Google Cloud said PHP and Wiz Research disclosed two flaws on October 22 that could let attackers run code remotely without authentication and expose memory.

Google Cloud is not affected, but customers running PHP applications on the platform may be vulnerable.

The flaws affect PHP versions 5.4 through 8.5.11.

Patches are available in 8.2.35, 8.3.36, 8.4.27, and 8.5.12. 8.1 and earlier will not receive upstream fixes.

PHP tracks versions through support and end-of-life pages.

Google’s response said supported App Engine standard runtimes update automatically. App Engine flexible users must redeploy.

Google Kubernetes Engine users must update container images and redeploy pods.

Cloud Run services with automatic base image updates enabled receive updates automatically; services without that setting must be rebuilt and redeployed.

Cloud Armor managed rules can help mitigate the flaws, but they are not a substitute for patching.

Users who have not enabled the rules can do so and should test them in preview mode first.

Reviewed snippets from the US Cybersecurity and Infrastructure Security Agency did not show whether the flaws appear in its catalog of known exploited vulnerabilities.

🔗 Source: Google Cloud

Recent Google Cloud developments