cloud (IaaS)

Google Cloud: security status

customer-managedofficial notice · 2026-10-21

Summary

Google Cloud bulletin GCP-2026-070 (published 2026-10-21): Google Cloud itself is not vulnerable, but customer workloads running PHP 5.4-8.5 may be. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Workloads on App Engine standard, Cloud Run, and Cloud Run functions with automatic updates may be patched automatically; others must be redeployed with updated dependencies. Bulletin GCP-2026-072 (Oct 24) adds that on Apigee only the Drupal-based developer portals, which customers deploy and operate, are affected; other Apigee products do not use PHP.

Customer action:

If PHP runs on Compute Engine or similar, ask your administrator to update PHP to a fixed release and redeploy. On App Engine standard or Cloud Run, confirm the running version is a fixed one. If you run a Drupal-based Apigee developer portal, update its PHP too.

Source: https://docs.cloud.google.com/support/bulletins
Verified: 2026-10-26

IaaS/PaaS. On Compute Engine and similar, the customer runs PHP.

How this tool recognises the provider

AS numbers: AS15169AS396982
Text in the AS name: GOOGLE-CLOUD
Name servers: *.googledomains.com

Report a correction (GitHub)