- Published
- Source
- Google Cloud
- Reported by
- 12 publishers
- Filed under
- Cloud, Malware & exploits
- Vulnerabilities
- 2 CVEs
PHP and Wiz Research disclosed today two critical vulnerabilities in the core PHP language runtime that can expose applications to unauthenticated remote code execution and memory disclosure. Wiz used a mix of models to identify and help remediate these vulnerabilities. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch. While Google Cloud itself is not vulnerable, users of PHP running on Google Cloud may be vulnerable. At Google…
Cloud checks worth doing
- Know every account and subscription you run – the forgotten ones are where exposures hide.
- Nothing public by default: storage, keys and admin consoles closed to the internet, and code scanned for secrets.
- Turn on the provider's audit logs, and alert on new access keys, policy changes and anything made public.
Also reported by 6 more publishers
The vulnerabilities in this story
CVE-2026-109618 in the NVD (opens in a new tab)
- CVSS9.8Critical
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
CVE-2026-109619 in the NVD (opens in a new tab)
- CVSS9.8Critical
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
Exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog (CC0). Exploit prediction: EPSS by FIRST. This product uses the NVD API but is not endorsed or certified by the NVD.
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Exploit Public-Facing Application
Initial AccessWhat a defender checks
- Find every internet-facing instance of the affected product.
- Patch, or apply the vendor's mitigation now – CISA's KEV list gives a deadline.
- Look for signs it was exploited before you patched: web shells, new accounts, odd outbound traffic.
Build the skillBlue Team Analyst · Vulnerability Management
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Engineer · Cloud Security Engineering
Most cloud breaches are configuration. Learn to get it right.
Blue Team Engineer covers CSPM at scale, CIS hardening, cloud-native detection and response, and mapping Azure controls to AWS and GCP – configured hands-on in your own tenants.
- CSPM and CIS hardening
- Cloud-native detection and response
- Azure, AWS and GCP
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
