Mitigating CVE-2026-109618 and CVE-2026-109619 with Cloud Armor
Cloud Armor has issued recommended mitigations that use Cloud Armor managed rules. Customers with active managed rules do not need to take action; protection against these vulnerabilities is applied automatically.
If you have not yet deployed Cloud Armor managed rules, doing so now can still help you mitigate these vulnerabilities. The Cloud Armor managed rules protections are available now through automatically-updated threat intelligence rulesets.
These rules are intended to help protect your internet-facing PHP applications and services that use global or regional application load balancers. Follow these steps to deploy the rules immediately as a frontline defense-in-depth mitigation while your vulnerability management program updates and verifies all vulnerable PHP instances in your environment.
1. Deploying canary and stable managed rules (preview and enforce mode) for automatic updates:
In order to protect your workloads from these CVEs, customers should minimally enable the File Upload and RFI categories. We recommend that you configure all ruleset categories in the canary version in preview mode, and ruleset categories in the stable version in enforced mode.
2. Mitigate risk on request bodies that exceed configured inspection limits:
Create a rule in your security policies to help ensure that no uninspected or unnecessarily large content reaches your backends. This is particularly important for these CVEs, which may use large payloads to trigger out-of-memory conditions.
Verifying WAF rule safety for your application and consuming telemetry
Because PHP applications and content-management platforms (such as WordPress and Drupal) vary widely in how they structure query parameters, form submissions, and custom error handlers, we strongly recommend deploying the rules described above in preview mode first so you can test and monitor the expected impact without actively blocking traffic.
Once you’ve verified that the new rule is behaving as expected for your application traffic, disable preview mode to allow Cloud Armor to actively enforce the deny(403) action. Cloud Armor per-request web application firewall (WAF) telemetry is emitted as part of the application load balancer logs in Cloud Logging.
To inspect Cloud Armor’s decision on every request load balancer request logging first needs to be enabled on a per-backend-service basis. Once enabled, all subsequent Cloud Armor enforcement and preview decisions can be queried in Cloud Logging by following these instructions.
We recommend consulting our Cloud Armor best practices guide and accounting for service limitations (such as maximum inspected request body sizes, covered above) to minimize risk and optimize performance.
