds and redeploys with patched PHP. Functions without automatic updates also need redeployment.
GKE and customer-owned container images	The application owner updates the image and redeploys the workloads using it.

Google’s infrastructure can be unaffected while a customer’s PHP workload remains vulnerable. The runtime packaged with that workload determines whether the vulnerable code is still running.

What Cloud Armor Can Block

Google recommends Cloud Armor’s file-upload and remote-file-inclusion rules to help block attacks while applications receive the PHP update. Preview mode lets teams see which legitimate requests the rules would reject before enabling enforcement.

Request size needs separate attention. Cloud Armor inspects request bodies up to a configured limit. Content beyond that limit can reach PHP uninspected, so Google also recommends rules to control oversized or uninspected bodies. An enabled ruleset alone leaves that limit unchanged.

Older PHP Versions Have Different Update Options

Google directs customers on unsupported runtimes to upgrade to a supported, patched version. Its broader claim that fixes for PHP 8.1 and earlier are unavailable conflicts with the PHP maintainers’ notice. PHP supplied exceptional minimal source backports for 7.4, 8.0 and 8.1, and some package vendors provide fixes. Those source patches do not extend Google’s runtime support or restore ordinary upstream maintenance.

The stale-state vulnerability, CVE-2026-109619, can also allow code execution as well as memory disclosure. Both flaws warrant a runtime update.

Editor's note

What to do with this

A managed service can remove the need to administer a server while still leaving application deployments to your team. For PHP2Shell, the decisive difference is whether Google replaces the runtime beneath an existing deployment or your team has to ship a new one. The application keeps using its previous PHP runtime until the update mechanism replaces it or a new deployment takes over.

The original

Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Google Cloud · 21 October 2026