SHIFTWIRE
Log inGet Early Access
BACK TO THE WIRE
SW-000354GOOGLE CLOUD · APP ENGINE STANDARD ENVIRONMENT, CLOUD RUN, CLOUD RUN FUNCTIONS, BUILDPACKS · PHP RUNTIME · CORE PHP VULNERABILITY PATCHHIGHACTION REQUIRED

Google Cloud patches core PHP 8.2+ vulnerabilities across multiple runtimes

Google Cloud released patched PHP runtime builds (8.5.12, 8.4.27, 8.3.36, 8.2.35) addressing unspecified 'core PHP vulnerabilities' for PHP 8.2 and later. The fix applies separately to App Engine standard environment, Cloud Run, Cloud Run functions, and Buildpacks-based deployments (google-22/google-24 tags). Workloads with automatic base image updates enabled were already patched; others require manual redeployment or rebuild from updated dependencies.

SECURITY · CLOUD · DEVOPS · SECURITY ADVISORY · VULNERABILITY

PUBLISHED OCT 23, 2026 19:47 UTC

WHAT CHANGED

On October 21 and 22, 2026, Google Cloud published security notes for App Engine standard environment PHP, Cloud Run, Cloud Run functions, and Buildpacks stating that all supported PHP 8.2+ runtimes are patched, with new versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 available. The October 21 entries for App Engine and Cloud Run were later flagged as incorrect, directing readers to the October 22 entry instead. No specific CVE identifier is given in the source for the underlying PHP issue; readers are pointed to a separate 'Responding to core PHP vulnerabilities' guidance page.

WHY IT MATTERS

Until affected workloads are redeployed or rebuilt with the updated PHP dependencies, they remain exposed to the unspecified core PHP vulnerability. Google Cloud explicitly instructs administrators to take immediate protective action by redeploying App Engine, Cloud Run, and Cloud Run functions resources, or rebuilding Buildpacks-based images, unless automatic base image updates are already enabled.

WHO IS AFFECTED

PRODUCTS
App Engine standard environment (PHP)Cloud RunCloud Run functionsBuildpacks (google-22, google-24 tags)
FEATURES
PHP runtime 8.2.xPHP runtime 8.3.xPHP runtime 8.4.xPHP runtime 8.5.x
CONFIGURATIONS
Deployments from source codeAutomatic base image updates
EXCLUSIONS
Cloud Run resources with automatic base image updates enabled are already patched

WHAT TO DO

  1. 01
    CRITICALAUTOMATABLE

    Redeploy App Engine standard environment PHP resources with updated dependencies to apply the patched PHP 8.2+ runtime versions.

  2. 02
    CRITICALAUTOMATABLE

    Rebuild and redeploy Cloud Run services deployed from source code to pick up the patched PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35).

  3. 03
    HIGHAUTOMATABLE

    Verify whether Cloud Run functions have automatic base image updates enabled; if disabled, redeploy with updated PHP dependencies immediately.

  4. 04
    HIGHAUTOMATABLE

    Rebuild Buildpacks-based PHP workloads on the google-22 and google-24 tags with the updated runtime versions.

TIMELINE

ANNOUNCED
OCT 22, 2026

SOURCES

  • TRUSTED SECONDARYGOOGLE CLOUD

    Google Cloud release notes

    PUBLISHED OCT 22, 2026VIEW SOURCE

VERIFICATION

HUMAN VERIFIEDLAST VERIFIED OCT 23, 2026 19:47 UTCREVISION 2

ShiftWire summarizes and analyzes changes from the cited sources. Always review the primary source before implementing material changes.

WAS THIS USEFUL?